Debian tutorials

Learn how to check whether SSH is using protocol 1 or 2, what OpenSSH version strings such as OpenSSH_7.4p1 mean, and how to read SSH-2.0 banners and verbose SSH output.

Automate password-based SSH and SCP in Linux using sshpass, Expect, and SSH_ASKPASS, with safer password input, host-key handling, and key-based alternatives.

Mount a remote Linux directory over SSH with SSHFS on RHEL, Ubuntu, and Windows. Covers install, user mounts, permissions, fstab, jump hosts, SSHFS-Win UNC paths, and troubleshooting.

Configure OpenSSH host-based authentication on Linux with HostbasedAuthentication, ssh-keysign, shosts.equiv, and verified host keys—plus hostname/DNS checks and safer alternatives.

Test SSH connectivity in Linux step by step: check port 22, verify that sshd responds, test authentication, inspect server-side sshd status, and troubleshoot common SSH errors.

Connect to private Linux servers through an SSH jump or bastion host using ProxyJump, ssh -J, ProxyCommand, and scp -J, with multi-hop routes and troubleshooting examples.

SSH from your host into a Linux VirtualBox VM using NAT port forwarding (recommended), host-only networking, or a bridged adapter — with a mode decision table, guest SSH checks, and troubleshooting for 10.0.2.15 and VPN …

Use OpenSSH host certificates so clients trust one host CA through @cert-authority in known_hosts instead of enrolling every server host key — create a host CA, sign with ssh-keygen -h, configure HostCertificate on sshd, …

Sign files with ssh-keygen -Y sign, verify them with an allowed_signers file, signer identity, namespace, and stdin — no sshd or GPG required on OpenSSH 8.2 and later.

Fix SSH no matching key exchange method found by reading Their offer:, enabling the required KEX algorithm safely, and resolving follow-on host-key or cipher errors.

Fix SSH "Bad server host key: Invalid key length" caused by 1024-bit RSA host keys, RequiredRSASize, RHEL crypto policies, or stale known_hosts entries.

Fix userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedKeyTypes by using rsa-sha2 with the same RSA key, or Ed25519, before any legacy ssh-rsa exception.

Create and update an OpenSSH Key Revocation List (KRL), revoke SSH certificates by serial, Key ID, or fingerprint, revoke plain public keys, and make sshd enforce RevokedKeys.

Set up OpenSSH user certificate authentication with an SSH CA: create TrustedUserCAKeys, sign keys with principals and expiry, verify login, revoke with a KRL, then map principals with AuthorizedPrincipalsFile.

Configure OpenSSH authentication in sshd_config: password, public key, keyboard-interactive, host-based, GSSAPI, AuthenticationMethods, and Match blocks on Linux.

OpenSSH PerSourcePenalties on Linux: how sshd temporarily refuses noisy source addresses, how to read defaults with sshd -T, how to fix Not allowed at this time, and how exemptions and MaxAuthTries differ from Fail2ban.

Install a private CA certificate into the Linux system trust store with update-ca-certificates on Debian and Ubuntu or update-ca-trust on RHEL and Fedora, verify the anchor landed, remove it again, and fix the …

Install Podman on Debian 12 Bookworm and Debian 13 Trixie with apt, compare 4.3.x and 5.4.x package branches, verify with podman info, test rootless mode, and run a hello container.

Read LeakSanitizer and Valgrind reports down to the line that owns the memory, use the flags that add detail, attribute growth with Massif, and query a running process with vgdb so you fix the cause instead of only …

Diagnose libc.so.6 errors by message type — GLIBC_2.xx not found, cannot open shared object file, wrong ELF class, or damaged system libc — then fix with the matching glibc package, multilib, rebuild, container, or …

Install Fail2ban, enable the sshd jail with sane bantime and ignoreip values, verify bans after failed SSH logins on RHEL and Debian, and unban trusted client addresses when needed.

Fix Vim E325 Found a swap file by the name by reading the .swp prompt, recovering after a crash, or removing a stale swap file once no editor owns it — not Linux swap memory from mkswap.

Diagnose SSH no route to host with TCP port tests, ip route get, remote firewalld and sshd checks, and learn when the message means a firewall REJECT instead of a missing route.

Set ClientAliveInterval and ClientAliveCountMax on sshd to drop unresponsive SSH clients, use ServerAliveInterval on the OpenSSH client to keep sessions alive through NAT, and understand how TCPKeepAlive differs.

Install rkhunter from EPEL or apt, update its signature database, baseline file properties with propupd, run a non-interactive check, and interpret warnings in rkhunter.log on RHEL and Debian-family hosts.

Create a custom systemd .service unit under /etc/systemd/system/, explain Unit Service and Install sections, start and enable it with systemctl, and verify with status and journalctl.

Take GNU tar listed-incremental backups with a snapshot file, create level 0 and level 1 archives, inspect Y and N file status, and restore by applying the full backup then each incremental in order.

Reuse one authenticated SSH connection for later ssh, scp, and sftp sessions with ControlMaster, ControlPath, and ControlPersist on the OpenSSH client.

Copy a directory and its contents between Linux hosts with scp -r and rsync -av over SSH, verify the remote layout, and avoid common path mistakes with trailing slashes.

Restrict SFTP users to a chroot directory with OpenSSH ChrootDirectory, ForceCommand internal-sftp, Match blocks in sshd_config, writable upload folders, and SSH public-key authentication.