SSH (Secure Shell) is a fundamental tool for managing Linux servers: it is an encrypted connection through which you can run commands on a remote machine, copy files and establish a secure tunnel to other services. If you rent a VPS, this is how you’ll install, update and configure it; if you have cPanel hosting, you can use it to run WP-CLI or Composer commands and manage your Git repositories.

In this guide, we explain how SSH works, how to connect from Windows, macOS and Linux, how to set up key-based authentication instead of a password, how to copy files, how to secure SSH access to a server, and what the most common error messages mean.

How does SSH work?

SSH operates on a client–server basis: the SSH service (usually the OpenSSH sshd process on Linux) runs on the server and, by default, accepts connections on TCP port 22, whilst an SSH client on your own machine connects to it.

When the connection is established, the two parties agree on encryption keys, so that everything that subsequently travels over the network (the password, the commands and their results, and the files) is encrypted. This is why SSH has replaced the old, unencrypted Telnet, and why SFTP, which is based on SSH, is better than plain FTP, which sends passwords in plain text.

When connecting for the first time, the client displays the server’s fingerprint and asks whether you trust it. Once accepted, it is recorded (in the ~/.ssh/known_hosts file), and if a different fingerprint is detected at the same address next time, you will be warned. This protects against someone intercepting the connection on behalf of the server; if the warning appears unexpectedly (you haven’t reinstalled the server), do not proceed.

Video: How Secure Shell Works (SSH) - Computerphile (Computerphile)

What can it be used for?

• Server management: installing and updating packages, editing configuration files, restarting services, reading logs.
• File transfer: SFTP, SCP and rsync, encrypted.
• Development work: Git operations, WP-CLI, Composer, npm, and command-line database backup and restore.
• Tunnel: a secure way to access a service running on a server that is not accessible from the outside (such as a database or remote desktop) from your own computer.

Where can I access SSH at aWh?

• KVM VPS: full SSH access with root privileges.
• cPanel hosting: from the cP Premium plan upwards, within your own hosting account (thanks to CloudLinux CageFS, you’ll only see your own files).
• Static hosting: SFTP file transfer, without command-line access.
• Web hosting (KeyHelp): SSH is not available; you can manage your files via FTP or using the file manager.

Sign up

In all cases, you will need your username and the server address, for example root@203.0.113.10 or felhasznalo@szerver.awh.hu.

Windows

The OpenSSH client is built in under Windows 10 and 11. Open PowerShell or Terminal and type:

ssh felhasznalo@203.0.113.10

For non-standard ports: ssh -p 2222 felhasznalo@203.0.113.10.

If you’re looking for a graphical client, PuTTY is the classic choice, whilst MobaXterm also includes a built-in SFTP browser; WinSCP and FileZilla also use SFTP for file transfers.

macOS and Linux

Open the Terminal and use the same command: ssh felhasznalo@203.0.113.10. The OpenSSH client is installed by default on both systems.

From a mobile phone

On Android, you can use the Termius or JuiceSSH apps, and on iPhone, the Termius or Blink Shell apps – they’re handy for quick checks and running the odd command.

The steps for connecting to your VPS for the first time are also described in the knowledge base article on connecting to your VPS via SSH.

Key-based login instead of a password

Password-based SSH login is the most common target for attacks: automated bots are constantly trying to guess passwords. Key-pair authentication is much more secure: a private key remains on your own machine, whilst the corresponding public key is stored on the server. When you log in, the server verifies that you have the private key, without it ever travelling over the network.

1. Creating a key pair (the same procedure applies in Windows PowerShell, on macOS and on Linux):

ssh-keygen -t ed25519 -C "laptop-2026"

Ed25519 is today’s recommended key type: short, fast and strong. If an older system does not support it, use an -t rsa -b 4096 key. Set a passphrase: if your laptop falls into the wrong hands, the key cannot be used without it. To avoid having to type it in every time, ssh-agent will remember it for the duration of the session.

2. Uploading the public key to the server:

ssh-copy-id felhasznalo@203.0.113.10

On Windows, where ssh-copy-id is not available, copy the contents of the file C:\Users\<név>\.ssh\id_ed25519.pub onto the server and paste them at the end of the ~/.ssh/authorized_keys file. On cPanel hosting, you can also upload or generate the key via the control panel; the steps for this are described in the article on creating and uploading an SSH key in cPanel.

3. Try logging in with the key in a new window to see if it works, and only then disable password-based login (see below). If you disable it first, you may lock yourself out.

Multiple keys, multiple servers: you can add multiple public keys to a single server (one per line in the authorized_keys file), so each of your devices or colleagues can have their own key, which you can revoke individually. On your own machine, you can specify the address, username, port and key for each server in the ~/.ssh/config file:

Host webszerver
    HostName 203.0.113.10
    User janos
    Port 22
    IdentityFile ~/.ssh/id_ed25519

Then all you need to do is: ssh webszerver.

Copying files via SSH

• SFTP: using a graphical program (FileZilla, WinSCP, Cyberduck) or via the command line (sftp felhasznalo@szerver). A secure alternative to standard FTP.
• SCP: quickly copying individual files: scp mentes.tar.gz felhasznalo@szerver:/home/felhasznalo/.
• rsync: synchronises directories, transferring only the changes, making it the fastest option for large volumes and repeated copying: rsync -avz ./public_html/ felhasznalo@szerver:/var/www/oldal/.

The article on using scp, rsync and sftp explains how to use these three tools in detail.

