SSH - Secure connection

---

Table of contents

1. What is SSH?
2. Basic connection
3. SSH keys: generation and use
4. ssh-agent and key management
5. Configuration ~/.ssh/config
6. scp and rsync
7. Hands-on exercises

---

1 - What is SSH?

SSH (Secure Shell) is a secure communication protocol for:

• Connecting remotely to a server
• Transferring files
• Running commands
• Creating tunnels

Advantages of SSH

Aspect	Description
Encryption	All data is encrypted
Authentication	Password or keys
Integrity	Detection of modifications
Port forwarding	Secure tunnels

Default port

SSH uses port 22 by default.

🔝 Back to table of contents

---

2 - Basic connection

Syntax

ssh [options] [user@]hostname [command]

Examples

# Connexion simple
ssh serveur.example.com

# Avec utilisateur
ssh [email protected]

# Port différent
ssh -p 2222 [email protected]

# Exécuter une commande
ssh [email protected] "ls -la"

# Mode verbeux (debug)
ssh -v [email protected]

First connection

The authenticity of host 'serveur.example.com (192.168.1.100)' can't be established.
ED25519 key fingerprint is SHA256:abc123...
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

tip

Answer yes only if you are sure you are connecting to the right server! The fingerprint is stored in ~/.ssh/known_hosts.

Useful options

Option	Description
-p PORT	SSH port
-l USER	User
-i FILE	Specific private key
-v	Verbose mode (debug)
-N	No command (for tunnels)
-f	Go to the background
-L	Local port forwarding
-R	Remote port forwarding

🔝 Back to table of contents

---

3 - SSH keys: generation and use

Key-based authentication

Advantages:

• More secure than passwords
• No need to type the password
• Automated authentication

Generate a key pair

# ED25519 (recommandé)
ssh-keygen -t ed25519 -C "[email protected]"

# RSA 4096 bits (alternative)
ssh-keygen -t rsa -b 4096 -C "[email protected]"

Interactive dialog:

Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/john/.ssh/id_ed25519): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/john/.ssh/id_ed25519
Your public key has been saved in /home/john/.ssh/id_ed25519.pub

Generated files

File	Description	Permissions
~/.ssh/id_ed25519	Private key (SECRET!)	600
~/.ssh/id_ed25519.pub	Public key	644

danger

The private key must NEVER be shared! Only the public key (.pub) is copied to the servers.

Copy the public key to a server

# Méthode automatique (recommandée)
ssh-copy-id [email protected]

# Méthode manuelle
cat ~/.ssh/id_ed25519.pub | ssh john@serveur "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

# Ou copier manuellement
# Sur le serveur, ajouter le contenu de id_ed25519.pub dans :
# ~/.ssh/authorized_keys

Verify the key-based connection

# Connexion sans mot de passe
ssh [email protected]

Important permissions

# Sur le client
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub

# Sur le serveur
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

🔝 Back to table of contents

---

4 - ssh-agent and key management

Why ssh-agent?

If your key has a passphrase, you must type it on every connection. ssh-agent keeps the unlocked key in memory.

Usage

# Démarrer l'agent
eval "$(ssh-agent -s)"

# Ajouter une clé
ssh-add ~/.ssh/id_ed25519

# Lister les clés chargées
ssh-add -l

# Supprimer toutes les clés
ssh-add -D

Automate ssh-agent

Add to ~/.bashrc:

# Démarrer ssh-agent automatiquement
if [ -z "$SSH_AUTH_SOCK" ]; then
    eval "$(ssh-agent -s)" > /dev/null
fi

Agent forwarding

Lets you use your local keys on a remote server (to bounce through).

# Connexion avec forwarding d'agent
ssh -A [email protected]

# Depuis serveur1, connexion à serveur2 utilise vos clés
ssh serveur2.example.com

warning

Only use agent forwarding (-A) toward trusted servers! A malicious admin could use your key.

🔝 Back to table of contents

---

5 - Configuration ~/.ssh/config

The ~/.ssh/config file simplifies connections.

