Skip to content

Chapter 1 of 8

SSH, Remote Access, and File Transfer

The Secure Shell (SSH) is the workhorse for remote Linux administration, and almost every aspect of it can be customized. The per-user ~/.ssh/config file lets administrators define reusable shortcuts with options such as Hostname, User, Port, and IdentityFile, which makes recurring logins far more convenient than typing full connection strings. Authentication itself relies on asymmetric cryptography, with ssh-keygen -t ed25519 being the recommended way to generate modern key pairs. Once a key pair exists, ssh-copy-id installs the public key into the remote ~/.ssh/authorized_keys, which must be locked down to mode 600 for security. Locking accounts locally is done with passwd -l user, and reviewing who has been knocking on the door is possible through lastb, which reads /var/log/btmp.

For file transfers, SSH provides several options. scp -r copies directories recursively, while the interactive sftp shell supports commands like get -r and put. For transparent remote filesystems, sshfs mounts a remote directory via FUSE and can be unmounted with fusermount -u. SSH can also be hardened to disable password authentication entirely by setting PasswordAuthentication no in /etc/ssh/sshd_config, optionally combined with ChallengeResponseAuthentication no, followed by reloading the daemon. Other useful directives include PermitRootLogin prohibit-password to allow key-only root access, AllowUsers to whitelist specific accounts, and ClientAliveInterval to detect dead sessions. Configuration syntax can be validated safely with sshd -t.

SSH also enables sophisticated network plumbing. Local port forwarding via ssh -L localport:targethost:targetport user@sshhost tunnels traffic through an SSH server, while reverse forwarding with ssh -R exposes a local service on a remote host. Agent forwarding (ssh -A) lets remote servers use the local agent without copying private keys, ssh-add -l lists fingerprints loaded into the agent, and ssh-add ~/.ssh/id_ed25519 adds new ones. When connectivity requires an intermediate host, ProxyJump (ssh -J jumphost targethost) or the equivalent ProxyJump directive in ~/.ssh/config simplifies multi-hop logins. The ssh-keygen -R hostname command cleans stale entries from ~/.ssh/known_hosts, which is the file used to detect man-in-the-middle attempts. When a system has been cloned or restored from backup, regenerating host keys with rm /etc/ssh/ssh_host_* && ssh-keygen -A ensures each system has unique fingerprints before restarting sshd.

For dedicated file transfer services, FTP, SFTP, and FTPS each have distinct security characteristics. Plain FTP on port 21 is unencrypted, FTPS wraps FTP with TLS on port 21 (explicit) or 990 (implicit), and SFTP runs entirely over SSH on port 22 and is the preferred option because it encrypts both credentials and data and traverses most firewalls easily. Linux servers commonly use vsftpd (config in /etc/vsftpd.conf) or proftpd; enabling chroot_local_user=YES jails FTP users to their home directories, and systemctl restart vsftpd applies configuration changes. On the client side, FileZilla is a popular GUI that uses File > Site Manager (Ctrl+S) to save reusable connections, supports key authentication under SFTP/Key file mode, defaults to ASCII mode for text files (with Binary mode used for exact copies), and stores its config under ~/.config/filezilla/. Speed limits, concurrent transfer caps, and transfer-mode toggles are all found in Edit > Settings > Transfers, while Server > Force showing hidden files reveals dotfiles on the remote side. Right-clicking a failed item and choosing Process Queue resumes interrupted transfers.

All chapters
  1. 1SSH, Remote Access, and File Transfer
  2. 2DNS and Name Resolution
  3. 3Systemd, Logging, and Scheduled Tasks
  4. 4Users, Permissions, and Linux Security
  5. 5Storage, Filesystems, and LVM
  6. 6Networking, Firewalls, and Diagnostics
  7. 7Web Servers, SSL/TLS, and Hosting Panels
  8. 8Process Management, Performance, and Containers

Drill it

Reading is not remembering. These come from the Sysadmin Cards deck:

Q

What is the purpose of the <code>~/.ssh/config</code> file?

It allows users to define shortcuts and configuration options (like Hostname, User, Port, IdentityFile) for SSH connections.

Q

What are the recommended permissions for the <code>~/.ssh/authorized_keys</code> file?

600 (read/write for owner only).

Q

What is a DNS <b>CNAME</b> record?

A Canonical Name record that maps one domain name (alias) to another domain name (canonical).

Q

What is a DNS <b>MX</b> record?

A Mail Exchange record that specifies the mail server responsible for accepting email messages on behalf of a domain.