SSH Tutorial: Log In to Linux Servers and Copy Files

SSH (Secure Shell) lets you run commands on another computer over an encrypted connection. It is how nearly every Linux server is managed. In this lesson, the "server" is this same machine, localhost, which is why the commands work without a second computer.

Connecting#

The form is ssh user@host:

ssh [email protected]

The first time, SSH asks you to confirm the server's fingerprint, and stores it in ~/.ssh/known_hosts. Type exit to log out.

Key-based login#

Passwords can be guessed. Keys are safer and need no typing. Create a key pair with ssh-keygen. In real use, add a passphrase when asked; we use an empty one (-N "") only so that this example can run unattended:

ssh-keygen -q -t ed25519 -f ~/.ssh/id_ed25519 -N ""
ls -l ~/.ssh | awk 'NR > 1 {print $1, $NF}'

-rw------- id_ed25519
-rw-r--r-- id_ed25519.pub

id_ed25519 is the private key, which you never share. id_ed25519.pub is the public key, which goes on the server.

Put the public key in the server's ~/.ssh/authorized_keys. Normally ssh-copy-id asha@server does this for you, and it is the same as:

cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
ssh -o StrictHostKeyChecking=accept-new localhost 'echo "Logged in to $(hostname) as $(whoami)"' 2> /dev/null

Logged in to laviyx as asha

No password was needed. As you can see, a command after the host runs remotely, and prints its output here.

The SSH config file#

Save long commands in ~/.ssh/config:

cat > ~/.ssh/config <<'EOF'
Host web
    HostName localhost
    User asha
    IdentityFile ~/.ssh/id_ed25519
EOF
chmod 600 ~/.ssh/config
ssh web hostname

laviyx

Now ssh web is enough. Add Port 2222 if a server uses a different port.

Copy files with scp#

scp copies over SSH. A colon marks the remote side:

echo "report" > report.txt
mkdir -p ~/backups
scp -q report.txt web:backups/
ssh web 'ls backups'

report.txt

Download by swapping the arguments, as in scp web:backups/report.txt ., and add -r for folders.

Sync with rsync#

rsync copies only what has changed, which makes it ideal for backups and deployments:

mkdir -p site
echo "home" > site/index.html
echo "about" > site/about.html
rsync -az --stats site/ web:public/ | grep 'files transferred'
echo "home v2" > site/index.html
rsync -az --stats site/ web:public/ | grep 'files transferred'

Number of regular files transferred: 2
Number of regular files transferred: 1

The second run sent one file. -a keeps permissions and times, and -z compresses.

Securing a server#

On any server exposed to the internet, disable password logins once your key works. Edit /etc/ssh/sshd_config:

PasswordAuthentication no
PermitRootLogin no

Then reload the service. Keep your current session open, and test a new login in a second terminal, so that you cannot lock yourself out.

sudo systemctl reload ssh

Automated bots try to log in to all public servers. Tools such as fail2ban block them after repeated failures.

Common mistakes#

Practice#

ssh web 'ls public | wc -l'
ssh web cat public/index.html

2
home v2

Key takeaway#

Next: Scheduling Jobs with cron.