SSH Remote Access
Overview
SSH (Secure Shell) provides encrypted remote access, file transfer, and tunneling over untrusted networks. OpenSSH is the standard implementation on Linux, macOS, and Windows (via built-in client). The client configuration lives at ~/.ssh/config and supports per-host settings, identity management, and connection reuse.
When to use: Remote server management, secure file transfers, port forwarding, jump host traversal, automated deployments, SOCKS proxying.
When NOT to use: High-throughput bulk data transfer across WANs (use Globus or similar), GUI-heavy remote desktop (use VNC/RDP), container orchestration (use kubectl/docker CLI).
Quick Reference
| Pattern |
Command / Directive |
Key Points |
| Basic connect |
ssh user@host |
Add -p PORT for non-default port |
| Identity file |
ssh -i ~/.ssh/key user@host |
Specify private key explicitly |
| Remote command |
ssh user@host "command" |
Add -t for interactive commands |
| SSH config alias |
Host myserver block in ~/.ssh/config |
Simplifies repeated connections |
| File copy (rsync) |
rsync -avzP src user@host:dest |
Preferred over scp for all transfers |
| File copy (scp) |
scp file user@host:path |
Legacy protocol; uses SFTP internally |
| Local tunnel |
ssh -L local:remote_host:remote_port |
Access remote services locally |
| Remote tunnel |
ssh -R remote:localhost:local_port |
Expose local services to remote |
| SOCKS proxy |
ssh -D 1080 user@host |
Dynamic port forwarding |
| Jump host |
ssh -J jump user@target |
ProxyJump, available since OpenSSH 7.3 |
| Key generation |
ssh-keygen -t ed25519 |
Ed25519 recommended for all new keys |
| FIDO2 key |
ssh-keygen -t ed25519-sk |
Hardware-backed, requires OpenSSH 8.2+ |
| Agent |
ssh-add ~/.ssh/key |
Cache key passphrase for session |
| Multiplexing |
ControlMaster auto in config |
Reuse TCP connections across sessions |
| Debug |
ssh -v user@host |
Up to -vvv for maximum verbosity |
Key Type Recommendations
| Algorithm |
Recommendation |
Notes |
| Ed25519 |
Default for all new keys |
256-bit, fast, secure, supported on OpenSSH 6.5+ |
| Ed25519-SK (FIDO2) |
Strongest option with hardware key |
Requires physical security key, OpenSSH 8.2+ |
| RSA 4096 |
Legacy compatibility only |
Use only when Ed25519 is unsupported by the remote system |
| ECDSA |
Avoid |
Implementation concerns; prefer Ed25519 |
File Transfer Decision Guide
| Scenario |
Tool |
Why |
| Recurring syncs or large directories |
rsync -avzP |
Delta sync, compression, resume, progress |
| Quick one-off file copy |
scp or rsync |
scp is simpler; rsync is more capable |
| Interactive file browsing |
sftp |
Tab completion, directory navigation |
| High-bandwidth WAN transfers |
Specialized tools (Globus) |
SSH buffer limits reduce WAN throughput |
Common Mistakes
| Mistake |
Correct Pattern |
| Using RSA keys for new setups |
Generate Ed25519 keys -- faster, smaller, and equally secure |
Using scp for large or recurring transfers |
Use rsync -avzP for compression, progress, and resumable delta sync |
| Typing passphrase repeatedly during sessions |
Use ssh-agent and ssh-add to cache keys for the session |
| Connecting through multiple hops with nested SSH |
Use -J (ProxyJump) for clean bastion/jump host traversal |
Running interactive commands without -t flag |
Use ssh -t user@host "htop" to allocate a pseudo-terminal |
Using ForwardAgent yes through untrusted hosts |
Use ProxyJump instead -- agent forwarding exposes keys to compromised hosts |
Setting ControlPath without %h, %p, %r |
Include all three tokens to ensure unique sockets per connection |
| Disabling host key checking globally |
Only use StrictHostKeyChecking no in trusted, ephemeral environments |
Not using IdentitiesOnly yes |
Prevents offering every loaded key to every server |
Security Checklist
- Generate Ed25519 keys with strong passphrases
- Set
PasswordAuthentication no on servers
- Set
PermitRootLogin prohibit-password or no
- Use
IdentitiesOnly yes in client config
- Restrict keys with
command= and from= in authorized_keys
- Use FIDO2 hardware keys (
ed25519-sk) for high-security environments
- Install
fail2ban on servers to block brute-force attempts
- Consider SSH certificate authentication for fleet management
Delegation
- Server inventory discovery and connection testing: Use
Explore agent
- Multi-host deployment or bulk file transfers: Use
Task agent
- Network architecture and bastion host planning: Use
Plan agent
References
