SSH on Linux: keys and hardening

In short: SSH is encrypted remote access to Linux machines. With key pairs instead of passwords it is much safer.

In more detail: The public key is on the server, the private one stays with the user. Whoever has the private key gets in without a password being transmitted.

In detail

ssh-keygen -t ed25519 -C "my-laptop"        # create key pair
ssh-copy-id user@server                      # public key to the server
ssh user@server                              # connect
scp file user@server:/path/                  # copy
ssh -L 8080:localhost:80 user@server         # port forwarding

• Hardening (/etc/ssh/sshd_config): PasswordAuthentication no, PermitRootLogin no, AllowUsers max, after changes sudo systemctl reload ssh.
• Changing the port: only reduces noise in the logs, no real protection.
• Fail2ban: blocks IPs after several failed attempts.
• ssh-agent: keeps unlocked keys in memory.
• Config: ~/.ssh/config with short names.
• Host keys: check the fingerprint on first connection (known_hosts).
• Protect private keys: set a passphrase, never share, permissions 600.
• Alternatives: Mosh, Tailscale/WireGuard to reach machines without open ports.

See also: Firewall on Linux: nftables, ufw and firewalld, SSH connect