ssh - Secure Shell Remote Access¶

generieren

Umfassende SSH-Befehle für sicheren Fernzugriff, Tunneling und Systemverwaltung auf allen Plattformen.

Einfache Verbindung¶

Command	Description
`ssh user@hostname`	Connect to remote host
`ssh user@192.168.1.100`	Connect using IP address
`ssh -p 2222 user@hostname`	Connect to custom port
`ssh hostname`	Connect with current username

Verbindungsoptionen¶

Command	Description
`ssh -v user@hostname`	Verbose output for debugging
`ssh -vv user@hostname`	More verbose output
`ssh -vvv user@hostname`	Maximum verbosity
`ssh -q user@hostname`	Quiet mode (suppress warnings)

Authentifizierungsmethoden¶

Passwort Authentication¶

```bash

ssh user@hostname

Force password authentication¶

ssh -o PreferredAuthentications=password user@hostname

Disable password authentication¶

ssh -o PasswordAuthentication=no user@hostname ```_

Schlüsselbasierte Authentifizierung¶

```bash

Generate SSH key pair¶

ssh-keygen -t rsa -b 4096 -C "your_email@example.com" ssh-keygen -t ed25519 -C "your_email@example.com" # Modern, secure

Copy public key to remote server¶

ssh-copy-id user@hostname ssh-copy-id -i ~/.ssh/id_rsa.pub user@hostname

Manual key installation¶

cat ~/.ssh/id_rsa.pub|ssh user@hostname "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys" ```_

Schlüsselverwaltung¶

Command	Description
`ssh-keygen -t ed25519`	Generate Ed25519 key (recommended)
`ssh-keygen -t rsa -b 4096`	Generate 4096-bit RSA key
`ssh-keygen -f ~/.ssh/custom_key`	Generate key with custom name
`ssh-add ~/.ssh/private_key`	Add key to SSH agent
`ssh-add -l`	List loaded keys
`ssh-add -D`	Remove all keys from agent

Konfiguration¶

SSH Client Config (~/.ssh/config)¶

```bash

Global defaults¶

Host * ServerAliveInterval 60 ServerAliveCountMax 3 TCPKeepAlive yes

Specific host configuration¶

Host myserver HostName server.example.com User myusername Port 2222 IdentityFile ~/.ssh/myserver_key ForwardAgent yes

Jump host configuration¶

Host target HostName 192.168.1.100 User admin ProxyJump jumphost

Host jumphost HostName jump.example.com User jumpuser ```_

Gemeinsame Konfigurationsoptionen¶

Option	Description	Example
`HostName`	Real hostname or IP	`HostName server.example.com`
`User`	Username for connection	`User admin`
`Port`	SSH port number	`Port 2222`
`IdentityFile`	Private key file	`IdentityFile ~/.ssh/id_rsa`
`ForwardAgent`	Enable agent forwarding	`ForwardAgent yes`
`Compression`	Enable compression	`Compression yes`

Port Forwarding und Tunneling¶

Lokaler Hafen¶

```bash

Forward local port to remote service¶

ssh -L 8080:localhost:80 user@hostname

Forward to different remote host¶

ssh -L 3306:database.internal:3306 user@gateway

Multiple port forwards¶

ssh -L 8080:localhost:80 -L 3306:localhost:3306 user@hostname ```_

Remote Port Forwarding¶

```bash

Forward remote port to local service¶

ssh -R 8080:localhost:3000 user@hostname

Allow remote connections to forwarded port¶

ssh -R 0.0.0.0:8080:localhost:3000 user@hostname ```_

Dynamic Port Forwarding (SOCKS Proxy)¶

```bash

Create SOCKS proxy on local port 1080¶

ssh -D 1080 user@hostname

Use with applications¶

Configure browser to use SOCKS proxy: localhost:1080¶

```_

X11 Weiterleitung¶

```bash

Enable X11 forwarding for GUI applications¶

ssh -X user@hostname

Trusted X11 forwarding¶

ssh -Y user@hostname

Run GUI application¶

ssh -X user@hostname firefox ```_

Integration von Dateiübertragungen¶

SCP Integration¶

```bash

Copy file to remote host¶

scp file.txt user@hostname:/path/to/destination/

Copy from remote host¶

scp user@hostname:/path/to/file.txt ./

Recursive copy¶

scp -r directory/ user@hostname:/path/to/destination/ ```_

FTP Integration¶

