SSH Configuration

Secure SSH server and client configuration.

Key Management

Generate key

ssh-keygen -t ed25519 -C "user@example.com"

Copy to server

ssh-copy-id user@server

Add to agent

eval "$(ssh-agent -s)" ssh-add ~/.ssh/id_ed25519

SSH Config (~/.ssh/config)

Host production HostName prod.example.com User deploy IdentityFile ~/.ssh/prod_key Port 22

Host bastion HostName bastion.example.com User admin

Host internal HostName 10.0.0.5 User admin ProxyJump bastion

Secure Server Config

/etc/ssh/sshd_config

PermitRootLogin no PasswordAuthentication no PubkeyAuthentication yes MaxAuthTries 3 AllowUsers deploy admin

Tunneling

Local port forward

ssh -L 8080:internal:80 bastion

Remote port forward

ssh -R 8080:localhost:80 server

SOCKS proxy

ssh -D 1080 server

Best Practices

• Use ed25519 keys

• Disable password auth

• Use SSH agent forwarding carefully

• Implement jump hosts/bastions