SSH connection basics in Linux CLI - Deep Dive

Overview - SSH connection basics

What is it?

SSH stands for Secure Shell. It is a way to connect safely to another computer over an internet or network. SSH lets you control that computer by typing commands as if you were sitting in front of it. It keeps your connection private and secure.

Why it matters

Without SSH, connecting to remote computers would be risky because data like passwords could be stolen. SSH solves this by encrypting the connection, so no one can spy on what you do. This makes managing servers, transferring files, and working remotely safe and reliable.

Where it fits

Before learning SSH, you should know basic command line usage and networking concepts like IP addresses. After SSH basics, you can learn about key-based authentication, tunneling, and advanced remote management techniques.

Mental Model

Core Idea

SSH is a secure, encrypted tunnel that lets you control a remote computer safely over a network.

Think of it like...

Imagine a secret tunnel between your house and a friend's house. You can send messages or commands through this tunnel without anyone outside hearing or seeing them.

Your Computer ──[Encrypted SSH Tunnel]──> Remote Computer

Commands and responses travel safely inside this tunnel, hidden from others.

Build-Up - 7 Steps

1

Foundation

What is SSH and why use it

Concept: SSH is a tool to connect securely to another computer over a network.

SSH stands for Secure Shell. It creates a safe connection between your computer and another one. This connection is encrypted, meaning no one else can read what you send or receive. You use SSH to run commands on the remote computer as if you were there.

Result

You understand SSH is a secure way to access and control remote computers.

Understanding SSH's purpose helps you see why security matters when working remotely.

2

Foundation

Basic SSH command usage

Concept: How to start an SSH connection using a simple command.

The basic SSH command looks like this: ssh username@remote_ip Replace 'username' with the user on the remote computer and 'remote_ip' with its address. When you run this, SSH asks for the password and then connects you.

Result

You can connect to a remote computer by typing one command.

Knowing the simple command builds confidence to try SSH hands-on.

3

Intermediate

Understanding SSH keys for login

🤔Before reading on: do you think SSH keys are just another password? Commit to your answer.

Concept: SSH keys let you log in without typing a password each time, using a pair of special files.

SSH keys come in pairs: a private key you keep safe on your computer, and a public key you put on the remote computer. When you connect, SSH uses these keys to prove who you are automatically. This is safer and faster than typing passwords.

Result

You can set up passwordless, secure login using SSH keys.

Understanding keys unlocks smoother and more secure remote access.

4

Intermediate

How SSH encrypts your connection

🤔Before reading on: do you think SSH sends your password in plain text? Commit to your answer.

Concept: SSH encrypts all data sent between your computer and the remote one to keep it private.

When you connect with SSH, it creates a secret code that scrambles all messages. Even if someone intercepts the data, they see only gibberish. This encryption protects your password, commands, and files from spying.

Result

Your remote session is private and secure from eavesdropping.

Knowing encryption is the core of SSH's security explains why it is trusted worldwide.

5

Intermediate

Common SSH connection options

🤔Before reading on: do you think SSH options change how the connection works or just add extra features? Commit to your answer.

Concept: SSH commands can include options to customize connection behavior.

You can add options like: - -p to specify a different port - -i to use a specific private key file - -v for verbose output to see connection details Example: ssh -p 2222 -i ~/.ssh/mykey user@host These options help when servers use non-standard settings or for troubleshooting.

Result

You can connect flexibly to different SSH servers and debug issues.

Knowing options lets you adapt SSH to many real-world scenarios.

6

Advanced

SSH known_hosts and security warnings

🤔Before reading on: do you think SSH always trusts any server you connect to? Commit to your answer.

Concept: SSH keeps a list of known servers to detect if a server's identity changes, warning you of possible attacks.

When you connect to a server for the first time, SSH saves its 'fingerprint' in a file called known_hosts. Next time, it checks if the fingerprint matches. If it changes, SSH warns you because it might be a hacker pretending to be that server (a man-in-the-middle attack).

Result

You get security alerts if a server's identity changes unexpectedly.

Understanding known_hosts helps you spot and prevent connection hijacking.

7

Expert

How SSH tunnels and port forwarding work

🤔Before reading on: do you think SSH tunnels only let you run commands remotely? Commit to your answer.

Concept: SSH can create secure tunnels to forward network traffic, not just remote commands.

SSH tunnels let you securely send other network data through the SSH connection. For example, you can forward a web browser's traffic through SSH to access a private network. This is done with options like -L (local forwarding) or -R (remote forwarding). It turns SSH into a versatile tool for secure networking.

Result

You can use SSH to protect and redirect network traffic beyond just remote login.

