Tag: ssh

SSH Bastion & Jump Host Patterns That Don't Hurt

Stop opening port 22 to the world. SSH bastion hosts, ProxyJump chains, session recording, and self-hosted Teleport alternatives that actually work.

SOCKS5 Over SSH: Selective Routing Without a VPN

Route only the traffic you want through a SOCKS5 proxy via ssh -D. Browser extensions, curl, git, ProxyChains, autossh, and DNS leak gotchas, no VPN needed.

Assume Your App Gets Popped

How to expose a possibly-vulnerable app to the public internet and survive it: rootless containers, a file-integrity tripwire, and zero inbound SSH on the box.

2FA for SSH and sudo via PAM

Adding TOTP to SSH and sudo takes 10 minutes and makes password spray attacks useless. Here's the setup that won't lock you out of your own server.

SSH CA: Finally Ditch authorized_keys

Managing authorized_keys across 10 servers is how you lose track of who has access to what. An SSH CA lets you sign keys and revoke access without touching every server.

Port Knocking: Simple Obscurity for SSH Access

Hide your SSH port from scanners with port knocking. It's not a replacement for security, but it's a valid defense-in-depth tactic.

SSH Hardening: Lock Down Remote Access Without Locking Yourself Out

Harden SSH properly: disable password auth, switch to Ed25519 keys, configure sshd_config, set up SSH certificates with step-ca, add 2FA, and configure ProxyJump for bastion hosts.

SSHFS: Ditch SCP & Access Remote Files

SSHFS mounts remote filesystems over SSH so you can browse and edit files locally, faster than scp for interactive work.

SSH Agent Forwarding: How It Works

Understand SSH agent forwarding security risks. When it's safe (almost never), and better alternatives like ProxyJump for jump hosts.

Why Your SSH Connection Keeps Dropping

Fix SSH timeouts: ServerAliveInterval, ServerAliveCountMax, ClientAliveInterval. Understand NAT, firewalls, and TCP keepalive.

SSH Multiplexing: Stop Reconnecting Every Time

Master SSH ControlMaster, ControlPath, and ControlPersist. Reuse connections for lightning-fast SSH, SCP, and rsync operations.

The SSH Config File: The Shortcut You're Not Using

Master ~/.ssh/config: Host aliases, HostName, User, Port, IdentityFile, ProxyJump. Stop typing long SSH commands. One-line setup.