Linux Commands & Shell Skills
ssh: The Connection That Runs Your Infrastructure
ssh is not a convenience, it is the transport every operation on every server rides on, and ~/.ssh/config is a contract with your future self at 3 a.m. Host aliases, IdentityFile entries, ProxyJump targets, and keepalive settings turn remembered flag sentences into one-word commands. Tunnels (-L, -R, -D) and ControlMaster multiplexing are what turn 'a shell' into an infrastructure command surface, and both are config-file work, not memory work.
Key points
- Put everything in ~/.ssh/config: Host aliases with User, IdentityFile, IdentitiesOnly yes, and ProxyJump make 'ssh prod-web1' one word; a flag sentence typed identically five times a day is a missing config entry.
- Keys are the only game: ssh-keygen -t ed25519 -C 'role@team', public half to authorized_keys, and PasswordAuthentication no on the server once rotation is actually proven working.
- Jump hosts collapsed into one flag: ssh -J bastion.corp internal-host, or ProxyJump bastion.corp in the Host block; the old ProxyCommand incantations still work and are no longer anyone's job.
- Tunnels are per-purpose: -L 5432:db.internal:5432 to reach a database, -D 1080 as a SOCKS shim through a strict network, -R to expose a local dev box, each bound to localhost unless you explicitly widen it.
- ControlMaster multiplexing (ControlMaster auto, ControlPath ~/.ssh/cm-%r@%h:%p, ControlPersist 10m) stops re-running handshakes on every open and makes multi-window work on one host instant.
- Keepalives keep sessions through NAT and idle-firewall drops: ServerAliveInterval 60 plus ServerAliveCountMax 3 client-side beats mysterious 'session died at 4 minutes' reports most of the time.
- Constrain dangerous access: -N (no remote command) for pure port forwards, -n for batch jobs reading from stdin, and fail2ban plus sane MaxAuthTries so brute force dies in the logs instead of the accounts.
- Debug order matters: ssh -vvv reveals config parsing, auth negotiation, and channel failures in that order, and a -G host dump answers 'why did it pick that key and that user' without touching a server.
Field note
I once disabled PasswordAuthentication before the new key was actually in authorized_keys and locked my own team out for an evening. The ritual now: second session open, key proven working, and ServerAliveInterval in the config so idle bastion NAT drops stop killing sessions.
Frequently asked questions
In one sentence each: -L, -R, -D?
-L carries a local port forward toward a remote service, -R pushes a remote port back toward your machine (know exactly what you exposed), and -D opens a dynamic SOCKS proxy through the connection.
My session drops after a few idle minutes. Fix?
An idle timeout on a NAT or firewall is the usual cause: set ServerAliveInterval on the client (and keep TCPKeepAlive sane on the server); the same fix belongs in the config you use for basement bastion hops.
ssh-agent or passphrase-less keys?
Agent, always: it holds decrypted keys per session so keys keep passphrases and automation stays non-interactive; ForwardAgent yes on a trusted bastion is fine and ssh-add -l tells you what is loaded before you lie to yourself.
How do I stop retyping tunnel specifications?
LocalForward and RemoteForward lines inside Host blocks: 'ssh dbtunnel' then does the whole thing; one entry per purpose keeps the file readable and lets audits see exactly who forwards what.
How Kinetikatech helps with linux commands & shell skills
Here's the deal: The commands and scripting habits that decide whether an administrator operates a server or fights it: search, transform, transfer, and supervise text and processes with the tools that live in every base install. Hand it to our Linux Server Security and Server Management service and it's covered, assessed properly, implemented cleanly, monitored around the clock.