{"id":6723,"date":"2024-07-30T02:00:00","date_gmt":"2024-07-30T06:00:00","guid":{"rendered":"https:\/\/www.both.org\/?p=6723"},"modified":"2024-07-27T21:29:41","modified_gmt":"2024-07-28T01:29:41","slug":"how-to-use-ssh","status":"publish","type":"post","link":"https:\/\/www.both.org\/?p=6723","title":{"rendered":"How to use SSH"},"content":{"rendered":"
\r\n
\r\n \r\n <\/i>\r\n <\/a>\r\n <\/span>\r\n<\/div><\/div>\n

You may have heard that Linux and Unix computers give you the ability to control a computer other than the one you’re sitting at. That’s true, and it’s how systems administrators manage hundreds of servers hidden away in a data centre, and it’s made possible by OpenSSH. It’s not just for sys admins, though, and is a daily convenience for many Linux users, although it can be confusing for someone who has yet to try it. This article explains how to configure two computers for secure shell (SSH) connections.<\/p>\n\n\n\n

Install SSH<\/h2>\n\n\n\n

An SSH client<\/em> is an application that provides you the option to contact another computer running an SSH server<\/em>. One application (the “client”) requests a secure connection, while the other application (the “server”) listens for incoming SSH connections. <\/p>\n\n\n\n

To use SSH, each computer involved must have SSH installed on it. In other words, the computer you’re physically using (your laptop or personal desktop workstation) must have an SSH client installed on it, and the computer you want to access (a server or personal computer in another room) must have an SSH server installed on it.<\/p>\n\n\n\n

Most Linux and Unix computers have at least an SSH client installed by default. To verify, open a terminal application and try to get the version (-V<\/code>) of the ssh<\/code> command:<\/p>\n\n\n\n

