SSH Configuration and Port Forwarding

reddit [#143] Created with Sketch.
Venkat Vaddineni
Venkat Vaddineni
1 min read

SSH Configuration and Port Forwarding: Your Gateway to Secure Remote Access

As a DevOps engineer, SSH (Secure Shell) is your daily companion. Whether you’re managing cloud servers, deploying applications, or troubleshooting production issues, SSH provides the secure foundation for all your remote operations. Today, we’ll embark on a journey from basic SSH concepts to advanced port forwarding techniques that will transform how you handle remote access and tunneling.

Chapter 1: Understanding SSH - The Foundation of Secure Remote Access

SSH operates on a simple yet powerful principle: it creates an encrypted tunnel between your local machine and a remote server. Think of it as a secure telephone line where only you and the remote server can understand the conversation, even if someone intercepts the communication.

Why SSH Matters in DevOps

In the DevOps world, you’re constantly juggling multiple servers, databases, and services. SSH enables you to:

  • Securely access remote servers without exposing passwords over the network
  • Create encrypted tunnels for database connections
  • Forward local ports to access services running on remote machines
  • Execute commands on multiple servers simultaneously
  • Transfer files securely between systems

Let’s start with the basics and work our way up to advanced configurations.

Chapter 2: Basic SSH Connection - Your First Steps

Making Your First Connection

The simplest SSH command looks like this:

ssh username@server-ip-address

For example, if you want to connect to a server with IP 192.168.1.100 as user “ubuntu”:

ssh ubuntu@192.168.1.100

When you run this command, several things happen behind the scenes:

  1. SSH initiates a connection on port 22 (the default SSH port)
  2. The server presents its host key for verification
  3. You’re prompted to authenticate (usually with a password)
  4. An encrypted session is established

Understanding Host Key Verification

The first time you connect to a server, you’ll see something like:

The authenticity of host '192.168.1.100 (192.168.1.100)' can't be established.
ECDSA key fingerprint is SHA256:abc123def456...
Are you sure you want to continue connecting (yes/no/[fingerprint])?

This is SSH’s way of ensuring you’re connecting to the right server. In production environments, always verify this fingerprint with your system administrator before typing “yes.”

Chapter 3: SSH Key Authentication - Eliminating Password Hassles

Password authentication works, but it’s not ideal for DevOps workflows. SSH keys provide a more secure and convenient alternative. Think of SSH keys as a sophisticated lock-and-key system where you hold the private key, and the server has your public key.

Generating Your SSH Key Pair

Let’s create your first SSH key pair:

ssh-keygen -t rsa -b 4096 -C "your-email@example.com"

Here’s what each parameter means:

  • -t rsa: Specifies the RSA algorithm (you can also use ed25519 for newer systems)
  • -b 4096: Sets the key size to 4096 bits (more secure than the default 2048)
  • -C "your-email@example.com": Adds a comment to identify the key

When prompted for a file location, press Enter to use the default (~/.ssh/id_rsa). You can set a passphrase for extra security, though many DevOps workflows use keys without passphrases for automation purposes.

This command creates two files:

  • ~/.ssh/id_rsa: Your private key (keep this secret!)
  • ~/.ssh/id_rsa.pub: Your public key (safe to share)

Copying Your Public Key to the Server

Now we need to install your public key on the remote server:

ssh-copy-id username@server-ip-address

This command automatically copies your public key to the server’s ~/.ssh/authorized_keys file. If ssh-copy-id isn’t available, you can do it manually:

cat ~/.ssh/id_rsa.pub | ssh username@server-ip "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

After this setup, you can connect without entering a password:

ssh username@server-ip-address

Chapter 4: SSH Configuration Files - Making Life Easier

Typing full connection details every time becomes tedious quickly. SSH configuration files solve this problem elegantly. The SSH client reads configuration from two main locations:

