Tech Setup
Linux

Ubuntu SSH Setup: Secure Remote Access in 10 Minutes

Tech Setup1 min read
TS

Tech Setup

Published July 31, 2026 · Editorial policy

Ubuntu SSH Setup: Secure Remote Access in 10 Minutes

Installing SSH Server

sudo apt update
sudo apt install openssh-server -y

Verify It's Running

sudo systemctl status ssh
sudo systemctl enable ssh

Connect from Another Machine

# Basic connection
ssh user@server-ip

# Example
ssh ubuntu@192.168.1.100

Find your server's IP:

ip addr show | grep "inet " | grep -v 127.0.0.1

Generate Key Pair (on your local machine)

ssh-keygen -t ed25519 -C "your@email.com"
# Press Enter for defaults
# Set a passphrase (recommended)

This creates:

  • ~/.ssh/id_ed25519 (private key — never share)
  • ~/.ssh/id_ed25519.pub (public key — goes on server)

Copy Public Key to Server

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server-ip

Or manually:

# On server
mkdir -p ~/.ssh
echo "your-public-key-content" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Test Key Auth

ssh user@server-ip
# Should connect without password (or with key passphrase only)

Harden SSH Configuration

Edit the SSH server config:

sudo nano /etc/ssh/sshd_config

Essential Changes

# Change default port (optional, reduces bot scans)
Port 2222

# Disable root login
PermitRootLogin no

# Disable password authentication (keys only)
PasswordAuthentication no

# Disable empty passwords
PermitEmptyPasswords no

# Limit authentication attempts
MaxAuthTries 3

# Use only SSH protocol 2
Protocol 2

# Disable X11 forwarding (unless needed)
X11Forwarding no

# Set idle timeout (seconds)
ClientAliveInterval 300
ClientAliveCountMax 2

# Allow specific users only
AllowUsers ubuntu deploy

# Disable agent forwarding (unless needed)
AllowAgentForwarding no

Apply Changes

sudo sshd -t           # Test config syntax
sudo systemctl restart ssh

IMPORTANT: Before restarting, keep your current SSH session open. Test a new connection in a separate terminal to verify you can still connect.

UFW Firewall Rules

# Allow SSH (adjust port if changed)
sudo ufw allow 2222/tcp
# Or allow from specific IP only
sudo ufw allow from 203.0.113.50 to any port 2222

# Enable firewall
sudo ufw enable
sudo ufw status verbose

SSH Config File (Client Side)

Create ~/.ssh/config on your local machine:

Host myserver
    HostName 192.168.1.100
    User ubuntu
    Port 2222
    IdentityFile ~/.ssh/id_ed25519
    ServerAliveInterval 60

Now connect with just:

ssh myserver

SSH Tunnels (Port Forwarding)

Local Forward Access Remote Service Locally

# Access remote PostgreSQL locally
ssh -L 5432:localhost:5432 user@server

# Now connect to localhost:5432 to reach remote DB
psql -h localhost -p 5432

Remote Forward Expose Local Service

# Expose local dev server (port 3000) on remote (port 8080)
ssh -R 8080:localhost:3000 user@server

Dynamic Forward (SOCKS Proxy)

ssh -D 1080 user@server
# Configure browser to use SOCKS5 proxy at localhost:1080

SCP / File Transfer

# Upload file
scp ./file.txt user@server:/home/ubuntu/

# Download file
scp user@server:/var/log/syslog ./

# Upload directory (recursive)
scp -r ./project/ user@server:/home/ubuntu/project/

# Using config alias
scp ./file.txt myserver:/home/ubuntu/

rsync (Better for Directories)

# Sync directory to server
rsync -avz ./project/ myserver:/home/ubuntu/project/

# Exclude patterns
rsync -avz --exclude 'node_modules' --exclude '.git' ./project/ myserver:/home/ubuntu/project/

# Dry run first
rsync -avzn ./project/ myserver:/home/ubuntu/project/

Troubleshooting

Permission Denied (publickey)

# On server, check permissions
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

# Check SSH logs
sudo journalctl -u ssh -f

Connection Refused

# Check if SSH is running
sudo systemctl status ssh

# Check if firewall is blocking
sudo ufw status

# Check if port is listening
sudo ss -tlnp | grep ssh

Slow Connection

Add to /etc/ssh/sshd_config:

UseDNS no
GSSAPIAuthentication no

SSH Key Management

List Keys

ls -la ~/.ssh/

Remove Old Keys from Server

# Edit authorized_keys and remove the line
nano ~/.ssh/authorized_keys

Rotate Keys

  1. Generate new key pair
  2. Copy new key to server
  3. Test new key works
  4. Remove old key from server
  5. Delete old private key

Related articles