$ ssh -V\nOpenSSH_8.8p1, OpenSSL 1.1.1m  14 Dec 2021<\/code><\/pre>\n\n\n\n
If you get any response, then you already have at least an SSH client installed.<\/p>\n\n\n\n
To verify whether you have an SSH server installed, look for its configuration file:<\/p>\n\n\n\n
$ file \/etc\/ssh\/sshd_config\n\/etc\/ssh\/sshd_config: ASCII text<\/code><\/pre>\n\n\n\n
Should this return No such file or directory<\/code>, then you don’t have an SSH server installed.<\/p>\n\n\n\n
Install SSH on Linux using your package manager. For example, on an RPM distribution (such as Fedora, CentOS, Alma, Rocky, or Mageia):<\/p>\n\n\n\n
$ sudo dnf install openssh-clients openssh-server<\/code><\/pre>\n\n\n\n
On distributions derived from Debian (such as Mint, Ubuntu, Pop_OS, and Debian itself):<\/p>\n\n\n\n
$ sudo apt install openssh-clients openssh-server<\/code><\/pre>\n\n\n\n
Enable SSH<\/h2>\n\n\n\n
In IT terminology, the computer you’re sitting at is considered your “local” computer. A computer that you’re not in front of is “remote”.<\/p>\n\n\n\n
On the remote computer, enable the SSH service using the systemctl<\/code> command:<\/p>\n\n\n\n
$ sudo systemctl enable --now sshd<\/code><\/pre>\n\n\n\n
Alternately, you can enable the SSH service from within System Settings on the GNOME desktop, or in System Preferences on macOS. On the GNOME desktop, it’s located in the Sharing panel:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Adjust the firewall<\/h2>\n\n\n\n
There may be an active firewall between you and the remote computer. Assuming the remote computer is on the same network as you, there’s likely a firewall application running on the remote machine. There are many different firewalls out there, so you may have to research what firewall the remote computer uses and how to open a port for SSH traffic to pass through. If the remote computer runs Linux with firewalld<\/code>, then you can use the firewall-cmd<\/code> command (on the remote computer):<\/p>\n\n\n\n
$ sudo firewall-cmd --add-service ssh --permanent<\/code><\/pre>\n\n\n\n
Login with SSH<\/h2>\n\n\n\n
Now that you’ve installed SSH, enabled SSH, and adjusted the firewall on the remote computer, you can try logging in. To access the remote computer, you must have a user account and a password on that machine. The username and password don’t need to be the same as it is on your local computer. For example, I could be seth<\/code> on my local machine but sethkenl<\/code> on a remote machine.<\/p>\n\n\n\n
To SSH into a remote computer, you must know its IP address or its resolvable hostname. To find the remote machine’s IP address, use the ip<\/code> command (on the remote computer):<\/p>\n\n\n\n
$ ip addr show | grep \"inet \"\ninet 127.0.0.1\/8 scope host lo\ninet 192.168.0.5\/24 brd 192.168.0.255 scope [...]<\/code><\/pre>\n\n\n\n
On a remote computer that doesn’t have the ip<\/code> command, try ifconfig<\/code> instead (or even ipconfig<\/code> on Windows).<\/p>\n\n\n\n
In this example, the remote computer’s IP address is 192.168.0.5 (the 127.0.0.1 address is a self-assigned loopback address). From your local computer, send a ping<\/code> to the remote machine’s IP address:<\/p>\n\n\n\n
$ ping -c1 192.168.0.5\nPING 192.168.0.5 (192.168.0.5) 56(84) bytes of data.\n64 bytes from 192.168.0.5: icmp_seq=1 ttl=64 time=4.66 ms<\/code><\/pre>\n\n\n\n
If you can ping the remote machine by its IP address or its hostname, and have a login account on it, then you can try to SSH into it:<\/p>\n\n\n\n
$ whoami\nseth\n$ ssh sethkenl@192.168.0.5\nbash$ whoami\nsethkenl<\/code><\/pre>\n\n\n\n
The test login works, so now you’re ready to activate passwordless login.<\/p>\n\n\n\n
Create an SSH key<\/h2>\n\n\n\n
Passwords present a potential vulnerability to the security of a computer, because a password can be guessed either by luck or, more likely, automation. You can cleverly eliminate passwords as a vulnerability by not using passwords for SSH, and using SSH key pairs instead. When you use key pairs, your local computer presents half a key to the remote computer, and login is successful as long as the remote computer has the matching half of the same key.<\/p>\n\n\n\n
An SSH key is sometimes generated for you by default, so you may already have an SSH key.  Whether you do or not, it doesn’t hurt to create a new one, and in fact many users have multiple keys for different sets of computers or tasks.<\/p>\n\n\n\n
An SSH key begins its life on your local computer. It consists of a private key, which you never share<\/em>, and a public one, which you are meant to share with any remote machine you want to have passwordless access to.<\/p>\n\n\n\n
Use the ssh-keygen<\/code> command to generate a new SSH key:<\/p>\n\n\n\n
$ ssh-keygen -t ed25519 -f ~\/.ssh\/my_key<\/code><\/pre>\n\n\n\n
The -t<\/code> option sets the encryption for the key to ed25519<\/code>, which is stronger than the default. The -f<\/code> option sets the key’s file name and location.<\/p>\n\n\n\n
After running the command, you’re prompted to create a password for your SSH key. Make this password unique to your key, and obviously don’t forget it. When you use the key, you must enter this password, but the password remains local and isn’t transmitted across the network. It’s another layer of security, however, in the event that someone maliciously obtains a copy of your private key.<\/p>\n\n\n\n
After running the ssh-keygen<\/code> command, you’re left with an SSH private key called my_kkey<\/code> and an SSH public key called my_key.pub<\/code>.<\/p>\n\n\n\n
To get the public key over to your remote machine, you can either use the ssh-copy-id<\/code> command or just copy the public key to a thumbdrive and copy it to the remote machine manually. The ssh-copy-id<\/code> command is the better option, because it manages permissions for you:<\/p>\n\n\n\n
$ ssh-copy-id -i ~\/.ssh\/lan.pub sethkenlon@192.168.0.5<\/code><\/pre>\n\n\n\n
Then again, if you can’t log into the remote host with a password, then you can’t set up passwordless login either, so you might have to do it manually. If you do have to manually copy the key over, place the key in your user’s ~\/.ssh<\/code> directory, and set its permissions to 600.<\/p>\n\n\n\n
Once you’ve got the public key on the remote machine, try logging in again, this time using the -i<\/code> option to point the SSH command to the appropriate key (my_key<\/code>, in this example):<\/p>\n\n\n\n
$ ssh -i ~\/.ssh\/lan sethkenl@192.168.0.5\nbash$ whoami\nsethkenl<\/code><\/pre>\n\n\n\n
Once you have passwordless authentication set up, you can edit the \/etc\/ssh\/sshd_config<\/code> file on the remote computer to forbid password authentication. This prevents anyone from using SSH to authenticate to a computer unless they have your private key. To do this, open \/etc\/ssh\/sshd_config<\/code> in a text editor with sudo<\/code> permissions and search for the string PasswordAuthentication<\/code>. <\/p>\n\n\n\n
Change the line to this:<\/p>\n\n\n\n
PasswordAuthentication no<\/code><\/pre>\n\n\n\n
Save it and reboot, or just restart the SSH server:<\/p>\n\n\n\n
$ sudo systemctl restart sshd && echo \"OK\"\nOK\n$<\/code><\/pre>\n\n\n\n
Remote login with SSH<\/h2>\n\n\n\n
OpenSSH can change your view of computing. With SSH, you have access to any computer on your network, or any computer you have an accounts on. With OpenSSH, you access the power of networked computing. OpenSSH is just the beginning, so start using it today, get used to it, and see what other gems you can discover within your Linux terminal.<\/p>\n","protected":false},"excerpt":{"rendered":"
You may have heard that Linux and Unix computers give you the ability to control a computer other<\/p>\n","protected":false},"author":31,"featured_media":4654,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_lmt_disableupdate":"","_lmt_disable":"","footnotes":""},"categories":[100,484],"tags":[151,104,91],"class_list":["post-6723","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-command-line","category-ssh","tag-bash","tag-command-line","tag-linux"],"modified_by":"David Both","_links":{"self":[{"href":"https:\/\/www.both.org\/index.php?rest_route=\/wp\/v2\/posts\/6723","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.both.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.both.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.both.org\/index.php?rest_route=\/wp\/v2\/users\/31"}],"replies":[{"embeddable":true,"href":"https:\/\/www.both.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6723"}],"version-history":[{"count":4,"href":"https:\/\/www.both.org\/index.php?rest_route=\/wp\/v2\/posts\/6723\/revisions"}],"predecessor-version":[{"id":6729,"href":"https:\/\/www.both.org\/index.php?rest_route=\/wp\/v2\/posts\/6723\/revisions\/6729"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.both.org\/index.php?rest_route=\/wp\/v2\/media\/4654"}],"wp:attachment":[{"href":"https:\/\/www.both.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6723"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.both.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6723"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.both.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6723"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}