  1. System-wide config: /etc/ssh/ssh_config
  2. User-specific config: ~/.ssh/config

Creating Your Personal SSH Config

Let’s create a personal SSH configuration file:

touch ~/.ssh/config
chmod 600 ~/.ssh/config

Now edit this file with your favorite text editor:

nano ~/.ssh/config

Here’s a comprehensive example configuration:

# Production web server
Host web-prod
    HostName 10.0.1.50
    User ubuntu
    Port 22
    IdentityFile ~/.ssh/id_rsa
    ForwardAgent yes
    ServerAliveInterval 60
    ServerAliveCountMax 3

# Development database server
Host db-dev
    HostName dev-db.company.com
    User admin
    Port 2222
    IdentityFile ~/.ssh/dev_key
    LocalForward 3306 localhost:3306

# Staging environment with jump host
Host staging-app
    HostName 172.16.1.100
    User deploy
    ProxyJump bastion-host
    IdentityFile ~/.ssh/staging_key

# Bastion/Jump host
Host bastion-host
    HostName bastion.company.com
    User jumpuser
    Port 22
    IdentityFile ~/.ssh/bastion_key

Understanding Configuration Options

Let’s break down the important configuration options:

  • Host: The alias you’ll use to connect
  • HostName: The actual server address (IP or domain)
  • User: The username to log in as
  • Port: SSH port (default is 22)
  • IdentityFile: Path to your private key
  • ForwardAgent: Allows your SSH keys to be used on the remote server
  • ServerAliveInterval: Sends keep-alive messages every 60 seconds
  • ServerAliveCountMax: Maximum number of keep-alive messages before disconnecting
  • LocalForward: Creates a local port forward (we’ll cover this in detail)
  • ProxyJump: Uses another host as a jump server

With this configuration, you can now connect simply by using:

ssh web-prod
ssh db-dev
ssh staging-app

Chapter 5: Port Forwarding - The Magic of SSH Tunnels

Port forwarding is where SSH truly shines for DevOps work. It allows you to create secure tunnels to access services that aren’t directly reachable from your local machine. Think of it as creating a private, encrypted highway between your computer and remote services.

Local Port Forwarding - Bringing Remote Services to Your Local Machine

Local port forwarding forwards a local port to a remote service. This is incredibly useful for accessing databases, web interfaces, or APIs running on remote servers.

Basic Local Port Forwarding

ssh -L local_port:remote_host:remote_port username@ssh_server

Real-world example: Accessing a MySQL database running on a remote server:

ssh -L 3306:localhost:3306 ubuntu@database-server.com

This command:

  1. Creates a tunnel from your local port 3306
  2. Routes traffic through the SSH connection to database-server.com
  3. Forwards it to port 3306 on the database server

Now you can connect to the database as if it were running locally:

mysql -h localhost -P 3306 -u dbuser -p

Advanced Local Port Forwarding Scenarios

Accessing a web application through a bastion host:

ssh -L 8080:internal-app.local:80 user@bastion-host.com

After establishing this tunnel, you can access the internal web application by browsing to http://localhost:8080.

Multiple port forwards in one connection:

ssh -L 3306:db1.internal:3306 -L 5432:db2.internal:5432 user@jump-server.com

This creates tunnels for both MySQL (port 3306) and PostgreSQL (port 5432) databases.

Remote Port Forwarding - Exposing Your Local Services

Remote port forwarding works in reverse - it makes a local service accessible from the remote server. This is useful for demonstrating local applications to remote colleagues or exposing development services.

Basic Remote Port Forwarding

ssh -R remote_port:local_host:local_port username@ssh_server

Example: Making your local web development server accessible from a remote server:

ssh -R 8080:localhost:3000 user@remote-server.com

This forwards port 8080 on the remote server to port 3000 on your local machine. Anyone accessing remote-server.com:8080 will see your local application running on port 3000.

