1. To securely connect to the remote server using SSH, you need to generate a key pair and configure the client and server. First, execute ssh-keygen to generate the key and set passphrase protection, add the public key to the server authorized_keys file to achieve password-free login; 2. Configure alias by editing ~/.ssh/config and enable connection reuse to improve connection efficiency; 3. Modify sshd_config to prohibit root login, turn off password authentication, and restrict logged in users to enhance security; 4. When connecting to an intranet server, you can transfer through the springboard machine through the -J parameter or ProxyJump configuration. Properly managing keys and optimizing configuration ensures that SSH connections are both convenient and secure.

Using SSH to connect to a remote server is a very basic and important operation in system management and daily operations. As long as it is properly configured, SSH can provide encrypted communication, authentication, and secure transmission capabilities. Here are some key points and practical suggestions to help you securely connect to remote servers with SSH.

Generate and log in with a key pair

Compared to password login, using SSH keys is more secure and more convenient. You can generate a pair of keys by following the steps below:

• Execute the ssh-keygen command to generate the default RSA key (you can also add -t ed25519 to use a more modern algorithm)
• Set an optional passphrase (password-like protection mechanism) to increase security
• Add the public key (usually ~/.ssh/id_rsa.pub or ~/.ssh/id_ed25519.pub ) content to the target server's ~/.ssh/authorized_keys file

Once set up, you can log in without password next time you connect.

Tip: Don’t copy private key files at will and store them everywhere, it is equivalent to your "digital ID card". If multiple devices are required to log in, different keys can be generated for each device and added to the server separately.

Configure SSH client options to improve experience

The default behavior of SSH is enough, but a little tweaking of the configuration can make the connection process easier. These configurations are written in the local user's ~/.ssh/config file:

• You can alias common servers, such as:

   Host myserver
    HostName example.com
    User yourname
    IdentityFile ~/.ssh/id_ed25519

• Enable connection multiplexing can speed up multiple connections:

   ControlMaster auto
  ControlPath ~/.ssh/sockets/%r@%h-%p
  ControlPersist 600

  (Provided that you created the .ssh/sockets directory)

In this way, you only need to enter ssh myserver to quickly connect.

Restrict SSH permissions on the server

In order to further improve security, you can make some restrictive configurations on the server, modify the /etc/ssh/sshd_config file and restart the sshd service to take effect:

• Disable root login: PermitRootLogin no
• Close password login, only key login is allowed: PasswordAuthentication no
• Change the default port (not recommended if not necessary): Port 2222
• Restrict users who are allowed to log in: AllowUsers user1 user2

Remember to confirm that you have other ways to access the server before modifying it, otherwise you may lock yourself outside.

Use springboard machine or proxy to connect to the intranet server

If you are connecting to an intranet server without a public IP, you can connect indirectly through a springboard machine (Jump Host). There are two methods:

1. Use the -J parameter to specify the springboard machine at one time:

    ssh -J user@gateway user@internal-server

2. Configure ProxyJump in ~/.ssh/config :

    Host internal-server
     HostName 192.168.1.10
     User appuser
     ProxyJump gateway-user@gateway-host

In this way, even if the target server is not on the public network, it can be used like a direct connection.

---

Basically that's it. SSH is very powerful, but mastering the above common practices can meet the needs of most scenarios. The key is to manage the key well and configure the client and server reasonably, so that the connection is fast and safe.

The above is the detailed content of How to use ssh to connect securely to a remote server?. For more information, please follow other related articles on the PHP Chinese website!