OpenSSH

OpenSSH (Open Secure Shell) is a free and open-source implementation of the SSH (Secure Shell) protocol. It provides a suite of tools for securely accessing and managing remote systems over an encrypted connection. OpenSSH is developed by the OpenBSD Project and is the most widely used SSH implementation on Unix-like systems, including Linux, BSD, and macOS.

OpenSSH is the default SSH client and server on most Linux distributions, including Debian, Ubuntu, Red Hat, and Arch Linux.

Key Features

Secure remote login – Provides encrypted terminal access to remote machines
Public key authentication – Enables secure, passwordless login using cryptographic key pairs
Secure file transfer – Tools like `scp` and `sftp` for transferring files
Port forwarding and tunneling – Forward local or remote ports over SSH
Agent forwarding – Temporarily use local SSH keys on remote systems
Configurable access control – Fine-grained SSH access rules via `sshd_config`

OpenSSH Tools

OpenSSH includes a set of command-line tools:

ssh – Secure remote shell client
sshd – SSH daemon (server)
scp – Secure file copy
sftp – Secure FTP-like file transfer interface
ssh-keygen – Generate and manage SSH key pairs
ssh-agent – SSH key agent for managing private keys
ssh-add – Add keys to the agent
ssh-copy-id – Install public key on a remote server
ssh-keyscan – Retrieve public keys from a host

Installation

On Debian-based systems (e.g., Debian, Ubuntu):

 sudo apt update
 sudo apt install openssh-server

Start and enable the SSH service:

 sudo systemctl start ssh
 sudo systemctl enable ssh

To check SSH server status:

 sudo systemctl status ssh

Configuration

The SSH server is configured via:

 /etc/ssh/sshd_config

Common settings include:

`Port 22` – The port sshd listens on. Moving it is not a security control on its own, and every client and firewall rule then has to match the new port.
`PermitRootLogin` – Whether root may log in (`yes`, `prohibit-password` or `no`). With a strong password, `yes` is fine; turning root login off can lock you out if no other admin account works.
`PasswordAuthentication` – Whether password login is allowed. `no` forces key-only login: set it only after every admin has logged in with a key from every place they need.
`AllowUsers` – Restrict login to specific users

After making changes, restart the service:

 sudo systemctl restart ssh

Security Practices

Use a strong, unique password (12 or more random characters), or SSH keys that every admin has tested. A strong password makes brute force impractical: see the brute force math.
Keep OpenSSH and the system patched
Cap log growth so login noise cannot fill the disk (logrotate `maxsize`)
Restrict SSH to known addresses only when it does not need to be reachable from anywhere
Monitor login attempts in `/var/log/auth.log`
fail2ban and a changed port add failure points without real security gain, and key-only login is a tradeoff rather than a must; see Fail2ban

Use Cases

Remote server administration
Secure file transfers (seedboxes, VPS, cloud instances)
Git and code deployments (e.g., via `git@`)
Remote backups and scripting automation
Encrypted tunnels for securing other network services

Related Software

PuTTY – SSH client for Windows
Dropbear SSH – Lightweight SSH alternative for embedded systems