Secure Shell (SSH) is the cryptographic network protocol that enables encrypted communication and remote administrative command execution over unsecured networks. In DevOps, SSH is used for managing cloud virtual machines, executing CI/CD deployment jobs, tunneling database connections, and authenticating to Git repositories.
1. Asymmetric Cryptography: Public vs. Private Keys
SSH authentication relies on asymmetric public-key cryptography:
- Public Key (
id_ed25519.pub): Represents an open padlock. You can freely share this public string with GitHub, AWS EC2, or append it to~/.ssh/authorized_keyson any number of servers. - Private Key (
id_ed25519): Represents the physical master key that opens that padlock. It must NEVER leave your personal laptop, be shared with colleagues, or be committed to a Git repository.
2. Generating Modern SSH Keypairs with ssh-keygen
Always generate keys using the modern Ed25519 elliptic-curve algorithm (faster, shorter, and cryptographically superior to legacy RSA):
- Location: Press Enter to accept the default file path (
~/.ssh/id_ed25519). - Passphrase: Enter a strong passphrase to encrypt your private key at rest on your laptop.
- This creates two files in
~/.ssh/:id_ed25519(Private Key — permissions must be600)id_ed25519.pub(Public Key — safe to distribute)
3. Authorizing Keys on Remote Servers: ssh-copy-id
To allow logging into a remote server using your keypair, your public key must be added to the server's ~/.ssh/authorized_keys file:
Mandatory File Permissions (Strictly Enforced by SSH)
The SSH daemon (sshd) will deliberately reject connection attempts if permissions on client or server SSH files are too permissive:
4. Masterclass: Advanced ~/.ssh/config Architecture
Instead of memorizing IP addresses, custom ports, and long key paths, configure aliases in ~/.ssh/config:
With this configuration, you can SSH into an isolated private VPC node with a single command:
5. Secure File Transfer: scp vs. rsync
While scp handles simple one-off file transfers, rsync is the gold-standard tool for DevOps because it transfers only changed file differences (delta-transfer), supports resume on disconnect, and preserves file metadata:
6. Production SSH Server Hardening (/etc/ssh/sshd_config)
When provisioning cloud servers, secure the SSH daemon against brute-force scanners:
Applying Changes Safely
Never close your active terminal session when modifying sshd_config. If there is a syntax error and sshd fails to restart, you will be locked out of the server permanently!
Summary
- Use Ed25519 (
ssh-keygen -t ed25519) for modern, high-performance cryptography. - Public keys live in
~/.ssh/authorized_keys; Private keys remain strictly confidential. - Permissions must be locked down:
700on~/.sshand600on private keys. - Manage multi-node VPC infrastructure cleanly using
~/.ssh/configandProxyJump. - Use
rsync -avzPfor efficient delta-compressed file synchronization. - Harden production servers by setting
PasswordAuthentication noandPermitRootLogin no.
In the final lesson, you will master Unix pipes, stream redirection (>, 2>&1), shell scripting best practices (set -euo pipefail), and terminal multiplexing with tmux!