SSH Security

SSH security depends on key management, file permissions, and thoughtful server configuration. Follow best practices to prevent unauthorized access.

Key generation and storage:

• Use Ed25519 keys (modern, fast, 256-bit security): ssh-keygen -t ed25519 -C "user@host"
• Protect private keys with a passphrase
• Store keys only on machines you control
• Never share or commit private keys to version control

File permissions (critical):

$ chmod 700 ~/.ssh              # directory
$ chmod 600 ~/.ssh/id_*         # private keys
$ chmod 644 ~/.ssh/*.pub        # public keys
$ chmod 644 ~/.ssh/authorized_keys  # on server
$ chmod 644 ~/.ssh/config       # config file

Incorrect permissions cause Permission denied (publickey) errors.

Host key verification:

• On first connection, SSH shows the host key fingerprint and asks to accept it
• Manually verify with: ssh-keyscan host | ssh-keygen -lf -
• Configure verification in ~/.ssh/config:

StrictHostKeyChecking accept-new     # accept new, warn if changed
StrictHostKeyChecking ask            # prompt for every unknown key
StrictHostKeyChecking yes            # require known key

Key rotation:

• Rotate keys every 1-2 years
• Use unique keys per high-value host (or at least distinct from daily-use keys)
• Revoke old keys from authorized_keys files on servers

Monitor for unauthorized keys:

$ cat ~/.ssh/authorized_keys

Review regularly for entries you didn't add.

SSH version and updates:

• Keep SSH updated: ssh -V shows version
• Subscribe to OpenSSH security advisories
• Disable outdated algorithms if possible (in sshd_config)

On servers, apply ssh-security hardening practices.