Useful information

• Long-running commands: if the connection is lost, the running command will also stop. Use tmux or screen: the session will continue to run on the server, and you can reconnect to it later. This is covered in the article on using tmux and screen.
• Tunnel: After running ssh -L 3307:localhost:3306 felhasznalo@szerver, you can access the server’s database on your own machine at localhost:3307 without having to open port 3306.
• Who has logged in? The last command shows previous logins, whilst who shows who is currently logged in; the detailed log can be viewed using journalctl -u ssh (Debian, Ubuntu) or journalctl -u sshd (AlmaLinux, Rocky Linux).
• You don’t need a static IP address for SSH, but if you have one, you can configure the firewall to only allow access from that address, which provides very effective protection.

SSH server security on a VPS

The SSH port of a freshly installed VPS is targeted by automated password-guessing attacks within minutes. The settings below eliminate most of the risk.

1. Create your own user with sudo privileges, and use this instead of root for day-to-day tasks.

2. Enable key-based authentication, then disable password-based authentication. In the /etc/ssh/sshd_config file (or in a file under /etc/ssh/sshd_config.d/):

   PasswordAuthentication no
   PermitRootLogin prohibit-password
   

   If you already have your own sudo user, root login can be completely disabled: PermitRootLogin no. After saving, check the setting (sudo sshd -t), restart the service (sudo systemctl restart ssh or sshd), and try logging in in a new window before closing the old one.

3. Fail2ban: automatically blocks the IP address of anyone attempting to log in after a number of failed attempts. The article on configuring Fail2ban explains how to install it.
4. Firewall: only open the ports you need, and if you have a static IP address, only allow SSH access from that address.
5. Updates: vulnerabilities also occur in OpenSSH (the 2024 ‘regreSSHion’, for example, allowed remote code execution without a password on unpatched servers), so make sure you enable automatic security updates.
6. Changing the port (for example, from 22 to 2222) reduces log noise, but does not provide protection on its own; it is no substitute for key-based authentication or Fail2ban. If you change the port, you must also open the new port in the firewall, and on AlmaLinux and Rocky Linux, you must also enable it in SELinux.

Further details are set out in our knowledge base article on SSH server security settings and our VPS security guide.

If you lose your private key, you’ll only be able to access the server with another valid key or password. That’s why it’s worth keeping access from at least two devices (or with a securely stored backup key). If you’ve lost everything, please contact us if you have an aWh VPS, and we’ll help you regain access. If your key may have fallen into the wrong hands, delete the public part from the authorized_keys file on every server.

Common error messages

• Connection timed out: packets are not reaching the server. Either the IP address or port is incorrect, a firewall (on the server or on your own network) is blocking the connection, or the server is not running. If you are using IP restriction or Fail2ban, it is possible that your own IP address has been blocked.
• Connection refused: the server is accessible, but the SSH service is not running on that port. Either the port is incorrect, or the sshd service has stopped.
• Permission denied (publickey): the server does not accept the key. Either the username is incorrect, the client is offering the wrong key (you can specify this using the -i switch), or the permissions on the server are incorrect: the ~/.ssh directory should be set to 700 and the authorized_keys file to 600.
• REMOTE HOST IDENTIFICATION HAS CHANGED: the server’s fingerprint has changed. If you have reinstalled the server, this is to be expected: delete the old entry (ssh-keygen -R 203.0.113.10). If not, do not connect until you know why it has changed.
• Too many authentication failures: the client has tried too many keys. Specify the correct one using the -i) switch or in the ~/.ssh/config file (IdentitiesOnly yes).

Summary

SSH is the secure foundation for managing Linux servers. You can connect from Windows, macOS and Linux using the built-in client; instead of a password, use an Ed25519 key protected by a passphrase. On a VPS, your first task should be to set up key-based authentication, disable password and root access, configure Fail2ban and the firewall, and transfer files via SFTP or rsync rather than FTP.

aWh’s KVM VPS servers come with full root-level SSH access, whilst SSH is available on cPanel hosting plans from the Premium package onwards.

Frequently Asked Questions

Is SSH more secure than FTP?

Yes. FTP sends passwords and files unencrypted, whereas SFTP, which is based on SSH, encrypts everything. If your hosting provider allows it, always use SFTP.

Which SSH client should I use on Windows 11?

Use the built-in OpenSSH client in PowerShell or Terminal; if you need a graphical program, use PuTTY or MobaXterm, and for file transfer, use WinSCP.

What should I do if I’ve forgotten my password?

The password cannot be reset. Generate a new key pair and upload the new public key to the server using another working access method; delete the old one from the authorized_keys file.

Can I use more than one SSH key on a single machine?

Yes. Create separate keys, for example, one for work and one for your own projects, and specify in the ~/.ssh/config file which one the client should use for each server.

How do I run a command so that it continues to run even after I log out?

Run it in atmux or screen, or using the nohup parancs &. tmux is best, as you can reconnect later.

Do you need a static IP address for SSH?

No, but if there is one, you can only allow access through the firewall, which provides very effective protection.

Is SSH secure on public Wi-Fi?

Yes, the connection is encrypted. However, keep an eye on the server’s fingerprint: if it changes unexpectedly, do not connect.

Do I need to reconfigure port 22?

This is not mandatory. It reduces the number of automated attempts visible in the logs, but real protection comes from disabling key-based and password-based logins, and using Fail2ban.

• ssh
• server administration
• vps
• guides