Tag: ssh

2FA for SSH and sudo via PAM

Adding TOTP to SSH and sudo takes 10 minutes and makes password spray attacks useless. Here's the setup that won't lock you out of your own server.

SSH CA: Finally Ditch authorized_keys

Managing authorized_keys across 10 servers is how you lose track of who has access to what. An SSH CA lets you sign keys and revoke access without touching every server.

SSH keys and secure file copy

Generate SSH keys, set up passwordless auth, configure SSH, and transfer files securely with SCP — the foundation of headless Linux work.

Port Knocking: Simple Obscurity for SSH Access

Hide your SSH port from scanners with port knocking. It's not a replacement for security, but it's a valid defense-in-depth tactic.

SSH Keys in 2026: Ed25519 Is the Standard

RSA SSH keys are aging out. Why Ed25519 is the 2026 default, how to generate one in 30 seconds, and how to audit and rotate your legacy keys safely.

SSH Hardening: Lock Down Remote Access Without Locking Yourself Out

Harden SSH properly: disable password auth, switch to Ed25519 keys, configure sshd_config, set up SSH certificates with step-ca, add 2FA, and configure ProxyJump for bastion hosts.

SSHFS: Ditch SCP & Access Remote Files

SSHFS mounts remote filesystems over SSH so you can browse and edit files locally — faster than scp for interactive work.

SSH Agent Forwarding: How It Works

Understand SSH agent forwarding security risks. When it's safe (almost never), and better alternatives like ProxyJump for jump hosts.

Why Your SSH Connection Keeps Dropping

Fix SSH timeouts: ServerAliveInterval, ServerAliveCountMax, ClientAliveInterval. Understand NAT, firewalls, and TCP keepalive.

SSH Multiplexing: Stop Reconnecting Every Time

Master SSH ControlMaster, ControlPath, and ControlPersist. Reuse connections for lightning-fast SSH, SCP, and rsync operations.

The SSH Config File: The Shortcut You're Not Using

Master ~/.ssh/config: Host aliases, HostName, User, Port, IdentityFile, ProxyJump. Stop typing long SSH commands. One-line setup.

Understanding the regreSSHion Vulnerability in OpenSSH

regreSSHion (CVE-2024-6387) is a remote code execution bug in OpenSSH — what it is, which versions are affected, and how to patch fast.