Secure Shell (SSH) essentials: a hands-on guide

Configure the open ssh server and client, edit sshd_config, and restart sshd; understand why changing the default port is not a strong security measure against reconnaissance using nmap and telnet.

Configure sshd to listen on a specific address and protocol by setting the address family to inet or inet6 and restarting sshd to apply changes.

Examine SSH host keys and public-private encryption, then configure a login banner and a message of the day to inform users before and after login.

control ssh access by listing deny and allow users and groups, showing how deny overrides allow and enabling service accounts like Oracle to be restricted from remote login.

Disable direct root login in ssh by setting permit root login to no and prefer public key authentication; administrators should use their own accounts and sudo to gain root privileges.

Learn to use the native SSH command across macOS, Linux, Unix, and Windows to connect to remote hosts, with or without a user name, and with the -l option.

Create a dot ssh directory with restrictive permissions, add a per-user config to override global ssh settings, and set port 2222 using the command line option -p.

Save ssh client settings per user by using host blocks, wildcards, and a default user in the config file to manage connections to multiple machines.

Master PuTTY tips for SSH connections, including saving default and per-session settings, using custom ports like 2222, enabling keepalive to prevent idle disconnects, and migrating settings between Windows machines.

Demonstrate how FTP credentials are sent in clear text and exposed by a packet sniffer like Wireshark, using Vsftpd on CentOS and an FTP client on Ubuntu.

Master the scp command for secure file transfers between local and remote hosts, replacing rcp with encrypted copies and optional directory transfers via -r.

Learn to use the WinSCP client for Windows to transfer files via scp and sftp, by installing, configuring a site, and dragging files between Windows host and CentOS remote.

Master mobaxterm's ssh and sftp capabilities on windows to connect to a remote ubuntu host. Use the built-in ftp browser to upload and download files, choosing destinations like your desktop.

Master sftp, a drop-in replacement for ftp, for encrypted transfers over ssh, and learn to upload, download, delete or rename files with get, put, lcd, and dash r.

Learn how scp and sftp differ from ssh command options, and how to change default ports using ssh_config, with per-user host entries and Windows session tips for seamless file transfers.

Learn how hosting providers chroot sftp users to their home directories, using internal-sftp, restricted groups, and sshd rules to prevent ssh access.

Explore how key-based authentication replaces passwords with public and private keys to securely authenticate SSH users and prevent brute force attacks.

Generate an ssh key pair with ssh-keygen, and protect the private key with a passphrase. Store the public key on remote hosts and enforce strict key permissions.

Use a public key placed in the server's authorized_keys to enable passwordless login with your private key, unlock it via a passphrase, and let the ssh agent manage it.

Use the ssh-copy-id command to upload your public key to the remote host and enable passwordless login via the remote account's authorized_keys; if unavailable, manually copy the key into authorized_keys.

learn how to generate a public private key pair with puttygen on Windows, copy the public key to the host's authorized_keys, and connect using a private key with a passphrase.

Enable pageant to start at Windows boot and auto-load your keys by placing a Pageant shortcut in the startup folder and using command line arguments for key files.

On a text-only terminal, start ssh-agent with your shell (bash via /bin/bash) and run ssh-add to load your private key passphrase, enabling password-free access to the Ubuntu host.

Enforce key-based ssh logins by setting ChallengeResponseAuthentication to no and PasswordAuthentication to no, ensure PubkeyAuthentication is enabled, then restart sshd and verify non-key users are blocked.

Grant temporary password access to a new users group in sshd_config using a match block, then copy public keys with ssh-copy-id and later disable password login to enforce key-based authentication.

Enable agent forwarding to hop from one server to another using a running ssh agent, outlining steps for the remote host, the client, and the first hop authentication.

Discover how multi-factor authentication strengthens SSH security by adding a second verification factor beyond keys, with Google Authenticator, YubiKey, RSA SecurID, and practical setup steps for Ubuntu and CentOS.

Enable MFA on Ubuntu and CentOS using Google Authenticator, configure PAM and sshd with keyboard-interactive, scan QR codes, and require tokens alongside passwords or private keys.

Mount a remote Linux file system locally with sshfs to access and edit remote files as if they were on your Linux machine, securely via ssh.

Mount a remote Linux filesystem on Windows using the VS Code remote ssh extension or sshfs with WinSshfs to develop on Windows while code runs on Linux.

Discover how X11 forwarding over SSH forwards the remote server's graphical user interface to your client, enabling GUI programs and installers to run without physical data center access.

Configure ssh X11 forwarding on the server (ubuntu) and the client (centos) to run graphical apps like firefox from the remote host on the local client, with optional trusted forwarding and compression.

Enable X11 forwarding on Windows by installing an X server (Xming) and configuring PuTTY, then run graphical apps like Firefox from an Ubuntu server securely over SSH.

Discover how to use ssh for X11 forwarding: run a single remote command with -f, enable one-time X11 forwarding with -X, and disable global X11 forwarding for secure, temporary access.

Explore SSH tunnels, including local, remote, reverse, and dynamic port forwarding, to encrypt TCP/IP traffic between a client and host and secure http connections without server-side https.

Learn to set up a local ssh tunnel with -L to forward a local port (8080) to a remote service, securing http traffic through an encrypted connection.

Use SSH local port forwarding to tunnel telnet traffic from the local port 2323 to the remote telnet port 23, encrypting insecure telnet inside SSH.

Create a local ssh tunnel with putty on windows to access a remote web server on port 80 via local port 8080. Open localhost:8080 to view server1.aharoni.com with encrypted traffic.

Demonstrate reverse ssh port forwarding to bypass firewalls and access a local machine behind NAT via a remote host such as an EC2 instance.

Learn dynamic port forwarding with SSH to create a SOCKS5 proxy that tunnels your traffic through a remote host, bypassing regional restrictions while keeping data encrypted.

Create a dynamic ssh tunnel (socks5 proxy) using PuTTY, configure Firefox to use the proxy at localhost, and verify the remote IP to confirm the proxy is active.

Learn to start ssh tunnels in the background with -N and -f, enabling local and remote port forwarding without an interactive shell.

Examine local and remote ssh port forwarding and how binding to localhost enhances security. Understand binding to all interfaces with 0.0.0.0 and explore reverse port forwarding.

Master controlling public access to a reverse SSH tunnel, binding to localhost by default and using 0.0.0.0 to expose the tunnel on all interfaces, with security considerations.

Establish a local SSH tunnel through a gateway to reach a remote host behind a firewall, using local port forwarding to bind localhost:8080 to remote:80 via a jump server.

Explore how your local machine can act as a gateway between two firewalled hosts using reverse port forwarding, enabling server one to reach server two on port 8080.