Syntax

# ~/.ssh/config

Host alias
    HostName adresse.serveur.com
    User utilisateur
    Port 22
    IdentityFile ~/.ssh/cle_specifique

Complete example

# Serveur de production
Host prod
    HostName production.example.com
    User deploy
    Port 22
    IdentityFile ~/.ssh/id_ed25519_prod

# Serveur de développement
Host dev
    HostName dev.example.com
    User john
    ForwardAgent yes

# Serveur avec jump host (bastion)
Host interne
    HostName 192.168.1.100
    User admin
    ProxyJump bastion

# Bastion / Jump host
Host bastion
    HostName bastion.example.com
    User jump_user
    IdentityFile ~/.ssh/id_ed25519_bastion

# Paramètres par défaut
Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3
    AddKeysToAgent yes

Usage

# Au lieu de :
ssh -p 22 -i ~/.ssh/id_ed25519_prod [email protected]

# Simplement :
ssh prod

Useful options

Option	Description
HostName	Actual address
User	Default user
Port	SSH port
IdentityFile	Private key to use
ForwardAgent	Enable agent forwarding
ProxyJump	Go through a bastion
ServerAliveInterval	Keepalive
Compression	Enable compression

🔝 Back to table of contents

---

6 - scp and rsync

scp - Secure copy

# Copier un fichier vers le serveur
scp fichier.txt john@serveur:/home/john/

# Copier depuis le serveur
scp john@serveur:/var/log/app.log ./

# Copier un répertoire
scp -r dossier/ john@serveur:/home/john/

# Port différent
scp -P 2222 fichier.txt john@serveur:/home/john/

# Avec alias du config
scp fichier.txt prod:/home/deploy/

rsync - Synchronization

# Installer si nécessaire
sudo apt install rsync

# Synchroniser un dossier (push)
rsync -avz dossier/ john@serveur:/backup/dossier/

# Synchroniser depuis le serveur (pull)
rsync -avz john@serveur:/var/www/ ./www_backup/

# Avec suppression des fichiers supprimés
rsync -avz --delete source/ john@serveur:/destination/

# Dry run (simulation)
rsync -avzn source/ john@serveur:/destination/

# Exclure des fichiers
rsync -avz --exclude='*.log' --exclude='node_modules/' source/ dest/

# Avec progression
rsync -avz --progress source/ john@serveur:/destination/

rsync options

Option	Description
-a	Archive (recursive, permissions, etc.)
-v	Verbose
-z	Compression during transfer
-n	Dry run (simulation)
--delete	Delete files absent from the source
--exclude	Exclude files
--progress	Show progress
-e	Specify the shell (e.g. -e "ssh -p 2222")

scp vs rsync comparison

Aspect	scp	rsync
Incremental synchronization	No	Yes
Resume after interruption	No	Yes
Compression	Option	Option
Complexity	Simple	More options
Usage	One-off copies	Backups, sync

🔝 Back to table of contents

---

7 - Hands-on exercises

Exercise 1: Generate and install a key

# 1. Générez une nouvelle clé
ssh-keygen -t ed25519 -C "test-key" -f ~/.ssh/id_test

# 2. Affichez la clé publique
cat ~/.ssh/id_test.pub

# 3. Si vous avez un serveur, copiez-la
# ssh-copy-id -i ~/.ssh/id_test john@serveur

Exercise 2: Configure ~/.ssh/config

# 1. Créez ou éditez le fichier
nano ~/.ssh/config

# 2. Ajoutez un alias
# Host monserveur
#     HostName example.com
#     User john
#     IdentityFile ~/.ssh/id_test

# 3. Testez
# ssh monserveur

Exercise 3: File transfer

# Si vous avez accès à un serveur :

# 1. Créez un fichier de test
echo "Test SSH" > test_ssh.txt

# 2. Copiez avec scp
# scp test_ssh.txt monserveur:/tmp/

# 3. Vérifiez
# ssh monserveur "cat /tmp/test_ssh.txt"

Quiz

Q1. Which command generates an ED25519 key pair?

Answer

ssh-keygen -t ed25519

Q2. What permissions must the private key have?

Answer

600 (chmod 600 ~/.ssh/id_ed25519)

Q3. How do you copy a public key to a server?

Answer

ssh-copy-id user@serveur

🔝 Back to table of contents

---

Key takeaways

• SSH = secure connection on port 22
• ED25519 keys recommended (more secure, shorter)
• Private key = secret, public key = distributed
• ssh-copy-id to easily install the public key
• ~/.ssh/config simplifies connections
• rsync > scp for regular synchronizations
• Always check the permissions (700/600)

🔝 Back to table of contents

---

← Previous chapter | Next chapter: Firewall and security →