使用 SSH 安全远程访问

Secure Shell (SSH) is a powerful network protocol that lets you connect to remote computers securely. It creates an encrypted tunnel between your local machine and a remote server.

SSH is essential for:

• Executing commands on remote servers.
• Securely transferring files.
• Creating secure tunnels for other network services.

It's a foundational tool for managing Linux servers remotely and securely.

SSH operates on a client-server model. Your local machine acts as the client, and the remote server runs an SSH daemon (the server software).

When you initiate a connection, the client and server perform a cryptographic handshake. This establishes a secure, encrypted channel, protecting all data exchanged from eavesdropping or tampering.

This strong encryption and identity verification make SSH safe to use even over untrusted networks like the internet.

To connect to a remote server, you'll need its IP address or hostname, and a valid username on that server. The basic command is simple:

When connecting for the first time, SSH will prompt you to verify the host's identity and add its fingerprint to your ~/.ssh/known_hosts file. Always verify this fingerprint if possible!

While passwords work, SSH keys offer a more secure and convenient way to authenticate. They eliminate the need to type your password for every connection.

An SSH key pair consists of two parts:

• A private key: Kept secret on your local machine.
• A public key: Shared with remote servers you want to access.

During connection, the server uses your public key to encrypt a challenge. Only your private key can decrypt it, proving your identity without ever sending your password over the network.

You can generate your own SSH key pair on your local machine using the ssh-keygen command. It's recommended to use a strong passphrase to protect your private key.

The command will ask where to save the keys (default is ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub) and for an optional passphrase.

To enable key-based authentication, your public key needs to be copied to the remote server. It should be placed in the ~/.ssh/authorized_keys file within your home directory on the remote server.

The simplest way to do this is using the ssh-copy-id utility:

Alternatively, you can manually copy the contents of your id_rsa.pub file and append it to the remote server's ~/.ssh/authorized_keys file.

The Secure Copy Protocol (SCP) allows you to securely copy files and directories between local and remote hosts, or even between two remote hosts.

SCP uses SSH for data transfer and authentication, ensuring your files are encrypted throughout the process.

• To copy a local file to a remote server:

Similarly, you can easily copy files from a remote server to your local machine using SCP:

• To copy a remote file to your local machine:

Remember to specify the full path for both source and destination to avoid errors.

SSH can create secure "tunnels" to forward network traffic. Local port forwarding lets you access a service on a remote network as if it were running on your local machine.

This is extremely useful for accessing services behind a firewall or on an internal network.

Command syntax: ssh -L local_port:target_host:target_port user@ssh_server

Example: Access a web server (port 80) on internal_web_server from your local browser via localhost:8080.

Which of the following statements about SSH are TRUE?

Great job! You've learned the essentials of SSH for secure remote access.

• We covered basic SSH connection using ssh username@host.
• Explored SSH key-based authentication, generating keys with ssh-keygen and deploying them with ssh-copy-id.
• Understood how to securely transfer files using SCP.
• Learned about local port forwarding to tunnel traffic securely.

SSH is an indispensable tool for any developer or system administrator. Keep practicing these commands to master remote server management!