Free Online Course · Self-paced · Hands-on

OpenSSH Tutorial: Keys, Certificates, Hardening and Remote Access

Free OpenSSH course: SSH keys, certificate authentication with a CA, sshd hardening, port forwarding, and file transfer, tested on RHEL and Ubuntu.

  • 8 chapters
  • 41 lessons
  • ~12h
  • Beginner to Advanced
  • Tested with RHEL 10.2 (Coughlan)
  • Updated Sep 2026
Start the course View syllabus
OpenSSH Tutorial: Keys, Certificates, Hardening and Remote Access
By Last updated

About this course

This is a free, self-paced course covering OpenSSH for real Linux administration: keys, server authentication policy, certificates, hardening, tunnels, session management, and file transfer. The lessons are individual, searchable guides, and this hub is the ordered path through them, tested on RHEL 10 and Ubuntu so both package worlds are covered.

The examples run on two hosts, a server and a client or CA workstation, because that is how the interesting parts of SSH actually work: a certificate authority signing user keys, a KRL revoking one immediately, or a Fail2ban jail banning a brute-force source. Nothing here needs paid software or a cloud account.

Start with SSH key authentication if you still type passwords between hosts. When authorized_keys sprawl gets painful, move to certificates with a user CA. Harden sshd before you expose it to the internet, and keep the troubleshooting chapter bookmarked for the failures that look like the network but are really config.

What you'll learn

  • Set up passwordless SSH with keys and troubleshoot authorized_keys failures
  • Choose key types sensibly and manage them with ssh-agent
  • Configure sshd authentication methods and client ssh_config for daily work
  • Issue OpenSSH user certificates with a CA, principals, expiry, and KRL revocation
  • Harden SSH with Fail2ban, PerSourcePenalties, and user or group restrictions
  • Use forwarding, multiplexing, keepalives, and jump hosts confidently
  • Transfer files with scp, SFTP, SSHFS, rsync, and parallel SSH
  • Debug connection, key, and algorithm failures with verbose logs and strace

Who this course is for

  • System administrators who manage remote access across many Linux hosts
  • DevOps engineers automating SSH in pipelines and jump-host setups
  • Security-minded operators hardening sshd against brute-force attacks
  • Anyone tired of copying passwords and sprawling authorized_keys files

Prerequisites

  • A Linux workstation or VM with OpenSSH client and server packages installed
  • Comfortable on the command line and editing config files with sudo
  • Basic networking — know how to reach a host by IP or hostname

Versions and testing environment

Every command in this course was run on this stack

ComponentVersionNotes
RHEL 10.2 (Coughlan) SSH server and client, openssh 9.9p1
Ubuntu 26.04 LTS CA and admin workstation, OpenSSH 10.2p1
OpenSSH 9.9p1 / 10.2p1 Versions exercised across the server and client labs
Fail2ban 1.1.x Brute-force protection lesson
rsync 3.4.x File-transfer and folder-copy labs

Syllabus

8 chapters · 41 lessons · ~12h of reading

  1. 1 Foundations 6 lessons · ~1h 18m
    1. Part 1 SSH key authentication 14 min read
    2. Part 2 Generate SSH keys with ssh-keygen 9 min read
    3. Part 3 OpenSSH authentication methods in sshd_config 14 min read
    4. Part 4 ssh_config client settings 12 min read
    5. Part 5 Test an SSH connection 14 min read
    6. Part 6 Automate SSH login with a password 15 min read
  2. 2 Certificates and Advanced Auth 4 lessons · ~1h 6m
    1. Part 7 OpenSSH certificate authentication with an SSH CA 22 min read
    2. Part 8 Revoke SSH keys and certificates with a KRL 20 min read
    3. Part 9 Host-based authentication 14 min read
    4. Part 10 Offline two-factor authentication for SSH 10 min read
  3. 3 Hardening and Access Control 5 lessons · ~55 min
    1. Part 11 Prevent brute-force SSH attacks 10 min read
    2. Part 12 Fail2ban for SSH 10 min read
    3. Part 13 OpenSSH PerSourcePenalties 22 min read
    4. Part 14 Restrict SSH users and groups 6 min read
    5. Part 15 Exclude users from Match Group 7 min read
  4. 4 Forwarding, Proxy, and Multiplexing 4 lessons · ~41 min
    1. Part 16 SSH port forwarding 12 min read
    2. Part 17 Remote port forwarding through a firewall 6 min read
    3. Part 18 SSH proxy and jump host patterns 13 min read
    4. Part 19 SSH multiplexing 10 min read
  5. 5 Sessions and Remote Commands 6 lessons · ~1h 3m
    1. Part 20 Keep SSH sessions alive 13 min read
    2. Part 21 Disconnect idle SSH sessions 8 min read
    3. Part 22 Kill a hung SSH session 14 min read
    4. Part 23 List active SSH connections 11 min read
    5. Part 24 Long-running commands over SSH 9 min read
    6. Part 25 Run multiple commands over SSH 8 min read
  6. 6 File Transfer 4 lessons · ~40 min
    1. Part 26 scp command cheat sheet 10 min read
    2. Part 27 Transfer files with SSHFS 16 min read
    3. Part 28 Copy a folder over SSH 7 min read
    4. Part 29 Parallel SSH (pssh) 7 min read
  7. 7 Troubleshooting and Ops 9 lessons · ~1h 25m
    1. Part 30 Fix SSH No route to host 10 min read
    2. Part 31 ssh-rsa algorithm is disabled 11 min read
    3. Part 32 userauth_pubkey ssh-rsa not in PubkeyAcceptedKeyTypes 15 min read
    4. Part 33 Timestamps in sshd debug logs 9 min read
    5. Part 34 Timestamps in ssh -v verbose logs 4 min read
    6. Part 35 Capture ssh and sshd with strace 8 min read
    7. Part 36 Run sshd as a non-root user 12 min read
    8. Part 37 Enable SSH in rescue mode 4 min read
    9. Part 38 SSH into a VirtualBox VM 12 min read
  8. 8 Reference / Cheat Sheets 3 lessons · ~31 min
    1. Part 39 ssh command cheat sheet 12 min read
    2. Part 40 Generate SSH keys 9 min read
    3. Part 41 scp command cheat sheet 10 min read

