SSH keys provide secure, password-less authentication to remote systems. Choosing the right algorithm matters for security, compatibility, and operational stability. Generate an Ed25519 Key Pair Ed25519 is the modern standard for SSH key generation. It offers stronger security properties than RSA, faster operations, and smaller key sizes. ssh-keygen -t ed25519 -C “your_email@example.com” You’ll be prompted…
If you’ve tried ssh root@my-server and got a “Permission denied” error, it’s not a bug—it’s a security feature. This behavior is standard across all modern distributions. Why Root SSH Login is Disabled By default, the PermitRootLogin directive in /etc/ssh/sshd_config is set to prohibit-password or no. This prevents direct root access over SSH regardless of whether…
Password-less SSH login is faster, more secure, and essential for automation. Combining it with remote command execution lets you run tasks on servers from your local machine without interactive authentication. Setting Up SSH Key-Based Authentication Generate SSH Keys First, generate an ED25519 key pair on your local machine (A): ssh-keygen -t ed25519 -C “user@hostname” -f…
The command journalctl -b -1 should show the previous boot’s journal, but on many systems it returns: Failed to look up boot -1: No such boot ID in journal This happens because persistent journal storage isn’t enabled by default. Without it, journald only keeps logs in volatile memory (/run/log/journal), which gets cleared on shutdown. Enable…
[md] By default, Fedora doesn’t enable SSH access. You’ll need to install OpenSSH server, start the service, and configure your firewall to allow connections. ## Install OpenSSH Server sudo dnf install openssh-server openssh-clients The openssh-clients package provides the ssh command for connecting to other machines, while openssh-server allows incoming connections. ## Start and Enable the…
SSH performs reverse DNS lookups on connecting clients by default. If your DNS infrastructure is slow or misconfigured, this can add several seconds to every login attempt. Disabling this lookup is a straightforward performance optimization, especially in cloud environments where internal IPs often lack valid PTR records. Disable the UseDNS Setting Edit /etc/ssh/sshd_config: sudo nano…
iptables remains the standard firewall configuration tool on Linux systems, though many distributions now layer it with ufw or firewalld. Understanding the basics helps you troubleshoot, migrate, or work on systems without those abstractions. Understanding iptables Fundamentals iptables operates on three main chains: INPUT: rules for incoming traffic FORWARD: rules for traffic passing through the…
Rate-limiting SSH brute-force attempts is essential for any server exposed to the internet. Using iptables with the recent module, you can drop connections from IPs that exceed a threshold in a given time window—for example, blocking IPs that attempt more than 6 connections in 60 seconds. Using iptables The recent module tracks connection attempts by…
When managing a Linux system remotely, you sometimes need to terminate all sessions for a specific user—whether they’re logged in locally at the console, via SSH, through X11 forwarding, VNC, or any other method. Here’s how to do it. Quick Answer To terminate all processes for a user named bob: killall -u bob This kills…
X11 forwarding lets you run Chrome on a remote host and display it on your local machine. It’s quick to set up for occasional use, but for regular work or modern Linux systems, you’ll want to know when to use alternatives. Basic X11 Forwarding The simplest approach uses SSH’s X11 forwarding: ssh -X username@remote_host google-chrome…
SSH is fast enough for most tasks, but when you’re transferring large files, running multiple commands, or managing hundreds of servers, every millisecond counts. Here’s how to squeeze real performance gains from SSH and SCP on Linux. Choose the Right Cipher Cipher selection has the biggest impact on throughput. Modern CPUs have AES-NI hardware acceleration,…
When standard reboot commands fail to work, the Magic SysRq key provides a kernel-level mechanism to force a reboot or shutdown. This works even when the system is mostly unresponsive. Prerequisites Magic SysRq must be enabled at runtime or in the kernel configuration. Most modern distributions enable it by default, but you can verify and…
To disable all active swap spaces on Linux, run: swapoff -a The -a flag targets all currently enabled swap devices and files. This forces the kernel and applications to rely entirely on physical RAM. When You’d Do This Disabling swap is useful for: Performance testing: Eliminating swap I/O variance to get consistent benchmarks Latency-sensitive workloads:…
When passwordless SSH authentication fails despite proper key setup, start by checking the SSH daemon logs to identify the actual problem. Checking SSH Logs The SSH daemon logs are your primary diagnostic tool: sudo tail -f /var/log/auth.log # Debian/Ubuntu sudo tail -f /var/log/secure # RHEL/CentOS/Fedora sudo journalctl -u ssh -f # systemd-based systems Watch the…
When you try to unmount a filesystem with umount, Linux may report “device is busy.” This is a safety mechanism — the kernel blocks unmounting when processes or kernel threads are actively accessing the partition or holding open files on it. Forcing an unmount without understanding what’s using the filesystem risks data corruption and data…
SSH connections dropping during idle periods is a persistent issue in production environments. Both client and server configurations provide built-in keep-alive mechanisms designed specifically for this problem. Stop running while true; do uptime; sleep 30; done — there are proper solutions. Client-side configuration Per-user SSH config Add to ~/.ssh/config: Host * ServerAliveInterval 60 ServerAliveCountMax 3…
When SSH fails but the daemon still runs, or when kernel panics strike, you need automated recovery without physical access. This guide covers three essential techniques: forcing reboots when the system is unresponsive, auto-recovery from kernel panics, and alerting you when it happens. Force a reboot when SSH is unresponsive If a server stops responding…
You’ve got internal hosts on RFC 1918 addresses (10.0.3.0/24, 172.16.0.0/12, etc.) behind a gateway, and you need SSH access to them from your workstation. Traditional solutions involve iptables port forwarding, non-standard ports, and a maintenance nightmare. ProxyCommand offers a cleaner approach: direct SSH connections to internal IPs that actually work. How ProxyCommand Works SSH’s ProxyCommand…
SSH performance is constrained by cipher choice, especially for large file transfers over high-bandwidth links where CPU becomes the bottleneck. Selecting the right cipher, key exchange algorithm, and compression settings can yield substantial throughput improvements. Current Cipher Landscape Modern OpenSSH (7.4+) has deprecated or removed weak ciphers. Here’s what’s viable today: Secure and performant: chacha20-poly1305@openssh.com…
SSH port forwarding lets you tunnel network traffic through an encrypted connection, making it essential for accessing services on restricted networks, exposing local services safely, or routing traffic through a jump host. This guide covers the three main types and production-ready practices. Local Forwarding Local forwarding listens on your local machine and relays connections through…