Basic Guide to SSH

The goal of this guide is to familiarize you with the ssh cli through basic examples that go 80% of the way.

What’s SSH?

SSH stands for (S)ecure (SH)ell. It is a protocol, a set of rules for communication between computers, built specifically for shell access. With it you can safely connect to a remote machine and run shell commands like ls -la.

Just like any other protocol, bluetooth, torrent, tcp/ip - it’s useless by itself, and requires an actual client (software) that implements the protocol. So just like you use qbittorrent to implement torrent protocol, you use openssh to implement ssh. Now there are gui clients like cyberduck, filezilla and many more but for any serious work you will be defaulting to openssh. Let’s install it.

Install SSH Client

Get your favorite package manager and run the install command

# Ubuntu/Debian
sudo apt install openssh-client

# macOS (if missing)
brew install openssh

# Windows (choose one)
winget install OpenSSH
choco install openssh

Congrats! First step done. Run ssh in the terminal to see the available commands, and man ssh to read the manual.

Generate Your First SSH Key

Next step is to set up your password, well, a “key” to be precise.

SSH uses pair keys called:

• private key, this one stays on your computer
• public key, which you place on the server

run the command to generate the two:

# Email is just for identification
ssh-keygen -t ed25519 -C "your-email@example.com"

ssh-keygen is provided by openssh cli so no need to install anything else

-t specifies encryption type

-C adds a comment, usually your email, so you can tell your keys apart later

you can set these variables manually and simply run ssh-keygen

How does ssh trust work?

To execute commands securely (the first S, remember?) you need to establish trust between two keys. Your server holds the public key, you hold the private one.

The handshake goes like this:

1. Your ssh client asks the server to connect.
2. The server responds with a “challenge”, asking you to sign some data.
3. Your client signs it with the private key and sends the answer back.
4. The server verifies the answer with the public key.

$ ssh user@server
server: sign this → 7c2e91af
laptop: signed it → 3b0f6d2a
server: matches id_ed25519.pub
Welcome to Ubuntu 24.04 LTS

Notice that this requires your server to have your public key! Let’s give it one.

Connecting to remote

Now that you have your own ssh key, it is time to use it. For the next step you’ll need to know:

• your server ip
• username
• password

Now run the following command to copy your public key to the server. Of course, replace it with real credentials, and wait for the command to ask you for the password

ssh-copy-id username@server-ip
# provided by open-ssh client

You can also do this part manually by copying your public key to server files if any issue arises. More on this in the next section.

And don’t worry, you will only need the password this one time. Once the key exists on your target machine, next login would only need to specify the username and location and the client will automatically answer the challenge for you! cool right?

You can further simplify this by using alias, more on this here

Do It Manually

Run the following commands in order

# Copy public key content
cat ~/.ssh/id_ed25519.pub # run this to see the public key on your machine

# Connect to server using your password
ssh username@server-ip
mkdir -p ~/.ssh # just like on your computer, server needs .ssh directory
echo "paste-public-key-here" >> ~/.ssh/authorized_keys # this will create a file authorized_keys with your key there
chmod 600 ~/.ssh/authorized_keys # change permission so that your server will be able to access the file
chmod 700 ~/.ssh # change permission so that your server will be able to access the directory

this might seem harder, but in essence you just log in to your server and paste the key

Change Passphrase of Your Key

Usually ssh keygen adds a passphrase to the key. This is a good practice to have since the key is stored as plain text on your machine. But it is annoying and I don’t use it. So in case you already have your ssh key from before, and want to use it without having to type the passphrase each time, you can replace the passphrase as shown below

# Default key
ssh-keygen -p

# Specific key
ssh-keygen -p -f ~/.ssh/custom_key_name

Alias SSH

To make the experience even nicer add an alias for your server. Find your SSH config location, usually in .ssh:

vim ~/.ssh/config

Configure the host:

# Simple alias
Host myserver
    HostName 192.168.1.100
    User john

After that you can just run:

ssh myserver

and instantly connect!

See also: moving a cPanel account from the command line and a free SSL certificate with Certbot, two things you will do once you are in.