```bash

Start SFTP session¶

sftp user@hostname

SFTP with custom port¶

sftp -P 2222 user@hostname ```_

Erweiterte Funktionen¶

Jump Hosts und Bastion Server¶

```bash

Connect through jump host¶

ssh -J jumphost user@target

Multiple jump hosts¶

ssh -J jump1,jump2 user@target

Using ProxyCommand¶

ssh -o ProxyCommand="ssh -W %h:%p jumphost" user@target ```_

SSH Agent und Key Management¶

```bash

Start SSH agent¶

eval $(ssh-agent)

Add key to agent¶

ssh-add ~/.ssh/id_rsa

Add key with timeout (1 hour)¶

ssh-add -t 3600 ~/.ssh/id_rsa

List agent keys¶

ssh-add -l

Remove specific key¶

ssh-add -d ~/.ssh/id_rsa

Remove all keys¶

ssh-add -D ```_

Verbindung Multiplexing¶

```bash

Host * ControlMaster auto ControlPath ~/.ssh/sockets/%r@%h-%p ControlPersist 600

Create socket directory¶

mkdir -p ~/.ssh/sockets ```_

Sicherheit und Härten¶

Sichere Verbindungsoptionen¶

```bash

Disable password authentication¶

ssh -o PasswordAuthentication=no user@hostname

Use specific key only¶

ssh -o IdentitiesOnly=yes -i ~/.ssh/specific_key user@hostname

Disable host key checking (development only)¶

ssh -o StrictHostKeyChecking=no user@hostname

Use specific cipher¶

ssh -c aes256-ctr user@hostname ```_

Host Key Verifikation¶

```bash

Check host key fingerprint¶

ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub

Remove host key from known_hosts¶

ssh-keygen -R hostname

Add host key manually¶

ssh-keyscan hostname >> ~/.ssh/known_hosts ```_

Zertifikatbasierte Authentifizierung¶

```bash

Generate user certificate¶

ssh-keygen -s ca_key -I user_id -n username user_key.pub

Use certificate for authentication¶

ssh -o CertificateFile=user_key-cert.pub user@hostname ```_

Fehlerbehebung¶

Verbindungsprobleme¶

```bash

Debug connection problems¶

ssh -vvv user@hostname

Test specific authentication method¶

ssh -o PreferredAuthentications=publickey user@hostname

Check SSH service status¶

systemctl status ssh # Linux service ssh status # Linux (older) ```_

Gemeinsame Probleme und Lösungen¶

Problem	Symptoms	Solution
Permission denied	Authentication fails	Check key permissions (600 for private key)
Connection timeout	No response	Check firewall, network connectivity
Host key verification failed	Key mismatch warning	Update known_hosts or verify host identity
Agent forwarding not working	Keys not available on remote	Enable ForwardAgent in config

Schlüsselberechtigungsfragen¶

```bash

Fix SSH key permissions¶

chmod 700 ~/.ssh chmod 600 ~/.ssh/id_rsa chmod 644 ~/.ssh/id_rsa.pub chmod 644 ~/.ssh/authorized_keys chmod 644 ~/.ssh/known_hosts chmod 600 ~/.ssh/config ```_

Automatisierung und Schrift¶

Nicht interaktiv SSH¶

```bash

Run single command¶

ssh user@hostname "ls -la /var/log"

Run multiple commands¶

ssh user@hostname "cd /var/log && tail -f syslog"

Execute local script on remote host¶

ssh user@hostname 'bash -s' < local_script.sh

Execute with sudo¶

ssh user@hostname "sudo systemctl restart nginx" ```_

Batch Operationen¶

```bash

!/bin/bash¶

Deploy to multiple servers¶

servers=("web1.example.com" "web2.example.com" "web3.example.com")

for server in "$\\\\{servers[@]\\\\}"; do echo "Deploying to \(server" ssh user@$server "cd /var/www && git pull origin main" ssh user@\)server "sudo systemctl restart nginx" done ```_

SSH mit Expect (Password Automation)¶

```bash

!/usr/bin/expect¶

spawn ssh user@hostname expect "password:" send "your_password\r" interact ```_

Leistungsoptimierung¶

Kompression und Geschwindigkeit¶

```bash

Enable compression¶

ssh -C user@hostname

Disable compression for fast networks¶

ssh -o Compression=no user@hostname

Use faster cipher for trusted networks¶

ssh -c arcfour user@hostname ```_

Verbindung Persistence¶

```bash

Keep connection alive¶

ssh -o ServerAliveInterval=60 user@hostname

Persistent connection in background¶

ssh -f -N -L 8080:localhost:80 user@hostname ```_

Plattformspezifische Überlegungen¶

Windows (OpenSSH)¶