Hands-on labs

6 guided builds you run yourself

  1. Set up passwordless key authentication

    Generate a key pair, install the public key on a second VM, and log in without a password.

  2. Issue user certificates from an SSH CA

    Stand up a certificate authority, sign a user key with principals and expiry, and trust the CA on the server.

  3. Revoke a certificate with a KRL

    Build a key revocation list, point sshd at it, and confirm a revoked certificate can no longer log in.

  4. Ban brute-force sources with Fail2ban

    Enable the sshd jail, trigger a ban with failed logins, then tune ignoreip and unban an address.

  5. Build local, remote, and dynamic tunnels

    Forward a port each way and run a SOCKS proxy, then background and close the tunnels safely.

  6. Reuse one connection with multiplexing

    Configure a control socket so extra sessions and file copies skip the handshake.

Where to go after this course

  • ssh command cheat sheetQuick syntax reference for the options you use most.
  • OpenSSL courseThe TLS and PKI companion once you are comfortable with SSH keys and certificates.
  • RHCSA courseBroader RHEL administration if SSH is one piece of a larger sysadmin path.

Frequently Asked Questions

What is the difference between SSH keys and SSH certificates?

With plain public-key authentication, every server stores each user's public key in authorized_keys, so adding or removing access means editing files on every host. An SSH certificate is a public key signed by a certificate authority, carrying principals, a validity window, and a serial number. Servers only need to trust the one CA key, so you issue short-lived credentials and revoke them centrally instead of chasing keys across machines.

Should I use an Ed25519 or RSA key?

Use Ed25519 for new keys: they are small, fast, and secure by default. Keep RSA (2048-bit or larger) only when you have to reach an old server or device that does not support Ed25519. Avoid DSA entirely; OpenSSH has removed it. You can generate either type with ssh-keygen, and the key authentication lesson shows the workflow.

How do I stop SSH brute-force attacks?

Start by disabling password authentication and using keys or certificates, which removes the target of most guessing. Layer Fail2ban to ban repeat offenders, and note that modern OpenSSH also ships PerSourcePenalties, which penalises misbehaving source addresses and has been on by default since OpenSSH 9.8. Restricting which users and groups may log in narrows the surface further.

Is OpenSSH the same as PuTTY?

No. OpenSSH is the SSH client and server built into Linux, macOS, and modern Windows. PuTTY is a separate Windows client with its own .ppk key format and the Pageant agent. You can convert between formats, and recent PuTTY understands OpenSSH certificates, but the commands and config files in this course are OpenSSH's, so run them from a terminal rather than PuTTY's dialogs.

Does OpenSSH run on Windows, and how do I check my version?

Yes. The OpenSSH client ships with Windows 10, 11, and Windows Server, and the server is an optional feature, so ssh and ssh-keygen work from PowerShell. Run ssh -V on any platform to see your build. Distributions ship older releases than upstream: these labs use OpenSSH 9.9p1 on RHEL 10 and 10.2p1 on Ubuntu, while the current upstream release is 10.5.

Deepak Prasad

R&D Engineer

Founder of GoLinuxCloud with 15+ years of expertise in Linux, Python, Go, Laravel, DevOps, Kubernetes, Git, Shell scripting, OpenShift, AWS, Networking, and Security. With extensive experience, he excels across development, DevOps, networking, and security, delivering robust and efficient solutions for diverse projects.

Expertise
  • Go (programming language)
  • Python (programming language)
  • DevOps
  • Computer Security
  • Cloud Computing
  • Kubernetes
  • Linux
  • Ansible (software)