Dynamic Port Forwarding - Creating a SOCKS Proxy

Dynamic port forwarding creates a SOCKS proxy, allowing you to route any application’s traffic through the SSH tunnel. This is particularly useful for accessing multiple services on a remote network.

ssh -D 1080 user@proxy-server.com

This creates a SOCKS proxy on local port 1080. You can then configure applications to use localhost:1080 as their SOCKS proxy.

Practical use case: Browsing internal company websites while working remotely. Configure your browser to use the SOCKS proxy, and all web traffic will route through your company’s network.

Chapter 6: Advanced SSH Configurations for DevOps Workflows

SSH Agent - Managing Multiple Keys Efficiently

When working with multiple servers and different SSH keys, SSH Agent becomes invaluable. It stores your decrypted private keys in memory, so you don’t need to enter passphrases repeatedly.

Starting SSH Agent (usually starts automatically on most Linux distributions):

eval "$(ssh-agent -s)"

Adding keys to the agent:

ssh-add ~/.ssh/id_rsa
ssh-add ~/.ssh/dev_key
ssh-add ~/.ssh/prod_key

Listing loaded keys:

ssh-add -l

SSH Agent Forwarding - Using Keys on Remote Servers

Agent forwarding allows you to use your local SSH keys on remote servers, which is crucial for deployment workflows where you need to access git repositories from deployment servers.

Enable agent forwarding in your SSH config:

Host deployment-server
    HostName deploy.company.com
    User deploy
    ForwardAgent yes

Or use the command line flag:

ssh -A user@server.com

Security note: Only enable agent forwarding for trusted servers, as it allows the remote server to use your SSH keys.

Jump Hosts and ProxyJump - Navigating Complex Network Topologies

In enterprise environments, you often need to go through bastion hosts or jump servers to reach internal resources. The ProxyJump directive makes this seamless:

Host internal-server
    HostName 10.0.1.100
    User app-user
    ProxyJump bastion-host

Host bastion-host
    HostName bastion.company.com
    User jump-user

Now ssh internal-server automatically routes through the bastion host.

For multiple hops:

Host final-destination
    HostName 192.168.100.50
    User final-user
    ProxyJump bastion1,bastion2

Chapter 7: SSH Security Best Practices for Production Environments

Server-Side SSH Hardening

Edit the SSH daemon configuration (/etc/ssh/sshd_config) with these security improvements:

# Change default port (security through obscurity)
Port 2222

# Disable root login
PermitRootLogin no

# Disable password authentication (keys only)
PasswordAuthentication no
PubkeyAuthentication yes

# Limit login attempts
MaxAuthTries 3
MaxStartups 10:30:100

# Set idle timeout
ClientAliveInterval 300
ClientAliveCountMax 2

# Restrict users
AllowUsers username1 username2

After making changes, restart SSH:

sudo systemctl restart sshd

Client-Side Security Measures

Configure your client for maximum security in ~/.ssh/config:

Host *
    Protocol 2
    Compression yes
    ServerAliveInterval 60
    ServerAliveCountMax 3
    VerifyHostKeyDNS yes
    ForwardAgent no
    ForwardX11 no
    HashKnownHosts yes

Key Management Best Practices

  1. Use different keys for different purposes:

    • Personal servers: ~/.ssh/id_personal
    • Work servers: ~/.ssh/id_work
    • CI/CD systems: ~/.ssh/id_cicd

  2. Regular key rotation:

    # Generate new key
ssh-keygen -t ed25519 -f ~/.ssh/id_new

# Deploy new key
ssh-copy-id -i ~/.ssh/id_new.pub user@server

# Test new key
ssh -i ~/.ssh/id_new user@server

# Remove old key from server's authorized_keys

  3. Use key passphrases for highly sensitive environments.

Chapter 8: Automating SSH in DevOps Workflows

SSH in Shell Scripts

Create reusable SSH functions in your deployment scripts:

#!/bin/bash

# Function to execute commands on remote server
remote_execute() {
    local server=$1
    local command=$2
    ssh "$server" "$command"
}