Knowing SSH tunnels reveals its power as a secure network tool, not just a remote shell.

Under the Hood

SSH works by establishing a TCP connection to the remote server, then performing a handshake to exchange cryptographic keys. This handshake uses asymmetric encryption to securely share a session key. After that, all communication is encrypted symmetrically with this session key. The server authenticates the client using passwords or public keys. Commands and data are sent inside this encrypted channel.

Why designed this way?

SSH was created to replace insecure remote login tools like Telnet that sent data in plain text. The design uses strong encryption and key exchange to prevent eavesdropping and impersonation. Using a handshake and session keys balances security with performance. Public key authentication was added to improve security and convenience over passwords.

┌───────────────┐       ┌───────────────┐
│ Your Computer │──────▶│ Remote Server │
└───────────────┘       └───────────────┘
       │                        │
       │ 1. TCP connection       │
       │──────────────────────▶ │
       │                        │
       │ 2. Key exchange handshake
       │◀────────────────────── │
       │                        │
       │ 3. Session key established
       │──────────────────────▶ │
       │                        │
       │ 4. Encrypted communication
       │◀──────────────────────▶│
       │                        │

Myth Busters - 4 Common Misconceptions

Quick: Does SSH send your password in plain text over the network? Commit to yes or no.

Common Belief: SSH sends passwords like regular login tools, so it is not fully secure.

Reality: SSH encrypts the entire connection, including passwords, so they are never sent in plain text.

Why it matters: Believing passwords are sent openly can cause users to avoid SSH or use insecure alternatives.

Quick: Can you use SSH without a password if you have the right keys? Commit to yes or no.

Common Belief: You always need to type a password to log in with SSH.

Reality: SSH keys allow passwordless login by proving identity automatically.

Why it matters: Not knowing this leads to slower workflows and missed security benefits.

Quick: Does SSH trust any server you connect to without question? Commit to yes or no.

Common Belief: SSH always trusts the server you connect to, so no warnings are needed.

Reality: SSH checks server identity against known_hosts and warns if it changes to prevent attacks.

Why it matters: Ignoring these warnings can lead to man-in-the-middle attacks and data theft.

Quick: Is SSH only useful for running commands remotely? Commit to yes or no.

Common Belief: SSH is just a remote terminal tool and cannot do more.

Reality: SSH can forward ports and create tunnels to secure other network traffic.

Why it matters: Underestimating SSH limits its use in secure networking and advanced setups.

Expert Zone

1

SSH key types (RSA, ECDSA, Ed25519) have different security and performance tradeoffs that experts choose based on needs.

2

The SSH handshake uses multiple cryptographic algorithms negotiated dynamically, allowing compatibility and security upgrades.

3

Known_hosts file format and management can be automated to handle large fleets of servers securely.

When NOT to use

SSH is not suitable for graphical remote desktop needs; tools like VNC or RDP are better. For very high-speed file transfers, specialized protocols like rsync or FTP may be preferred. Also, SSH requires network access to the server, so it cannot connect if firewalls block it without tunneling.

Production Patterns

In production, SSH is used with key-based authentication and agent forwarding for secure, passwordless access. It is combined with configuration files (~/.ssh/config) to manage multiple servers easily. SSH tunnels are used to secure database connections or internal services. Monitoring known_hosts changes is part of security audits.

Connections

Public Key Cryptography

SSH uses public key cryptography for authentication and key exchange.

Understanding public key cryptography explains how SSH securely verifies identities without sharing secrets.

Virtual Private Network (VPN)

SSH tunnels can act like a simple VPN by securely forwarding network traffic.

Knowing SSH tunnels helps grasp how VPNs encrypt and route data to protect privacy.

Postal Mail with Sealed Envelopes

Like sealing a letter in an envelope to keep contents private, SSH encrypts data to keep it secret during transit.

This connection shows how encryption protects information from being read by unintended recipients.

Common Pitfalls

#1 Trying to connect without specifying the correct username.

Wrong approach:

ssh 192.168.1.10

Correct approach:

ssh user@192.168.1.10

Root cause:

Assuming SSH defaults to the correct username on the remote server.

#2 Ignoring SSH warnings about changed server keys.

Wrong approach:

ssh user@host
Warning: REMOTE HOST IDENTIFICATION HAS CHANGED!
Ignoring and continuing anyway.

Correct approach:

Investigate the warning, verify server identity, then update known_hosts if safe.

Root cause:

Not understanding the security importance of server key verification.

#3 Using password authentication instead of SSH keys for automation.

Wrong approach:

Automated scripts that call ssh and expect password prompts.

