How to SSH into Linux: 10 Essential, Secure Tips

SSH means Secure Shell. It creates an encrypted connection between your computer and a remote Linux machine. With SSH you can:

• Run commands on a remote server
• Transfer files securely with SCP or SFTP
• Forward network ports through an encrypted tunnel

Three parts matter:

• SSH client on your computer
• SSH server on the Linux machine
• Encryption that protects everything sent over the network

Remote Linux server

• OpenSSH server installed
• SSH service running
• Firewall or cloud security group allows TCP port 22 or another chosen port
• IP address or DNS hostname available
• A user account on the server

Your computer

• SSH client installed
  • Windows 10 or 11 OpenSSH client or PuTTY
  • macOS Terminal with OpenSSH
  • Linux OpenSSH client
• Network access to the server
• Username and either a password or an SSH key pair

Run these on the server.

OpenSSH is the standard SSH implementation: OpenSSH project.

# Install OpenSSH server

# Debian or Ubuntu
sudo apt update
sudo apt install -y openssh-server

# RHEL, Rocky, AlmaLinux
sudo dnf install -y openssh-server
# (Older RHEL or CentOS may use: sudo yum install -y openssh-server)

# Start and enable the service

# Debian or Ubuntu
sudo systemctl enable --now ssh

# RHEL family
sudo systemctl enable --now sshd

# Verify status
sudo systemctl status ssh     # Debian or Ubuntu
sudo systemctl status sshd    # RHEL family

# Open the firewall

# UFW on Ubuntu
sudo ufw allow OpenSSH
sudo ufw enable        # if UFW is not already enabled
sudo ufw status

# firewalld on RHEL family
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

# Cloud servers: allow the SSH port in the instance security group

Firewall reference: UFW on Ubuntu Server.

# Find the server address
ip a
# or
hostname -I

Quick reference table

Windows 10 and 11 with the built-in OpenSSH client

1. Check the client: Settings → Apps → Optional Features → OpenSSH Client. If missing, add it.
2. Open PowerShell or Command Prompt.
3. Connect

# Replace 203.0.113.10 with your server IP/hostname (e.g., 192.168.1.10)
ssh user@203.0.113.10
# On first connect, type yes to trust the host key.
# Enter the account password when prompted. No characters appear while typing.

# Useful options
# (use -p if your SSH server listens on a non-default port)
ssh -p 2222 user@203.0.113.10   # custom port
ssh -v  user@203.0.113.10       # verbose output for troubleshooting

# Exit
exit

Microsoft reference: Windows OpenSSH docs.

Windows with PuTTY

1. Download and install from the official site.
2. Open PuTTY → Session and set:
   • Host Name: 192.168.1.10 (replace with your server IP or hostname)
   • Port: 22
   • Connection type: SSH
3. Click Open, then accept the first-time security alert.
4. Enter your username, then your password.
5. Type exit to close.

macOS

# Replace 203.0.113.10 with your server IP/hostname (e.g., 192.168.1.10)
ssh user@203.0.113.10
# First time, type yes to trust the host key, then enter the password.
# Exit with:
exit

Linux

# Replace 203.0.113.10 with your server IP/hostname (e.g., 192.168.1.10)
ssh user@203.0.113.10
# Accept the host key and enter the password.
# Exit with:
exit

Password login is simple for first use. SSH keys improve security and convenience.

Generate a key pair on your computer

# Recommended modern key
ssh-keygen -t ed25519 -C "your_label"

# Traditional RSA option
ssh-keygen -t rsa -b 4096 -C "your_label"

# Press Enter to accept the default path ~/.ssh/id_ed25519 or ~/.ssh/id_rsa
# Choose a passphrase for the private key for better security

PuTTY users on Windows: open PuTTYgen, choose Ed25519 or RSA 4096, click Generate, save the private key .ppk, and copy the public key text.

Install your public key on the server

# Automatic method
# Replace 203.0.113.10 with your server IP/hostname (e.g., 192.168.1.10)
ssh-copy-id user@203.0.113.10
# Enter the server password one time. The tool appends your public key to ~/.ssh/authorized_keys

# Manual method

# On your computer
cat ~/.ssh/id_ed25519.pub
# Copy the single line

# On the server
mkdir -p ~/.ssh
chmod 700 ~/.ssh
echo "ssh-ed25519 AAAA... your_label" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Log in with your key

# Replace 203.0.113.10 with your server IP/hostname (e.g., 192.168.1.10)
ssh user@203.0.113.10
# If your key has a passphrase, the client will ask to unlock it.