# Function to deploy files
deploy_files() {
    local server=$1
    local local_path=$2
    local remote_path=$3
    scp -r "$local_path" "$server:$remote_path"
}

# Usage
remote_execute "web-prod" "sudo systemctl restart nginx"
deploy_files "web-prod" "./dist/*" "/var/www/html/"

SSH with Configuration Management

Integrate SSH configurations with tools like Ansible:

# ansible.cfg
[defaults]
host_key_checking = False
pipelining = True

[ssh_connection]
ssh_args = -o ForwardAgent=yes -o ControlMaster=auto -o ControlPersist=60s

Persistent SSH Connections

For frequent connections to the same servers, use SSH multiplexing:

Host *
    ControlMaster auto
    ControlPath ~/.ssh/master-%r@%h:%p
    ControlPersist 600

This maintains a master connection that subsequent SSH commands can reuse, significantly speeding up operations.

Chapter 9: Troubleshooting Common SSH Issues

Connection Troubleshooting

Verbose mode for debugging:

ssh -v username@server  # Basic verbose
ssh -vv username@server # More verbose
ssh -vvv username@server # Maximum verbosity

Common issues and solutions:

  1. Permission denied (publickey):

    • Check key permissions: chmod 600 ~/.ssh/id_rsa
    • Verify public key on server: cat ~/.ssh/authorized_keys
    • Ensure SSH agent has the key: ssh-add -l

  2. Connection timeout:

    • Check firewall rules
    • Verify SSH service is running: sudo systemctl status sshd
    • Test with telnet: telnet server-ip 22

  3. Host key verification failed:

    • Remove old key: ssh-keygen -R hostname
    • Get new fingerprint from server administrator

Port Forwarding Troubleshooting

Test port forwarding:

# Test if local port is listening
netstat -ln | grep :3306

# Test connection through tunnel
telnet localhost 3306

Common port forwarding issues:

  • Port already in use: Choose a different local port
  • Firewall blocking connections: Check iptables/firewall rules
  • Service not running on remote host: Verify service status

Chapter 10: Advanced SSH Techniques for DevOps Mastery

SSH Escape Sequences

While in an SSH session, you can use escape sequences (start with ~):

  • ~.: Disconnect
  • ~^Z: Background SSH session
  • ~#: List forwarded connections
  • ~?: Help

SSH with Different Network Interfaces

Bind SSH to specific network interfaces:

ssh -b 192.168.1.100 user@server  # Use specific local IP

SSH Session Recording

For compliance and auditing, record SSH sessions:

script -f /tmp/ssh-session.log
ssh user@server
# ... your session ...
exit  # Exit script

SSH-based File Synchronization

Use SSH for efficient file synchronization:

# Rsync over SSH
rsync -avz -e ssh ./local-dir/ user@server:/remote-dir/

# SSHFS for mounting remote directories
sshfs user@server:/remote/path /local/mount/point

Conclusion: Mastering SSH for DevOps Excellence

SSH is far more than just a remote access tool - it’s the backbone of secure DevOps operations. From basic connections to complex port forwarding scenarios, from secure key management to automation integration, SSH provides the foundation for modern infrastructure management.

The techniques we’ve covered will serve you well in various scenarios:

  • Development: Quick access to development servers and databases
  • Staging: Secure tunnels through corporate firewalls
  • Production: Hardened, key-based authentication with proper logging
  • Automation: Scripted deployments and configuration management

Remember these key principles:

  1. Always use SSH keys instead of passwords in production
  2. Implement proper security hardening on both client and server
  3. Use SSH configurations to simplify and standardize access
  4. Leverage port forwarding for secure access to internal services
  5. Regular key rotation and proper key management are essential

As you continue your DevOps journey, SSH will remain your trusted companion, enabling secure, efficient, and scalable remote operations. The investment in mastering these techniques will pay dividends in your daily workflow and overall system security.

Keep practicing, stay security-conscious, and remember: in the world of DevOps, SSH isn’t just a tool - it’s your gateway to infrastructure mastery.