The Secure Shell (SSH) is the workhorse for remote Linux administration, and almost every aspect of it can be customized. The per-user ~/.ssh/config file lets administrators define reusable shortcuts with options such as Hostname, User, Port, and IdentityFile, which makes recurring logins far more convenient than typing full connection strings. Authentication itself relies on asymmetric cryptography, with ssh-keygen -t ed25519 being the recommended way to generate modern key pairs. Once a key pair exists, ssh-copy-id installs the public key into the remote ~/.ssh/authorized_keys, which must be locked down to mode 600 for security. Locking accounts locally is done with passwd -l user, and reviewing who has been knocking on the door is possible through lastb, which reads /var/log/btmp.
For file transfers, SSH provides several options. scp -r copies directories recursively, while the interactive sftp shell supports commands like get -r and put. For transparent remote filesystems, sshfs mounts a remote directory via FUSE and can be unmounted with fusermount -u. SSH can also be hardened to disable password authentication entirely by setting PasswordAuthentication no in /etc/ssh/sshd_config, optionally combined with ChallengeResponseAuthentication no, followed by reloading the daemon. Other useful directives include PermitRootLogin prohibit-password to allow key-only root access, AllowUsers to whitelist specific accounts, and ClientAliveInterval to detect dead sessions. Configuration syntax can be validated safely with sshd -t.
SSH also enables sophisticated network plumbing. Local port forwarding via ssh -L localport:targethost:targetport user@sshhost tunnels traffic through an SSH server, while reverse forwarding with ssh -R exposes a local service on a remote host. Agent forwarding (ssh -A) lets remote servers use the local agent without copying private keys, ssh-add -l lists fingerprints loaded into the agent, and ssh-add ~/.ssh/id_ed25519 adds new ones. When connectivity requires an intermediate host, ProxyJump (ssh -J jumphost targethost) or the equivalent ProxyJump directive in ~/.ssh/config simplifies multi-hop logins. The ssh-keygen -R hostname command cleans stale entries from ~/.ssh/known_hosts, which is the file used to detect man-in-the-middle attempts. When a system has been cloned or restored from backup, regenerating host keys with rm /etc/ssh/ssh_host_* && ssh-keygen -A ensures each system has unique fingerprints before restarting sshd.
For dedicated file transfer services, FTP, SFTP, and FTPS each have distinct security characteristics. Plain FTP on port 21 is unencrypted, FTPS wraps FTP with TLS on port 21 (explicit) or 990 (implicit), and SFTP runs entirely over SSH on port 22 and is the preferred option because it encrypts both credentials and data and traverses most firewalls easily. Linux servers commonly use vsftpd (config in /etc/vsftpd.conf) or proftpd; enabling chroot_local_user=YES jails FTP users to their home directories, and systemctl restart vsftpd applies configuration changes. On the client side, FileZilla is a popular GUI that uses File > Site Manager (Ctrl+S) to save reusable connections, supports key authentication under SFTP/Key file mode, defaults to ASCII mode for text files (with Binary mode used for exact copies), and stores its config under ~/.config/filezilla/. Speed limits, concurrent transfer caps, and transfer-mode toggles are all found in Edit > Settings > Transfers, while Server > Force showing hidden files reveals dotfiles on the remote side. Right-clicking a failed item and choosing Process Queue resumes interrupted transfers.