SSH and SFTP — Secure Remote Access
Every task on web1 in this course began with "SSH in". SSH is the encrypted door to your servers, and how you set it up decides whether that door is easy for you and hard for everyone else.
The rule
Use keys, not passwords: the private key stays home, the public key travels.
SSH (Secure Shell) gives you an encrypted terminal on a remote machine, normally on port 22. Key-based login works with a key pair:
- The private key stays on your laptop, protected by a passphrase. Never copy or share it.
- The public key is placed on the server, in
~/.ssh/authorized_keysof the account you log in as.
ssh-keygen -t ed25519 -C "you@laptop" # create a key pair
ssh-copy-id deploy@web1.example.com # install the public key on the server
ssh deploy@web1.example.com # log in with the keyA ~/.ssh/config entry saves typing:
Host web1
HostName web1.example.com
User deploy
IdentityFile ~/.ssh/id_ed25519Now ssh web1 is enough. The first time you connect, SSH records the server's host key in ~/.ssh/known_hosts. If that key later changes, SSH warns loudly: it could be a rebuilt server, or someone intercepting you. Find out which before continuing.
Once keys work, harden the server in /etc/ssh/sshd_config with PasswordAuthentication no and PermitRootLogin no, then reload sshd.
Moving files. Old FTP sends passwords and data unencrypted, so avoid it. SFTP is a file-transfer protocol that runs inside SSH, using the same port and keys. scp also copies over SSH, and rsync over SSH copies only what changed.
sftp web1 # interactive transfers
scp release.tar.gz web1:/srv/releases/ # copy one fileThe shortcut
For any remote-access question ask "does this travel over SSH?" If yes, it is encrypted and uses your keys. If no, like FTP, it is a plain-text risk that you should replace.
Create and install a key
ssh-keygen -t ed25519, thenssh-copy-id deploy@web1.example.com.
The trap: disabling passwords before confirming key login works, and locking yourself out of the server.
Drills
Answer fast — trust the rule.
Which key goes into the server's ~/.ssh/authorized_keys?
What does SFTP run on top of?
SSH warns that the remote host key has changed. What should you do?
Why avoid classic FTP for deployments?
Remember
- Use keys, not passwords: the private key stays home, the public key travels.
- Shortcut: "does it travel over SSH?" If not, replace it.
- Trap: disabling passwords before testing key login in a fresh session.