SSH Mastery: Key Management, Port Forwarding, Tunnels & Server Hardening
The complete production reference for OpenSSH: Ed25519 key generation, SSH agent forwarding security, multiplexing via ~/.ssh/config, local/remote/dynamic port tunneling, root lockout, and Fail2ban defense.
1. Modern SSH Key Generation (Ed25519 vs RSA)
ssh-keygen -t ed25519 -a 100 -C "ops@production-cluster" -f ~/.ssh/id_ed25519-a 100 instructs bcrypt KDF to run 100 rounds of memory-hard derivation, greatly slowing brute-force cracking if the private key file is stolen.
ssh-copy-id -i ~/.ssh/id_ed25519.pub -p 22 deploy@203.0.113.10Securely appends the public key to ~/.ssh/authorized_keys and enforces mandatory 700 and 600 permissions.
chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys ~/.ssh/id_ed25519 && chmod 644 ~/.ssh/id_ed25519.pubOpenSSH strictly rejects key authentication if permissions are too open to other users on the host machine.
2. Professional SSH Client Config (~/.ssh/config)
# Production Bastion & Internal VPC Nodes
Host bastion
HostName 203.0.113.1
User jumpadmin
Port 2222
IdentityFile ~/.ssh/id_ed25519
ForwardAgent no
Host internal-db-*
User postgres
ProxyJump bastion
IdentityFile ~/.ssh/id_ed25519_db
# Universal Connection Multiplexing (Instant 2nd connection)
Host *
ControlMaster auto
ControlPath ~/.ssh/sockets/%r@%h:%p
ControlPersist 10m
ServerAliveInterval 60
ServerAliveCountMax 3ControlMaster reuses existing authenticated TCP connections, reducing subsequent connection latency from 800ms down to 12ms.
mkdir -p ~/.ssh/sockets && chmod 700 ~/.ssh/socketsEnsures the Unix domain socket path exists with secure user-only access.
3. SSH Tunnels: Local (-L), Remote (-R) & Dynamic SOCKS5 (-D)
ssh -N -L 5433:127.0.0.1:5432 deploy@db-server.prodForwards local port 5433 to the remote server's internal port 5432. Connect your local GUI tool to localhost:5433.
ssh -N -R 8080:127.0.0.1:3000 deploy@public-vps.comAllows an external server at public-vps.com:8080 to forward traffic backward into your local port 3000.
ssh -N -D 1080 deploy@exit-node.netSpawns an encrypted SOCKS5 proxy on 127.0.0.1:1080. Point your browser or curl --socks5 127.0.0.1:1080 through it.
| Tunnel Type | Flag Syntax | Traffic Flow | Primary Use Case | Copy |
|---|---|---|---|---|
| Local (-L) | ssh -L [local_port]:[remote_host]:[remote_port] | Client -> Remote Server -> Target Network | Reach a private service (database, internal web UI) from your laptop through a bastion host | |
| Remote (-R) | ssh -R [remote_port]:[local_host]:[local_port] | Remote Server -> Client -> Local Machine | Expose a local dev server to a remote machine (reverse tunnel), e.g. for a webhook demo | |
| Dynamic (-D) | ssh -D [local_socks_port] | Client SOCKS5 -> Encrypted Tunnel -> Open Internet | Local SOCKS5 proxy: route browser or CLI traffic through the SSH server |
4. Server-Side Hardening (/etc/ssh/sshd_config)
# /etc/ssh/sshd_config.d/99-hardened.conf
Port 22
Protocol 2
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding yesCompletely disables password brute-forcing, locks root login, and drops idle connections after 10 minutes.
sshd -t && systemctl reload sshdsshd -t validates syntax before reloading. ALWAYS test your new connection in a separate terminal before closing your active session!
5. Automated Brute-Force Defense with Fail2ban
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = systemd
maxretry = 3
findtime = 600
bantime = 86400Bans any IP address for 24 hours (86400 seconds) after 3 failed login attempts within a 10-minute window.
fail2ban-client status sshd
# To unban an accidental lockout:
fail2ban-client set sshd unbanip 198.51.100.24Displays current failure metrics and provides safe administrative unban capability.
Related Free Online Tools
Put these techniques into practice immediately with our privacy-first browser utilities:
Generate high-entropy passphrases to encrypt SSH private keys.
Calculate exact octal permissions for ~/.ssh (700) and authorized_keys (600).
Verify cryptographic signatures and message authentication.
