SSH and Remote Machines

SSH is the remote-access protocol — encrypted, authenticated, everywhere. Beyond ssh user@host is a config file that turns repetitive commands into one-word invocations, and port forwarding that turns remote services into local ones.

Keys over passwords

ssh-keygen -t ed25519 -C "[email protected]"   # modern key type
ssh-copy-id user@host                        # install the public key

~/.ssh/id_ed25519 is the private key (never leaves the machine), id_ed25519.pub is the public key (safe to share). The remote authorized_keys file authorizes you; authorized_keys with 600 permissions, owned by the target user.

~/.ssh/config

Host prod
  HostName 40.160.82.139
  User traven
  IdentityFile ~/.ssh/deploy_key

Host *
  ServerAliveInterval 60
  ServerAliveCountMax 3

Now ssh prod does the whole thing — hostname, user, key file. ServerAliveInterval keeps NATed connections alive.

The forwarding patterns

• Local forward — ssh -L 8080:localhost:80 prod → remote port 80 shows up as localhost:8080 here. For UIs, dashboards, dev servers you can't expose.
• Remote forward — ssh -R 9090:localhost:3000 prod → your local 3000 is exposed on the remote's 9090. For demos from behind NAT.
• SOCKS proxy — ssh -D 1080 prod → all browser traffic routes through the remote machine.

File transfer

• scp — simple copy: scp file.txt prod:~/
• rsync -avz — resumable, incremental, the right tool for directories and deploys.
• sftp — interactive shell for browsing remote files.

Field notes

• ssh-agent caches decrypted keys — eval $(ssh-agent) + ssh-add once per session, then ssh never prompts.
• mosh for unreliable connections — roams networks, survives sleep/wake, local echo. SSH drops, mosh resumes.
• Bastion/jump hosts: ssh -J bastion user@internal — ProxyJump in the config makes multi-hop transparent.