# SSH Security

**SSH security** depends on key management, file permissions, and thoughtful server configuration. Follow best practices to prevent unauthorized access.

Key generation and storage:

- Use Ed25519 keys (modern, fast, 256-bit security): `ssh-keygen -t ed25519 -C "user@host"`
- Protect private keys with a passphrase
- Store keys only on machines you control
- Never share or commit private keys to version control

File permissions (critical):

```bash
$ chmod 700 ~/.ssh              # directory
$ chmod 600 ~/.ssh/id_*         # private keys
$ chmod 644 ~/.ssh/*.pub        # public keys
$ chmod 644 ~/.ssh/authorized_keys  # on server
$ chmod 644 ~/.ssh/config       # config file
```

Incorrect permissions cause `Permission denied (publickey)` errors.

Host key verification:

- On first connection, SSH shows the host key fingerprint and asks to accept it
- Manually verify with: `ssh-keyscan host | ssh-keygen -lf -`
- Configure verification in `~/.ssh/config`:

```
StrictHostKeyChecking accept-new     # accept new, warn if changed
StrictHostKeyChecking ask            # prompt for every unknown key
StrictHostKeyChecking yes            # require known key
```

Key rotation:

- Rotate keys every 1-2 years
- Use unique keys per high-value host (or at least distinct from daily-use keys)
- Revoke old keys from `authorized_keys` files on servers

Monitor for unauthorized keys:

```bash
$ cat ~/.ssh/authorized_keys
```

Review regularly for entries you didn't add.

SSH version and updates:

- Keep SSH updated: `ssh -V` shows version
- Subscribe to OpenSSH security advisories
- Disable outdated algorithms if possible (in sshd_config)

On servers, apply `ssh-security` hardening practices.