SSH (Secure Shell) is a network protocol that establishes an encrypted connection between two computers, allowing you to securely control a remote machine even over an untrusted network, such as the internet. Via an SSH connection, you can run commands, copy files and transfer other network traffic. It has completely replaced the old, unencrypted protocols (telnet, rsh): remote management of Linux servers is now carried out almost exclusively via SSH.

On Linux, the most widely used implementation is OpenSSH. On the server, the sshd service accepts connections, by default on TCP port 22, whilst the client uses the ssh command, which is available as a built-in feature on Linux, macOS and Windows 10 and later versions.

How does it work?

1. Server authentication. Upon connection, the server presents its own public key (host key). On the first connection, the client displays the fingerprint of this key and asks whether you trust it. Once accepted, the key is added to the ~/.ssh/known_hosts file, and the client verifies it on every subsequent connection.
2. Encrypted channel. The two parties exchange keys to generate a shared key that is valid only for this connection, and from this point onwards, all data is transmitted in encrypted form.
3. User authentication. This can be done using a password or a key pair. With key-based authentication, the private key never leaves your computer; the server only recognises the public key, which is why this is the more secure method.

Connecting to a server

Open a terminal or command prompt on your own computer and type:

ssh felhasznalo@szervercime

Replace felhasznalo with your server username (usually root for VPS on first login) and szervercime with your server’s IP address or hostname. If SSH is not running on port 22, specify the port using the -p switch: ssh -p 2222 felhasznalo@szervercime. On your first connection, type yes to accept the server’s key, then enter your password. You can log out using the exit command or the Ctrl+D key combination.

The step-by-step guide to connecting to our KVM VPS via SSH from Windows, macOS and Linux is available in the VPS SSH connection guide.

Setting up password-protected login

ssh-keygen -t ed25519
ssh-copy-id felhasznalo@szervercime

The first command generates a key pair on your own machine (by default in the files ~/.ssh/id_ed25519 and id_ed25519.pub), whilst the second copies the public key to the server’s ~/.ssh/authorized_keys file. You can then log in using the key, without a password. Protect your private key with a passphrase and never share it with anyone.

What else can it be used for?

• File copying: scp, sftp and rsync all transfer files via SSH; see: copying files between servers.
• Tunnelling: a service available only locally on a server, such as a database, can be securely accessed from your own computer, or the server can also be used as a SOCKS proxy.
• Convenience settings: in the ~/.ssh/config file, you can assign a short name to your servers, together with the username, port and key.

Common error messages

• Connection refused: the SSH service is not running on the server, or it is listening on a different port.
• Connection timed out: the port is blocked by a firewall, or the address is incorrect.
• Permission denied (publickey): the server only allows access via a key and cannot find the correct key.
• REMOTE HOST IDENTIFICATION HAS CHANGED: the server’s key has changed, for example following a reinstallation. If you are certain this is the cause, delete the old entry using the command ssh-keygen -R szervercime; if not, do not connect, as the connection may be hijacked.

The article on SSH server security settings covers how to secure the SSH server (making key-based authentication mandatory and restricting root access).