Correct approach:

Set up SSH key authentication and use ssh-agent for passwordless automation.

Root cause:

Not knowing SSH keys enable secure, unattended connections.

Key Takeaways

SSH creates a secure, encrypted connection to control remote computers safely.

You connect using the ssh command with a username and server address.

SSH keys allow passwordless and stronger authentication than passwords.

SSH encrypts all data, protecting it from eavesdropping and tampering.

SSH can do more than remote login, including secure network tunneling.

Practice

1. What does the command ssh user@hostname do?

easy

A. Lists files on the remote computer.

B. Copies files from the remote computer to local.

C. Starts a secure connection to the remote computer as 'user'.

D. Deletes the user account on the remote computer.

Solution

1. Step 1: Understand the ssh command purpose

   The ssh command is used to securely connect to another computer over a network.

2. Step 2: Analyze the syntax ssh user@hostname

   This syntax means connect as 'user' to the computer identified by 'hostname'.

3. Final Answer:

   Starts a secure connection to the remote computer as 'user'. -> Option C

4. Quick Check:

   ssh user@hostname = Secure connection [OK]

Hint: ssh user@host means connect securely as user [OK]

Common Mistakes:

• Thinking ssh copies files instead of connecting
• Confusing ssh with file listing commands
• Assuming ssh deletes accounts

2. Which of these is the correct syntax to connect to a remote server with ssh?

easy

A. ssh user@hostname

B. ssh -connect user hostname

C. ssh connect user@hostname

D. ssh user hostname

Solution

1. Step 1: Recall ssh command syntax

   The correct syntax is ssh user@hostname without extra words or flags for basic connection.

2. Step 2: Check each option

   Options A, B, and D have incorrect syntax or missing '@' sign.

3. Final Answer:

   ssh user@hostname -> Option A

4. Quick Check:

   Correct ssh syntax = ssh user@hostname [OK]

Hint: ssh always uses user@hostname format [OK]

Common Mistakes:

• Adding extra words like 'connect' in command
• Omitting '@' between user and hostname
• Using flags incorrectly for basic ssh

3. What will happen if you run ssh alice@192.168.1.10 and the password is correct?

medium

A. You will see a list of files on your local computer.

B. The remote computer will shut down.

C. Your local files will be deleted.

D. You will be logged into the remote computer as user alice.

Solution

1. Step 1: Understand ssh login process

   Running ssh with user and IP tries to connect and log in to that remote machine.

2. Step 2: Check what happens on correct password

   If password is correct, you get a command prompt on the remote machine as that user.

3. Final Answer:

   You will be logged into the remote computer as user alice. -> Option D

4. Quick Check:

   ssh + correct password = remote login [OK]

Hint: Correct password means remote login success [OK]

Common Mistakes:

• Thinking ssh shuts down remote machine
• Confusing ssh with file deletion
• Assuming ssh lists local files

4. You try to connect with ssh [e-mail] but get the error: Permission denied (publickey). What is the likely problem?

medium

A. You typed the wrong hostname.

B. Your SSH key is missing or not accepted by the server.

C. The server is turned off.

D. You forgot to install ssh on your computer.

Solution

1. Step 1: Understand the error message

   "Permission denied (publickey)" means the server expects an SSH key for authentication but did not accept yours.

2. Step 2: Identify cause of error

   This usually means your SSH key is missing, not loaded, or not authorized on the server.

3. Final Answer:

   Your SSH key is missing or not accepted by the server. -> Option B

4. Quick Check:

   Permission denied (publickey) = SSH key issue [OK]

Hint: Permission denied (publickey) means SSH key problem [OK]

Common Mistakes:

• Assuming hostname typo causes this error
• Thinking server power state causes this error
• Believing ssh must be installed locally to connect

5. You want to connect to a remote server at example.com as user admin but the server uses a non-standard port 2222. Which command will connect correctly?

hard

A. ssh -p 2222 [e-mail]

B. ssh [e-mail]:2222

C. ssh [e-mail] -port 2222

D. ssh [e-mail]

Solution

1. Step 1: Recall how to specify a port in ssh

   The correct flag to specify a port is -p followed by the port number.

2. Step 2: Analyze each option

   ssh -p 2222 [e-mail] uses -p 2222 correctly. Options A, C, and D use incorrect syntax or wrong placement.

3. Final Answer:

   ssh -p 2222 [e-mail] -> Option A

4. Quick Check:

   Use -p to specify port in ssh [OK]

Hint: Use ssh -p port user@host for custom ports [OK]

Common Mistakes:

• Putting port after hostname with colon
• Using -port instead of -p
• Changing hostname to include port number