Debian SSH

SSH (Secure Shell) allows remote command execution and file transfer over encrypted connections.

Connect to remote host:

ssh user@host
ssh user@host -p 2222        # non-standard port

Run single command (no interactive shell):

ssh user@host "ls -la /home"

More secure than passwords. Generate RSA key:

ssh-keygen -t rsa -b 4096
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_custom

Copy public key to server:

ssh-copy-id -i ~/.ssh/id_rsa.pub user@host
ssh-copy-id -i ~/.ssh/id_rsa_custom user@host -p 2222

Or manually:

cat ~/.ssh/id_rsa.pub | ssh user@host "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Verify key permissions on server (critical):

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Edit /etc/ssh/sshd_config:

sudo nano /etc/ssh/sshd_config

Common settings:

Port 2222                    # change port
PasswordAuthentication no    # key-only
PubkeyAuthentication yes
PermitRootLogin no           # never allow root login
X11Forwarding no             # disable if not needed

Reload server:

sudo systemctl restart ssh

Test config first:

sudo sshd -t

Local port forward:

ssh user@host -L 8000:localhost:3000

Access localhost:8000 as if it's host:3000.

Remote port forward:

ssh user@host -R 8000:localhost:3000

SOCKS proxy:

ssh user@host -D 1080

X11 forwarding (GUI apps):

ssh user@host -X

Copy file to remote:

scp file user@host:/path/to/destination
scp -r directory user@host:/path/to/

Copy from remote:

scp user@host:/path/to/file .

Or use rsync (smarter, resume-able):

rsync -avz file user@host:/path/to/
rsync -avz --delete directory/ user@host:/path/to/directory/

• Use ssh-agent to cache passphrases: eval $(ssh-agent), then ssh-add
• Configure ~/.ssh/config for shortcuts (avoid remembering hosts/ports)
• Fail2Ban or similar to block brute-force attempts
• Rotate keys periodically
• Always use keys, never passwords in production