DHIVA LABS · LEARN

Appearance

SSH: sign in to another computer ​

SSH lets you type commands on another computer, copy files to and from it, and reach its services, all over one encrypted connection. By the end of this lesson you know what happens when you connect, how to tell that you reached the right machine, and how to turn on an SSH server.

What SSH is ​

SSH (Secure Shell) is a protocol, a set of rules two programs follow, for signing in to a computer over a network. Everything it carries is encrypted, so someone on the same Wi-Fi sees only scrambled data: not your password, not your commands, not your files.

There are always two sides:

SideWhat it doesExamples
SSH serverListens on TCP port 22 and lets people sign inOpenSSH server (sshd) on Linux, Windows or a Raspberry Pi
SSH clientConnects to a serverThe ssh command, SecureShell Go, CrossShell, VS Code Remote-SSH

The computer you sign in to is often called the host or the server. Your phone with SecureShell Go is a client: it connects to servers, and nothing connects to it.

One SSH connection can carry several things at once: a terminal, file transfers (SFTP), and forwarded ports (tunnels, in lesson 4).

What happens when you connect ​

text
 Client (your phone)                         Server 192.168.1.20, port 22
     │                                                    │
  1  │──── open a TCP connection to port 22 ─────────────►│
  2  │◄─── both say which SSH version they speak ────────►│
  3  │◄─── key exchange: agree a secret, encryption on ──►│
  4  │◄─── server proves who it is with its HOST KEY ─────│
  5  │  client compares that key with the one it saved    │
  6  │──── you prove who you are: password or key ───────►│
  7  │◄─── terminal, files or tunnels, all encrypted ────►│

The order matters. Encryption is on before you send anything secret (step 3), and the server proves its identity (step 4) before you type a password (step 6). If the identity check fails, the client stops there, and your password never leaves your device.

The host key: is this the right machine? ​

Every SSH server has a host key: a key pair created when the server was installed, kept in /etc/ssh/ on Linux. It works like the server's passport. Anyone can see the public half; only the server holds the private half, so only the real server can prove it owns that key.

A key is long, so people compare a short fingerprint of it instead: SHA256: followed by 43 characters.

The first connection ​

The first time you connect, your client has never seen this server's key. It shows you the fingerprint and asks:

text
$ ssh maya@192.168.1.20
The authenticity of host '192.168.1.20 (192.168.1.20)' can't be established.
ED25519 key fingerprint is: SHA256:L8BPGUEDc7xoANerKu6RDnDAVO8vcb82Tldt2QFHxVU
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Answering yes without looking defeats the purpose. Compare the fingerprint with one you got from the server itself, not over the same network connection. On the server's own screen and keyboard, run:

bash
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
text
256 SHA256:L8BPGUEDc7xoANerKu6RDnDAVO8vcb82Tldt2QFHxVU root@maya-desktop (ED25519)

If the two match, type yes. If you cannot check, for example because the server is a cloud machine, use the fingerprint its provider shows in its web console.

The client then saves the key in ~/.ssh/known_hosts, one line per server:

text
192.168.1.20 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI…

Next time it checks silently. To see whether a host is in your file:

bash
ssh-keygen -F 192.168.1.20

SecureShell Go does the same with its Unknown host dialog: compare the SHA256 fingerprint, then Accept & save or Reject. See Verify host keys.

The changed-host-key warning ​

If a server you trusted shows a different key, the client refuses to connect:

text
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
…
Offending ED25519 key in /home/maya/.ssh/known_hosts:3
  remove with:
  ssh-keygen -f '/home/maya/.ssh/known_hosts' -R '192.168.1.20'
Host key verification failed.

There are two explanations, and you must find out which:

  • Innocent: the server was reinstalled, rebuilt from an image, or its keys were regenerated. On a home network, a different device may also have been given the old device's address by DHCP. A virtual machine you recreate gets a new key too; WinBridge's guide says exactly this for its Windows VM.
  • An attack: something between you and the server is pretending to be it, a machine in the middle, hoping you will type your password.

