SSH

SSH is the Secure Shell, a powerful encrypted communication tool. This page contains some basic information about the use of SSH.

SSH Software

SSH client and server programs are included with almost all Linux distributions and Mac OS/X. You can obtain SSH client and server software for most other platforms, including Windows and Android.

On Windows, the PuTTy open-source ssh client is recommended.

Here are some possible SSH clients:

Platform	Software	Comments
Linux	OpenSSH	Included in almost all Linux distributions
OSX	OpenSSH	Included with OSX
ChromeOS (Chromebook)	crosh	The CROme SHell (crosh) includes SSH support - use Ctrl-Alt-T inside Chrome to open a crosh tab.
Android	JuiceSSH	Free and premium versions available in the Google Play store.
Windows	Putty	Free and open source SSH client.

Using SSH for a Text-Based Connection

The most basic use of SSH is for a text-based connection used to enter commands and view command output, or execute a text-based application such a menu-driven system.

The basic form of the ssh client command is:

ssh [OPTIONS] [user@]host command

Note that the ssh command name may vary, depending on the software used.

Where:

• user is the name of the user account on the remote computer (optional, if the user account name is the same on both systems)
• host is the name or IP address of the remote computer
• command is the command to be executed on the remote computer (optional - the default is to open whatever shell or application is the default for the specified user)

Useful options include:

Option	Description	Example
-C	Enable compression (gzip) to enhance performance	ssh -C user@host
-X or -Y	Turn on X11 forwarding (it is recommended that -C also be used) - See X11 Tunnelling, below	ssh -X -C user@host
-L or -R	Turns on tunnelling	(See Tunnelling section)
-i identityfile	Specifies the private key file to be used (default: all private keys in ~/.ssh)	ssh -i ~/.ssh/id_dsa user@host

Examples

• Connect to a shell for account 'kim' on the computer 'winter': ssh kim@winter
• Like above, with compression: ssh -C kim@winter
• Run df -h on the remote system, and display the graphics on the local computer: ssh -XC kim@winter firefox

Using SSH for a Graphical Application (X11 Tunnelling)

SSH is capable of carrying graphical traffic using the X Window System (X11) protocol. This means that if your client system is running the X Window System (most Unix/Linux systems, and any Mac or Windows system on which an X Server has been started), you can run remote graphical programs and display the output (windows) locally.

To enable this, add the -X or -Y options to your command line. The difference between -X and -Y is that (ideally) the -X option will prevent certain advanced types of access which are not required by most graphical programs and which may present a security vulnerability, such as taking a screenshot of your desktop.

Example

• Run Firefox on the remote system, and display the graphics on the local computer: ssh -XC kim@winter firefox

Using SSH with Tunnelling

In addition to X11 tunnelling, SSH permits you to set up your own tunnels to carry arbitrary network traffic either from the client system to the server, or from the server to your client. This allows you to encrypt the traffic for security/privacy, and to circumvent firewalls.

For local, forward (client to server) tunnels, the syntax is:

ssh -L listenport:destinationhost:destinationport [OPTIONS] [user@]host [command]

Where:

• listenport is the port on the client machine which will accept connections
• destinationhost is the remote computer hostname or IP address to which connections will be directed. This is usually localhost, which denotes the SSH server, but it can also be the name of a system which the server can directly reach. Note that communication between the server and the destinationhost is not encrypted.
• destinationport is the port on the destinationhost to which the connection will be directed

For reverse (server to client) tunnels, the syntax is:

ssh -R listenport:destinationhost:destinationport [OPTIONS] [user@]host [command]

The arguments have the same meaning, but are executed one the opposite hosts, so the tunnel listens on the server and communicates to the destination through the client system.

Examples

• To connect port 8080 on the local computer to port 80 on the server winter, using the account sam: ssh -L 8080:localhost:80 sam@winter
  • After the tunnel above was put in place, you could access http://localhost:8080/ and be connected to the webserver (port 80) on the host winter
• To connect port 2000 on the local computer to port 1234 on the host spring, which is on the same LAN as the SSH server winter: ssh -R 2000:spring:1234 sam@winter
• To connect port 3000 on the server winter to port 5900 on the local computer: ssh -L 3000:localhost:5900 sam@winter

Using SSH for File Transfer

SSH provides two mechanisms for file transfer: scp and sftp.

scp - Secure Copy

The scp command functions like the normal Unix/Linux copy (cp) command, but accepts a hostname (and optional user ID) prepended to a filename for copying to/from remote systems:

scp [user@]host:sourcefilename [user@]host:destinationfilename

Examples

• Copy the file /etc/hosts from this computer to the /tmp directory on the computer ireland: scp /etc/hosts ireland:/tmp
• Copy the file test.tar from the home directory of the user chris on the computer ireland to the current directory: scp chris@ireland:~/test.tar .

sftp - Secure FTP

sftp provides an encrypted version of FTP. The command usage is:

sftp [user@]host

At which point you can use any standard FTP command.

Example

• Open a secure FTP connection to the account john.doe on the server matrix.senecac.on.ca: sftp john.doe@matrix.senecac.on.ca

Graphical File Management over SSH

Many Linux graphical file managers, such as the GNOME Nautilus and KDE Konqueror programs, know how to manage files remotely using the ssh/scp/sftp protocols. For example, on GNOME, you can select the menu option Places>Connect to Server, enter the connection details, and view a file management window on a remote server. You can then rename, copy, move, and delete files using drag-and-drop operations (for example, you can copy a file by dragging it from your desktop to the remote window). You can also create bookmarks for rapid access to remote filesystems at a later date.

Using SSH with Public-Key Authentication

Although SSH can be used with passwords, a sysadmin may need to initiate hundreds of SSH connections a day, and typing passwords that often is tedious. SSH therefore permits authentication using public and private keys.

Background: Public Key Cryptography

See Public Key Cryptography for an overview of how this technology works.

Using Public Keys with SSH

Creating a Public/Private Key Pair

1. Enter this command: ssh-keygen
   • Answer the questions asked by ssh-keygen. Use default values for most questions. The use of a passphrase is strongly recommended.
   • ssh-keygen will produce two files:
     • ~/.ssh/id_rsa - your private key
     • ~/.ssh/id_rsa.pub - your public key

Key Type and Length
ssh-keygen can generate two types of keys: rsa and dsa. Either type serves the same purpose, and can be generated with varying key lengths. The longer the key, the more difficult it is to break the key by guessing it (trying successive values until the right key is found) - each bit added to the key doubles the number of possible key values. Key lengths of 1024-4096 bits are considered reasonably secure; as computers become faster, key lengths should be increased.

Sending the Public Key to a Remote System Administrator

1. Mail (or otherwise send) the ~/.ssh/id_rsa.pub file to the remote system administrator. Do NOT send your private key!

Setting up Public Key Authentication on Two Machines

Automatically (preferred approach):

1. Run the command: ssh-copy-id user@host

Manually:

1. Copy the public key to the remote system you wish to access.
2. Create the ~/.ssh directory if it does not exist.
   • Set the permission on ~/.ssh to 0700
3. Append the public key to the file ~/authorized_keys
   • Set the permission on ~/authorized_keys to 0600