SSH and Secure Access

# Generate an Ed25519 key pair (preferred — smaller and faster than RSA)
ssh-keygen -t ed25519 -C "alice@workstation"

# Generate RSA 4096 if Ed25519 is not supported on the target
ssh-keygen -t rsa -b 4096 -C "alice@workstation"

# Keys are stored in:
# ~/.ssh/id_ed25519       — private key (chmod 600, never share)
# ~/.ssh/id_ed25519.pub   — public key (safe to distribute)

# Copy the public key to a remote server
ssh-copy-id -i ~/.ssh/id_ed25519.pub alice@192.168.1.10

# Manual alternative (when ssh-copy-id is not available)
cat ~/.ssh/id_ed25519.pub | ssh alice@192.168.1.10 \
  "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

# Verify key login works BEFORE disabling password auth
ssh -i ~/.ssh/id_ed25519 alice@192.168.1.10

# ~/.ssh/config — client-side SSH configuration
# Permissions must be: chmod 600 ~/.ssh/config

# ── Global defaults for all hosts ────────────────────────────────
Host *
    ServerAliveInterval 60        # send keepalive every 60 seconds
    ServerAliveCountMax 3         # disconnect after 3 missed keepalives
    AddKeysToAgent yes            # automatically add keys to ssh-agent
    IdentityFile ~/.ssh/id_ed25519

# ── Production web server ─────────────────────────────────────────
Host web-prod
    HostName 203.0.113.10
    User deploy
    Port 2222
    IdentityFile ~/.ssh/id_ed25519_deploy

# ── Bastion / jump host ───────────────────────────────────────────
Host bastion
    HostName bastion.example.com
    User alice
    IdentityFile ~/.ssh/id_ed25519

# ── Internal server reached via the bastion ───────────────────────
Host db-internal
    HostName 10.0.1.50
    User dbadmin
    ProxyJump bastion          # tunnel through bastion automatically

# ── GitHub ────────────────────────────────────────────────────────
Host github.com
    IdentityFile ~/.ssh/id_ed25519_github
    AddKeysToAgent yes

# With the config above, these long commands become short aliases:
# Instead of: ssh -i ~/.ssh/id_ed25519_deploy -p 2222 deploy@203.0.113.10
ssh web-prod

# Instead of: ssh -J alice@bastion.example.com dbadmin@10.0.1.50
ssh db-internal

# Test the config — show which settings would be used for a host
ssh -G web-prod

# Check config file permissions (must be 600 or SSH ignores it)
ls -la ~/.ssh/config

# Start the SSH agent (usually started automatically on login in modern distros)
eval "$(ssh-agent -s)"

# Add a key to the agent — prompts for passphrase once
ssh-add ~/.ssh/id_ed25519

# Add a key with a time limit (auto-removed after 4 hours)
ssh-add -t 14400 ~/.ssh/id_ed25519

# List keys currently loaded in the agent
ssh-add -l

# Remove a specific key from the agent
ssh-add -d ~/.ssh/id_ed25519

# Remove all keys from the agent
ssh-add -D

# ── Agent Forwarding ──────────────────────────────────────────────
# Connect to a server AND forward your agent (so you can ssh further
# from that server without copying keys there)
ssh -A alice@bastion.example.com

# Or set ForwardAgent in ~/.ssh/config for specific hosts
# Host bastion
#     ForwardAgent yes

# IMPORTANT: Only enable ForwardAgent for trusted hosts — a compromised
# intermediate server could use your forwarded agent to authenticate elsewhere

# ── Local forwarding — access a remote database locally ──────────
# Forward local port 5433 to port 5432 on db.internal via bastion
ssh -L 5433:db.internal:5432 -N -f alice@bastion.example.com
# -N = no command, just tunnel; -f = run in background
# Now connect to the database as: psql -h localhost -p 5433

# ── Remote forwarding — expose local dev server to a remote host ──
# Make your local port 3000 accessible as port 8080 on the remote server
ssh -R 8080:localhost:3000 -N alice@server.example.com

# ── Dynamic forwarding — SOCKS5 proxy ────────────────────────────
ssh -D 1080 -N -f alice@server.example.com
# Configure browser/app to use SOCKS5 proxy at 127.0.0.1:1080

# ── Jump hosts / ProxyJump ────────────────────────────────────────
# Reach an internal server through a bastion in one command
ssh -J alice@bastion.example.com dbadmin@10.0.1.50

# Multi-hop jump chain
ssh -J user@hop1,user@hop2 user@final-destination

# ── Persistent tunnel with autossh ───────────────────────────────
sudo apt install autossh -y
autossh -M 0 -f -N -L 5433:db.internal:5432 alice@bastion.example.com

# Back up before editing
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.$(date +%Y%m%d)

# Apply the hardened configuration
sudo tee /etc/ssh/sshd_config.d/hardening.conf <<'EOF'
# Drop-in hardening config — overrides defaults without touching the main file
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers alice bob deploy
MaxAuthTries 3
LoginGraceTime 30
X11Forwarding no
ClientAliveInterval 300
ClientAliveCountMax 2
AllowAgentForwarding no
AllowTcpForwarding no
EOF

# ALWAYS validate before reloading — a syntax error locks you out
sudo sshd -t && echo "Config OK"

# Reload the daemon (keeps existing sessions alive)
sudo systemctl reload sshd

# Verify the settings took effect
sudo sshd -T | grep -E "permitrootlogin|passwordauthentication|allowusers"

# Show all current SSH sessions
who
w
last | head -20        # login history
lastb | head -10       # failed login history (requires root)

# Show failed SSH attempts from the journal
journalctl -u sshd --since "24 hours ago" | grep "Failed"

# Count unique IPs attempting to login in the last hour
journalctl -u sshd --since "1 hour ago" | \
  grep "Failed password" | \
  grep -oP '(\d{1,3}\.){3}\d{1,3}' | sort -u | wc -l

# Check fail2ban status and banned IPs
sudo fail2ban-client status sshd
sudo fail2ban-client get sshd banned