Use an SSH agent

# macOS and Linux
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

# Windows OpenSSH (PowerShell)
Get-Service ssh-agent
Start-Service ssh-agent
Set-Service -Name ssh-agent -StartupType Automatic
ssh-add $env:USERPROFILE\.ssh\id_ed25519

PuTTY with keys

In PuTTY, go to Connection → SSH → Auth, pick your .ppk private key, return to Session, and connect.

Optional hardening after keys work

# Edit /etc/ssh/sshd_config on the server
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no

# Reload
sudo systemctl reload ssh    # Debian or Ubuntu
sudo systemctl reload sshd   # RHEL family

# SELinux note for non-standard port
sudo semanage port -a -t ssh_port_t -p tcp 2222
sudo systemctl reload sshd
# Install policycoreutils-python-utils if semanage is missing

Shortcuts with ~/.ssh/config on your computer

# Replace HostName with your server IP/hostname (e.g., 192.168.1.10)
Host myserver
  HostName 203.0.113.10
  User user
  Port 22
  IdentityFile ~/.ssh/id_ed25519

# Connect with:
# ssh myserver

Copy files

# SCP upload
scp file.txt user@203.0.113.10:/home/user/

# SCP download
scp user@203.0.113.10:/etc/hosts .

# SFTP interactive session
sftp user@203.0.113.10
# then: put, get, ls, cd, lcd, pwd, exit

Port forwarding

# Local forward example
ssh -L 8080:localhost:80 user@203.0.113.10
# Open http://localhost:8080 on your computer

X11 forwarding for graphical apps

# Client side
ssh -X user@203.0.113.10
# Server and client must both support X11

Cannot reach the server

Connection refused: The service is not listening or the port is wrong.

sudo systemctl status ssh    # Debian or Ubuntu
sudo systemctl status sshd   # RHEL family
# Check the port and use -p if it is not 22

Connection timed out: A firewall or network path is blocking traffic.

# Replace 203.0.113.10 with your server IP/hostname
ping 203.0.113.10
nc -vz 203.0.113.10 22    # or: telnet 203.0.113.10 22
# Open the port in host and cloud firewalls

Authentication problems

Permission denied (password): Wrong username or password, or password login disabled. Confirm the account and settings in /etc/ssh/sshd_config.

Permission denied (publickey): The server cannot use your key. Fix permissions and ensure the correct key.

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
# Replace with your key path and server IP/hostname
ssh -i ~/.ssh/id_ed25519 user@203.0.113.10

Host key warnings

Host key verification failed or remote host identification has changed. Verify that the server really changed. Then clear the cached key and reconnect.

# Replace 203.0.113.10 with your server IP/hostname
ssh-keygen -R 203.0.113.10
# or edit ~/.ssh/known_hosts

Verbose client output

ssh -vvv user@203.0.113.10

Server logs

# Debian or Ubuntu
sudo tail -f /var/log/auth.log

# RHEL family
sudo tail -f /var/log/secure

Client not found

# Debian or Ubuntu
sudo apt install -y openssh-client

# RHEL family
sudo dnf install -y openssh-clients

# Windows: install the OpenSSH Client optional feature or use PuTTY

• Prefer key-based authentication
• Disable root SSH login
• Keep packages updated
• Use fail2ban or similar to block repeated failures
• Protect private keys with a passphrase and use an agent
• Remove unused keys from authorized_keys regularly

# On the server (Debian or Ubuntu)
sudo apt install -y openssh-server
sudo systemctl enable --now ssh
sudo ufw allow OpenSSH

# On the server (RHEL family)
sudo dnf install -y openssh-server
sudo systemctl enable --now sshd
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

# On your computer
ssh-keygen -t ed25519
# Replace 203.0.113.10 with your server IP/hostname (e.g., 192.168.1.10)
ssh-copy-id user@203.0.113.10
ssh user@203.0.113.10

You now know how to SSH into Linux from Windows, macOS, and Linux. You can prepare the server, connect with either a password or keys, transfer files, forward ports, and troubleshoot issues with confidence.