Installation & Basic Setup

Installing OpenSSH Server

Install the OpenSSH server package to enable SSH access to your Debian 12 system:

sudo apt update && sudo apt install openssh-server

Starting and Enabling SSH Service

Start the SSH service and enable it to start automatically at boot:

sudo systemctl start ssh
sudo systemctl enable ssh

Checking SSH Status

Verify that the SSH service is running properly:

sudo systemctl status ssh
Note: By default, SSH runs on port 22. Ensure your firewall allows connections on this port.

Basic SSH Connections

Connect to Remote Server

Connect to a remote server using username and hostname/IP:

ssh username@hostname_or_ip

Connect with Specific Port

Connect to a server using a non-default port:

ssh -p port_number username@hostname

Execute Remote Command

Run a single command on a remote server without opening an interactive session:

ssh username@hostname "command_to_execute"

SSH with Verbose Output

Get detailed connection information for troubleshooting:

ssh -v username@hostname # Level 1 verbosity
ssh -vv username@hostname # Level 2 verbosity
ssh -vvv username@hostname # Level 3 verbosity (most detailed)

SSH Key Management

Generate SSH Key Pair

Create a new SSH key pair (RSA 4096-bit recommended):

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

For Ed25519 (modern, recommended):

ssh-keygen -t ed25519 -C "your_email@example.com"

Copy Public Key to Remote Server

Securely copy your public key to a remote server for passwordless authentication:

ssh-copy-id username@hostname

Alternative method using cat:

cat ～/.ssh/id_rsa.pub | ssh username@hostname "mkdir -p ～/.ssh && cat >> ～/.ssh/authorized_keys"

Disable Password Authentication

After setting up key-based authentication, disable password logins for enhanced security:

sudo nano /etc/ssh/sshd_config
# Set: PasswordAuthentication no
sudo systemctl reload ssh
Warning: Always test your key-based login before disabling password authentication to avoid locking yourself out!

Advanced SSH Usage

SSH Agent for Key Management

Use SSH agent to manage private keys and avoid entering passphrases repeatedly:

eval $(ssh-agent)
ssh-add ～/.ssh/id_rsa
ssh-add -l # List loaded keys

SSH Config File

Create a configuration file for simplified connections:

nano ～/.ssh/config

Example configuration:

Host myserver
  HostName 192.168.1.100
  User admin
  Port 2222
  IdentityFile ～/.ssh/myserver_key

Host *.example.com
  User developer
  IdentityFile ～/.ssh/work_key

Now connect with: ssh myserver

SSH Tunneling

Create secure tunnels for forwarding ports:

# Local port forwarding
ssh -L local_port:destination_host:destination_port username@gateway

# Remote port forwarding
ssh -R remote_port:destination_host:destination_port username@gateway

# Dynamic port forwarding (SOCKS proxy)
ssh -D local_port username@gateway

SCP and SFTP

Securely copy files between systems:

# Copy file to remote server
scp /local/file.txt username@hostname:/remote/directory/

# Copy file from remote server
scp username@hostname:/remote/file.txt /local/directory/

# Start SFTP session
sftp username@hostname

Security Hardening

Change Default SSH Port

Edit the SSH configuration to use a non-standard port:

sudo nano /etc/ssh/sshd_config
# Change: Port 2222
sudo ufw allow 2222/tcp
sudo systemctl restart ssh

Disable Root Login

Prevent direct root logins for better security:

sudo nano /etc/ssh/sshd_config
# Set: PermitRootLogin no
sudo systemctl reload ssh

Allow Specific Users

Restrict SSH access to specific users only:

sudo nano /etc/ssh/sshd_config
# Add: AllowUsers user1 user2
sudo systemctl reload ssh

Fail2Ban for Brute Force Protection

Install and configure Fail2Ban to block brute force attacks:

sudo apt install fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Enable SSH protection in the [sshd] section:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 600
sudo systemctl restart fail2ban

Troubleshooting

Common Issues and Solutions

Issue Solution
Permission denied (publickey) Verify correct permissions: ～/.ssh (700), ～/.ssh/authorized_keys (600)
Connection refused Check if SSH service is running: sudo systemctl status ssh
Host key verification failed Remove old key: ssh-keygen -R hostname
Too many authentication failures Specify identity file: ssh -i ～/.ssh/key username@host

Check SSH Logs

View SSH authentication logs for debugging:

sudo tail -f /var/log/auth.log

Test SSH Configuration

Validate SSH server configuration before reloading:

sudo sshd -t