Never click through

Do not delete the old key only to make the warning go away. First find out why it changed. Only when you know, and you have checked the new fingerprint on the server's own screen, remove the old line with ssh-keygen -R 192.168.1.20 and connect again.

In SecureShell Go, the same situation shows Host key has CHANGED and blocks the connection until you verify the new key.

Sign in and run commands ​

bash
ssh maya@192.168.1.20

maya is the account on the server; 192.168.1.20 is the server's address (a name such as maya-desktop.local works too). Add -p 2222 if the server listens on another port. Type exit to leave.

To run one command and come straight back:

bash
ssh maya@192.168.1.20 uptime

When a connection fails and the message is not enough, add -v for a step-by-step report of what the client is doing.

Copy files: SFTP and scp ​

SFTP (SSH File Transfer Protocol) moves files over the SSH connection. Any OpenSSH server offers it, with nothing extra to set up.

bash
# copy a file to your home folder on the server (note the colon)
scp notes.txt maya@192.168.1.20:

# copy a file from the server into the current folder
scp maya@192.168.1.20:/var/log/syslog .

# an interactive session: ls, cd, get, put, then exit
sftp maya@192.168.1.20

The colon after the address is what makes it a remote path; without it, scp copies to a local file named maya@192.168.1.20. Since OpenSSH 9.0, scp itself uses the SFTP protocol underneath.

In SecureShell Go, Browse files opens an SFTP file browser on the same connection. See Copy files with SFTP.

Turn on an SSH server ​

Only do this on a computer you own or look after.

Ubuntu ​

bash
sudo apt install openssh-server

The package turns the server on straight away. Check it:

bash
systemctl status ssh.socket

You should see Active: active (listening). Since Ubuntu 22.10, SSH uses socket activation: systemd itself listens on port 22 (ssh.socket) and starts the real server, ssh.service, when the first connection arrives. So systemctl status ssh can say inactive while SSH is ready to use. On Ubuntu 22.04 and older, the server runs all the time as ssh.service, so check it with systemctl status ssh, which shows active (running).

Either way, ss -tln should now list 0.0.0.0:22 and [::]:22.

Windows 10 and 11 ​

  1. Open Settings › System › Optional features (on Windows 10, Settings › Apps › Optional features).

  2. Add the feature OpenSSH Server and wait for it to install.

  3. Open Services, find OpenSSH SSH Server, start it, and set Startup type to Automatic.

Or, in PowerShell run as administrator:

powershell
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'

Installing it adds a Windows Firewall rule that allows port 22. The server's settings live in C:\ProgramData\ssh\sshd_config, and its host keys are in the same folder, so the fingerprint command is:

powershell
ssh-keygen -lf C:\ProgramData\ssh\ssh_host_ed25519_key.pub

CrossShell does all of this for you on Linux and Windows, and records each paired machine's host key during pairing, so you never see the first-connection question. See Pair two machines.

Stay safe ​

  • Check the fingerprint on the first connection, from the server's own screen or its provider's console. Never accept an unchecked one on public or shared Wi-Fi.
  • Treat a changed host key as an attack until you can explain it. Abort, ask why, verify, then update.
  • An SSH sign-in is full control of that account. Deleted files are gone; there is no recycle bin over SSH.
  • Turn the server off when you do not need it. Lesson 5 covers locking it down when you do.

Check yourself ​

QuizSSH: sign in to another computer

Question 1 of 6

When you connect over SSH, which happens first?

Score: 0

What you learned ​

  • SSH is a client and a server, usually on TCP port 22, with everything encrypted.
  • The server proves who it is with its host key before you send a password.
  • Compare the fingerprint on the first connection; the client remembers it in known_hosts.
  • A changed host key blocks the connection; find out why before trusting the new key.
  • scp and sftp copy files over SSH; on Ubuntu 22.10 and later, ssh.socket listens for the server.

Next steps ​