# Debian SSH

SSH (Secure Shell) allows remote command execution and file transfer over encrypted connections.

## Basic Connection

Connect to remote host:

```bash
ssh user@host
ssh user@host -p 2222        # non-standard port
```

Run single command (no interactive shell):

```bash
ssh user@host "ls -la /home"
```

## Key-Based Authentication

More secure than passwords. Generate RSA key:

```bash
ssh-keygen -t rsa -b 4096
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_custom
```

Copy public key to server:

```bash
ssh-copy-id -i ~/.ssh/id_rsa.pub user@host
ssh-copy-id -i ~/.ssh/id_rsa_custom user@host -p 2222
```

Or manually:

```bash
cat ~/.ssh/id_rsa.pub | ssh user@host "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"
```

Verify key permissions on server (critical):

```bash
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
```

## Server Configuration

Edit `/etc/ssh/sshd_config`:

```bash
sudo nano /etc/ssh/sshd_config
```

Common settings:

```
Port 2222                    # change port
PasswordAuthentication no    # key-only
PubkeyAuthentication yes
PermitRootLogin no           # never allow root login
X11Forwarding no             # disable if not needed
```

Reload server:

```bash
sudo systemctl restart ssh
```

Test config first:

```bash
sudo sshd -t
```

## Advanced Options

Local port forward:

```bash
ssh user@host -L 8000:localhost:3000
```

Access `localhost:8000` as if it's `host:3000`.

Remote port forward:

```bash
ssh user@host -R 8000:localhost:3000
```

SOCKS proxy:

```bash
ssh user@host -D 1080
```

X11 forwarding (GUI apps):

```bash
ssh user@host -X
```

## File Transfer

Copy file to remote:

```bash
scp file user@host:/path/to/destination
scp -r directory user@host:/path/to/
```

Copy from remote:

```bash
scp user@host:/path/to/file .
```

Or use `rsync` (smarter, resume-able):

```bash
rsync -avz file user@host:/path/to/
rsync -avz --delete directory/ user@host:/path/to/directory/
```

## Tips

- Use `ssh-agent` to cache passphrases: `eval $(ssh-agent)`, then `ssh-add`
- Configure `~/.ssh/config` for shortcuts (avoid remembering hosts/ports)
- Fail2Ban or similar to block brute-force attempts
- Rotate keys periodically
- Always use keys, never passwords in production