• /etc/ssh/sshd_config
• sshd -t "Test mode. Only check the validity of the configuration file and sanity of the keys. This is useful for updating SSHD reliably as configuration options may change.".

Keep connection alive; prevent freezing.

# On server `/etc/ssh/sshd_config`
TCPKeepAlive yes
ClientAliveInterval 500
ClientAliveCountMax 1000

# On client `~/.ssh/ssh_config`
Host *
  ServerAliveInterval 100

If the value of ClientAliveInterval is greater than ServerAliveInterval then the server sends messages to the client console.

• The user home directory should not allow write permission for group "other" chmod go-w
• The directory .ssh should be 700
• The file .ssh/authorized_keys should be 600
• The private key files should be 600

• /lib/systemd/system/sshd.service

The systemctl enable sshd.socket only invokes SSH when a connection is attempted to be established. As described in Arch Linux Wiki article on SSH

OpenSSH 8.0p1-3 has removed support for the /systemd/system/sshd.socket due to it being susceptible to denial of service.

• An SSH tunnel via multiple hops
• SSH from A through B to C, using private key on B [closed]
• SSH Tips and why ProxyJump is awesome

1. Configure the server .ssh/sshd_config
2. Login to the user client account that is to use SSH on the server.
   • Create file .ssh/authorized_keys if it does not exist.
   • Create the key pairs if not using an existing key pair.
3. Add the user's public key to ~/.ssh/authorized_keys for the user's account on the server.
   • If no terminal access to the server and the client at the same time:
     • ssh-copy-id -i ~/.ssh/pub/key user@<SERVER IP>
   • If terminal access to the server and the client at the same time:
     • Create or overwrite existing file cat <PUBLIC KEY> > ~/.ssh/authorized_keys
     • Append to existing file cat <PUBLIC KEY> >> ~/.ssh/authorized_keys
     • Open file and paste the public key into it. Each row represents a public key. The format for each row is the same as the public key: ssh-ed25519 <PUBLIC KEY> <COMMENT>
4. Ensure server keys are generated for each algorithm used.

• Directory /etc/ssh/
• If one or more key types already exist, and is to be updated, remove them and then re-generate new keys.
  • ssh-keygen -A or systemctl restart sshdgenkeys.service

5. Print the applicable server key. For example:
   • ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

• SSH keys

Ensure permission is read-only to all keys stored locally:

• $ chmod 400 <PRIVATE KEY>
• $ chmod 400 <PUBLIC KEY>

The keys could be read and write (6), but removed write in order to prevent accidentally overwriting.

• Encrypted SOCKS tunnel -TND

• $ chmod 700 ~/.ssh/

• ~/.ssh/config

  Host user
    HostName server.local
    User user
    Port 22

Connect: ssh user

• ~/.ssh/sshd_config

HashKnownHosts no
StrictHostKeyChecking yes

• ~/.ssh/authorized_hosts
  • chmod 400

1. Verify server fingerprint
   • Retrieve the server public key ssh-keyscan -p <PORT> <SERVER>.
   • Retrieve the server fingerprint from the public key (OpenSSH >= 7.2) ssh-keyscan -p <PORT> <SERVER> | ssh-keygen -lf -.
   • Add the server fingerprint to known hosts ~/.ssh/known_hosts:
     • ssh-keyscan -H -p <PORT> <SERVER> >> ~/.ssh/known_hosts or
     • if HashKnownHosts yes then re-hash the known hosts ssh-keygen -Hf ~/.ssh/known_hosts
2. Login to server. For example:
   • ssh [email protected] -p <PORT>
   • ssh -F /<PATH TO ssh_config> -i /<PATH TO PRIVATE KEY> -p <PORT> <USER>@<IP, DOMAIN NAME>
   • ssh <NAME DEFINED IN ~/.ssh/config>

Destination must have permission of user@<IP> scp -i .ssh/prv/user\@<IP> -P 49999 /path/to/local/file/to.copy user@<IP>:/home/user

sshfs -p <PORT>          \
  -F ~/.ssh/ssh_config   \
  -o debug               \
  -o IdentityFile=~/.ssh/prv/key \
  -o UserKnownHostsFile=~/.ssh/known_hosts \
  user@<IP>:/   \
  /mnt/

Unmount:

• fusermount -u /mnt/

Render a program on a remote server with no graphic output on a local client with graphic output.

ForwardX11 yes ~/.ssh/ssh_config on both local and remote computer. SSH with -X or -Y