Topolearn

Learn SSH

Secure remote shells, file transfer and tunnels with OpenSSH

15 lessons · 3 hours · 4 levels · covers SSH OpenSSH 10.0

SSH (Secure Shell) gives you an encrypted, authenticated connection to another machine for running commands, copying files and tunnelling network traffic. OpenSSH is the implementation on virtually every Linux server, Mac and modern Windows, and it is how developers reach servers, Git hosts and cloud VMs.

Sign in free to track progressOfficial docs ↗

Before you start

SSH builds on these; the tree links to the exact lessons you need.

LinuxEssentials level

How deep do you want to go?

1. EssentialsRead and write simple code, do the everyday basics5 lessons · 40 min in total
2. PracticalUse it productively at work, with the usual idioms9 lessons · 1 hour in total
3. AdvancedThe less common features, performance and trade-offs12 lessons · 2 hours in total
4. ExpertInternals and the edge cases experts know15 lessons · 3 hours in total

The SSH tree

SSHConnecting with sshConnecting with sshHost keys and known_hostsHost keys andknown_hostsGenerating SSH key pairsGenerating SSH keypairsauthorized_keys and ssh-copy-idauthorized_keys andssh-copy-idRunning remote commands and piping dataRunning remotecommands and pipi…ssh-agent: unlock once, use all dayssh-agent: unlockonce, use all day~/.ssh/config: hosts and aliases~/.ssh/config: hostsand aliasesscp, sftp and rsync over SSHscp, sftp and rsyncover SSHLocal port forwarding (-L)Local port forwarding(-L)
Essentials and Practical shown (9 of 15 lessons); the full list is below. Click a lesson to read it.

All 15 lessons, in order

Connecting

  1. Connecting with ssh · Essentials · 8 min

    ssh user@host opens an encrypted shell on a remote machine; -p picks the port and exit or Ctrl-d closes it.

  2. Host keys and known_hosts · Essentials · 8 min

    The server's host key is recorded in ~/.ssh/known_hosts on first connect; a changed key triggers a loud warning.

  3. Running remote commands and piping data · Essentials · 8 min

    ssh host 'command' runs one command remotely and returns its output and exit status, and stdin/stdout flow through the connection.

Keys and authentication

  1. Generating SSH key pairs · Essentials · 8 min

    ssh-keygen -t ed25519 creates a private key you keep secret and a .pub public key you hand out.

  2. authorized_keys and ssh-copy-id · Essentials · 8 min

    A server trusts your public key once it is listed in ~/.ssh/authorized_keys of the target account, with strict permissions.

  3. ssh-agent: unlock once, use all day · Practical · 9 min

    ssh-agent holds decrypted keys in memory so you type a passphrase once per session, not on every connection.

Client configuration

  1. ~/.ssh/config: hosts and aliases · Practical · 10 min

    Describe hosts once in ~/.ssh/config with Host blocks so ssh web just works with the right user, port and key.

  2. Connection multiplexing (ControlMaster) · Expert · 10 min

    Reuse one authenticated SSH connection for many sessions with ControlMaster, ControlPath and ControlPersist.

Copying files

  1. scp, sftp and rsync over SSH · Practical · 10 min

    Copy files with scp, browse interactively with sftp, and sync directories efficiently with rsync over SSH.

Tunnels and forwarding

  1. Local port forwarding (-L) · Practical · 10 min

    ssh -L 5433:localhost:5432 db makes a remote service, such as a database, appear on a port of your own machine.

  2. Bastions and ProxyJump · Advanced · 10 min

    Reach private machines through a bastion host with ssh -J or ProxyJump, without copying keys to the bastion or forwarding your agent.

  3. Remote (-R) and dynamic (-D) forwarding · Advanced · 10 min

    -R exposes a port of your machine on the server, and -D turns ssh into a SOCKS proxy for any destination.

Server, security and internals

  1. Configuring and hardening sshd · Advanced · 12 min

    Lock down an SSH server: keys only, no root password logins, limited users, and safe config testing before reload.

  2. SSH certificates and CAs · Expert · 15 min

    Sign user and host keys with an SSH certificate authority so servers trust a CA instead of individual keys, with expiry built in.

  3. How the SSH protocol works · Expert · 15 min

    SSH-2 layers a transport (key exchange, encryption, host auth), user authentication and multiplexed channels on one TCP connection.