SSH and Remote Access

By the end of this lesson you'll be able to open an encrypted shell on a remote server, set up passwordless key-based login, recognise host-key prompts, and move files back and forth with scp and sftp — the everyday toolkit for working on machines you can't physically touch.

Learn SSH and Remote Access in our free Command Line course — an interactive lesson with worked examples, a practice exercise and a quick reference.

Part of the free Cli course at LearnCodingFast — hands-on lessons with examples you run in your browser, plus practice exercises and a quick quiz.

What You'll Learn

1. Opening a Remote Shell

SSH (Secure Shell) gives you an encrypted command line on another machine. The basic form is ssh user@host — your username on the server, then the address. SSH uses port 22 by default; if a server listens elsewhere, add -p , as in ssh -p 2222 user@host . You can also tack a command on the end to run it remotely and return immediately.

2. Host Keys & known_hosts

The first time you connect to a server, SSH has no record of it, so it prints the server's fingerprint and asks you to confirm. Say yes only if it matches what you expect. SSH then stores that host key in ~/.ssh/known_hosts . On every later connection it compares the server's key against this file — and warns you loudly if it changed, which is how SSH catches impersonation or a man-in-the-middle attack.

3. Generating a Key Pair

Key-based auth starts with ssh-keygen -t ed25519 -C "you@example.com" , which creates a key pair : a private key ( ~/.ssh/id_ed25519 ) you keep secret, and a public key ( ~/.ssh/id_ed25519.pub ) that's safe to share. You put the public key on servers; the private key never leaves your machine — don't email it, commit it, or paste it anywhere.

4. Installing Your Public Key

To enable passwordless login, your public key needs to live on the server. ssh-copy-id user@host does this for you: it appends your .pub key to the server's ~/.ssh/authorized_keys — the file listing every public key allowed to log in as you. It asks for your password just once to do the install; after that, ssh user@host logs you in automatically with your key.

5. Host Shortcuts with ~/.ssh/config

Typing ssh -p 2222 -i ~/.ssh/id_ed25519 ada@server.example.com every time is tedious. The ~/.ssh/config file lets you save those settings under a short nickname using a Host block with HostName , User , Port , and IdentityFile . Then you just run ssh myserver . Bonus: scp and sftp read this file too.

6. Transferring Files: scp & sftp

SSH also moves files. scp (secure copy) sends them over the same encrypted channel: scp localfile user@host:/path/ copies to the remote host, scp user@host:/path/file . copies one back , and -r copies a whole directory. For an interactive session where you browse and grab files, use sftp user@host .

🎯 Your Turn: connect on a custom port

Fill in the blank marked ___ using the # 👉 hint, then picture the prompt you'd land on.

🎯 Your Turn: set up passwordless login

Two blanks: pick the key type, and the tool that installs your public key on the server. Then check the output.

Pro Tips

• 💡 Prefer ed25519 keys: ssh-keygen -t ed25519 gives short, fast, modern keys. They're the recommended default over older RSA keys.
• 💡 Let ssh-agent remember your passphrase: ssh-agent holds your decrypted private key in memory so you don't retype the passphrase on every connection.
• 💡 Lean on ~/.ssh/config: one Host block per server turns long commands into ssh prod . scp and sftp honour it too.
• 💡 Forward the agent only when you trust the host: ssh -A lets a remote machine use your keys — handy for hopping to a second server, but a malicious host could abuse it, so use it sparingly.

Common Errors (and the fix)

• "Permission denied (publickey)" — the server didn't accept your key. Make sure your public key is in the server's ~/.ssh/authorized_keys (run ssh-copy-id user@host ), and that you're offering the matching private key.
• "Connection refused" — nothing is listening on the port you tried. The SSH service may be down, or it's on a non-default port — add -p PORT .
• "REMOTE HOST IDENTIFICATION HAS CHANGED!" — the server's host key no longer matches ~/.ssh/known_hosts . This can be a legit server rebuild — or an attack. Verify the new fingerprint out-of-band before removing the old line.
• "UNPROTECTED PRIVATE KEY FILE!" — your private key is too readable. Tighten it with chmod 600 ~/.ssh/id_ed25519 (and chmod 700 ~/.ssh ).
• scp "No such file or directory" — you forgot the colon, so SSH treated host/path as a local file. Remote targets need host:/path .

📋 Quick Reference

Task

Command

Notes

Connect

ssh user@host

Encrypted remote shell

Custom port

ssh -p 2222 user@host

Default port is 22

Make a key

ssh-keygen -t ed25519

Creates a key pair

Install key

ssh-copy-id user@host

Adds public key to server

Private key

~/.ssh/id_ed25519

Keep secret

Public key

~/.ssh/id_ed25519.pub

Safe to share

Allowed keys

~/.ssh/authorized_keys

On the server

Known hosts

~/.ssh/known_hosts

Saved fingerprints

Shortcuts

~/.ssh/config

Per-host settings

Copy to remote

scp file user@host:/path/

Note the colon

Copy from remote

scp user@host:/path/file .

Dot = here

Interactive transfer

sftp user@host

get / put / ls

Frequently Asked Questions

Mini-Challenge: one-word login + deploy copy

No blanks this time — just a brief and an outline. Wire up a ~/.ssh/config shortcut, confirm your key is on the server, then push a release file using your new nickname. Check your result against the goal in the comments.

🎉 Lesson Complete!

• ✅ ssh user@host opens an encrypted shell; -p picks a non-default port (default is 22)
• ✅ ssh-keygen -t ed25519 makes a key pair: a secret private key and a shareable public key
• ✅ ssh-copy-id puts your public key in the server's ~/.ssh/authorized_keys for passwordless login
• ✅ Host keys live in ~/.ssh/known_hosts and guard against impersonation; ~/.ssh/config saves shortcuts
• ✅ scp and sftp move files; ssh-agent remembers your passphrase and ssh -A forwards it to trusted hosts
• ✅ Next lesson: Scheduling Tasks with cron — run commands automatically on a timetable

Practice quiz

Continue this course

• Previous: Package Managers
• Next: Scheduling Tasks with cron