```powershell

Windows OpenSSH client¶

ssh user@hostname

Windows SSH config location¶

%USERPROFILE%.ssh\config

Start SSH agent on Windows¶

Start-Service ssh-agent ssh-add ~/.ssh/id_rsa ```_

macOS Keychain Integration¶

```bash

Add key to macOS keychain¶

ssh-add --apple-use-keychain ~/.ssh/id_rsa

Configure automatic keychain loading¶

Host * AddKeysToAgent yes UseKeychain yes ```_

Best Practices¶

Sicherheit¶

**Benutze Schlüsselauthentifizierung*: Kennwort-Authentifizierung deaktivieren
**Strong Keys*: Verwenden Sie Ed25519 oder 4096-bit RSA Schlüssel
Key Rotation: Regelmäßig drehen SSH-Tasten
**Principle of Least Privilege*: Benutzerzugriff beschränken
Monitor Access: SSH-Verbindungen protokollieren und überwachen

Konfigurationsmanagement¶

**Centralized Config*: Verwenden Sie ~/.ssh/config für gemeinsame Einstellungen
**Host Aliases*: Wichtige Host-Aliase erstellen
Könnungsmultiplikation: Reuse-Verbindungen für Effizienz
** Agent Forwarding*: Verwenden Sie vorsichtig, nur wenn nötig
Dokumentation: Dokument benutzerdefinierte Konfigurationen

Betrieb¶

**Backup Keys*: Sichere Sicherung privater Schlüssel
**Test-Verbindungen*: Regelmäßig testen SSH-Zugang
Update Software: SSH-Client/Server aktualisieren
**Monitor Logs*: Uhr für verdächtige Aktivität
Emergency Access: Alternativen Zugang erhalten

ssh - Secure Shell Remote Access¶

Einfache Verbindung¶

Einfache Verbindung¶

Verbindungsoptionen¶

Authentifizierungsmethoden¶

Passwort Authentication¶

Standard password login¶

Force password authentication¶

Disable password authentication¶

Schlüsselbasierte Authentifizierung¶

Generate SSH key pair¶

Copy public key to remote server¶

Manual key installation¶

Schlüsselverwaltung¶

Konfiguration¶

SSH Client Config (~/.ssh/config)¶

Global defaults¶

Specific host configuration¶

Jump host configuration¶

Gemeinsame Konfigurationsoptionen¶

Port Forwarding und Tunneling¶

Lokaler Hafen¶

Forward local port to remote service¶

Forward to different remote host¶

Multiple port forwards¶

Remote Port Forwarding¶

Forward remote port to local service¶

Allow remote connections to forwarded port¶

Dynamic Port Forwarding (SOCKS Proxy)¶

Create SOCKS proxy on local port 1080¶

Use with applications¶

Configure browser to use SOCKS proxy: localhost:1080¶

X11 Weiterleitung¶

Enable X11 forwarding for GUI applications¶

Trusted X11 forwarding¶

Run GUI application¶

Integration von Dateiübertragungen¶

SCP Integration¶

Copy file to remote host¶

Copy from remote host¶

Recursive copy¶

FTP Integration¶

Start SFTP session¶

SFTP with custom port¶

Erweiterte Funktionen¶

Jump Hosts und Bastion Server¶

Connect through jump host¶

Multiple jump hosts¶

Using ProxyCommand¶

SSH Agent und Key Management¶

Start SSH agent¶

Add key to agent¶

Add key with timeout (1 hour)¶

List agent keys¶

Remove specific key¶

Remove all keys¶

Verbindung Multiplexing¶

Enable connection sharing in ~/.ssh/config¶

Create socket directory¶

Sicherheit und Härten¶

Sichere Verbindungsoptionen¶

Disable password authentication¶

Use specific key only¶

Disable host key checking (development only)¶

Use specific cipher¶

Host Key Verifikation¶

Check host key fingerprint¶

Remove host key from known_hosts¶

Add host key manually¶

Zertifikatbasierte Authentifizierung¶

Generate user certificate¶

Use certificate for authentication¶

Fehlerbehebung¶

Verbindungsprobleme¶

Debug connection problems¶

Test specific authentication method¶

Check SSH service status¶

Gemeinsame Probleme und Lösungen¶

Schlüsselberechtigungsfragen¶

Fix SSH key permissions¶