Linux SSH Mastery: Cryptography, Key Management, Tunneling, and Hardening

SSH (Secure Shell / OpenSSH) is the foundational cryptographic network protocol for remote server administration, automated configuration management (Ansible), and secure data tunneling across untrusted networks. This guide covers cryptographic foundations, key management, client configuration patterns, proxy jump chains, port forwarding, connection multiplexing, and server hardening.

⚡ Quick Dive

SSH Command Cheat Sheet

Quick ~/.ssh/config Template

# ~/.ssh/config
Host prod-app
    HostName 10.0.1.50
    User ubuntu
    IdentityFile ~/.ssh/id_ed25519
    ProxyJump jump-bastion
    ServerAliveInterval 60
    ServerAliveCountMax 3

Host jump-bastion
    HostName bastion.example.com
    User jumpuser
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

📖 Extended Guide

1. SSH Cryptographic Architecture

The SSH protocol creates an encrypted, authenticated tunnel using three distinct cryptographic layers:

1. Transport Layer (Key Exchange)
   └─ Diffie-Hellman (Curve25519 / ECDH) negotiates a shared session secret.
2. Server & Client Authentication
   ├─ Server authenticates via Host Key (stored in client's ~/.ssh/known_hosts).
   └─ Client authenticates via User Key (~/.ssh/authorized_keys) or Password.
3. Symmetric Encryption & Integrity (Active Session)
   └─ ChaCha20-Poly1305 or AES-256-GCM encrypts all traffic and provides MAC integrity.

Key Exchange & known_hosts

When connecting to a host for the first time, the client verifies the server's public key fingerprint and stores it in ~/.ssh/known_hosts. If a host key changes unexpectedly, SSH aborts the connection with a Host Key Verification Failed warning to protect against Man-in-the-Middle (MITM) attacks.

# Remove stale/changed host key from known_hosts
ssh-keygen -R 192.168.1.50

2. Key Generation & Management

Generating Modern SSH Keys

Always prefer Ed25519 (Edwards-curve Digital Signature Algorithm) for superior performance and security over older RSA algorithms:

# 1. Recommended: Generate Ed25519 Key (256-bit curve)
ssh-keygen -t ed25519 -C "admin@company.com"

# 2. Legacy requirement: Generate RSA 4096-bit Key
ssh-keygen -t rsa -b 4096 -C "legacy@company.com"

Deploying Public Keys: ssh-copy-id

Copies your public key (~/.ssh/id_ed25519.pub) and appends it to the remote user's ~/.ssh/authorized_keys with correct permissions:

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server.example.com

Key Agent: ssh-agent and ssh-add

Avoid re-typing private key passphrases for every connection:

# Start agent in background
eval "$(ssh-agent -s)"

# Add key to agent with a 4-hour timeout (-t)
ssh-add -t 4h ~/.ssh/id_ed25519

# List keys loaded in agent
ssh-add -l

# Delete all keys from agent
ssh-add -D

3. Client Configuration Mastery: ~/.ssh/config

Configure persistent host aliases, jump chains, and multiplexing in ~/.ssh/config (ensure permissions are chmod 600 ~/.ssh/config):

# Global defaults applied to all hosts
Host *
    ServerAliveInterval 30
    ServerAliveCountMax 3
    AddKeysToAgent yes
    IdentitiesOnly yes

# Single-hop Bastion setup
Host private-node
    HostName 10.0.2.15
    User ubuntu
    IdentityFile ~/.ssh/prod_ed25519
    ProxyJump bastion.example.com

# High-Performance Connection Multiplexing (re-uses open TCP sockets)
Host *.internal.company.com
    ControlMaster auto
    ControlPath ~/.ssh/sockets/%r@%h-%p
    ControlPersist 10m

[!TIP] Connection Multiplexing (ControlMaster): Opens a master connection in the background. Subsequent SSH, SCP, or Git connections to the same host open instantly without repeating the TLS/SSH authentication handshake.

4. Port Forwarding & Tunneling

Local Port Forwarding (-L)

Forwards traffic from a local port to a remote target:

# Forward local port 5432 to remote database
ssh -N -L 5432:localhost:5432 user@db-server.internal

# Syntax: ssh -L [local_ip:]local_port:destination_host:destination_port user@ssh_server

Remote (Reverse) Port Forwarding (-R)

Enables a remote machine to reach a service running locally on your workstation:

# Expose local web server (port 3000) to remote port 8080
ssh -N -R 8080:localhost:3000 user@public-vps.com

Dynamic SOCKS5 Proxy (-D)

Routes application network traffic through the remote SSH server:

# Create local SOCKS5 proxy on port 1080
ssh -N -D 1080 user@remote-vps

# Configure browser or curl to use the proxy
curl --socks5-hostname 127.0.0.1:1080 https://icanhazip.com

5. Remote File Operations: scp, sftp, and rsync

# 1. SCP: Fast file copy
scp -P 22 -r ./dist/ user@remote:/var/www/html/

# 2. SFTP: Interactive secure FTP session
sftp -P 22 user@remote

# 3. RSYNC over SSH (Best practice for large datasets)
rsync -avz -e "ssh -p 22 -i ~/.ssh/id_ed25519" ./build/ user@remote:/opt/app/

6. Server-Side Hardening: /etc/ssh/sshd_config

Configure these production-grade security directives in /etc/ssh/sshd_config:

# 1. Disable Root Login via SSH
PermitRootLogin no

# 2. Enforce Key-Based Authentication only (Disable Passwords)
PasswordAuthentication no
KbdInteractiveAuthentication no

# 3. Restrict Empty Passwords
PermitEmptyPasswords no

# 4. Limit Allowed Users or Groups
AllowGroups sudo sysadmin

# 5. Disable X11 and Agent Forwarding unless explicitly needed
X11Forwarding no
AllowAgentForwarding no

# 6. Idle Timeout Disconnection
ClientAliveInterval 300
ClientAliveCountMax 2

# 7. Max Authentication Attempts before disconnect
MaxAuthTries 3

Validate configuration before restarting daemon:

# Test sshd syntax
sudo sshd -t

# Apply changes
sudo systemctl reload sshd

7. Interactive Escape Sequences & Troubleshooting

Escape Sequences

When connected to an active SSH session, typing newline followed by ~ opens SSH escape controls:

• Enter then ~.: Immediately disconnect a frozen or hanging SSH session.
• Enter then ~#: List currently forwarded connections.
• Enter then ~^Z: Suspend SSH to client background.

Verbose Debugging

# Level 1: General connection/auth stage
ssh -v user@host

# Level 2: Detailed cipher negotiation and key matching
ssh -vv user@host

# Level 3: Full packet-level trace (maximum granularity)
ssh -vvv user@host