Mastering SSH: Key Authentication, Config Mapping, and Port Forwarding

Secure Shell (SSH) is the backbone of remote server administration. In production environments, raw password authentication is banned because it is highly vulnerable to brute-force dictionary attacks. In this guide, we will implement a robust SSH security configuration, create custom connection mappings, and route isolated services through secure local tunnels.

1. Generating High-Entropy Ed25519 Keys

Elliptic Curve Cryptography (ECC) provides better security and significantly smaller key sizes compared to traditional RSA. The current standard is Ed25519. To generate a secure Ed25519 keypair, run this on your local machine:

ssh-keygen -t ed25519 -a 100 -C "admin@your-domain.com"

Parameters explained:

• -t ed25519: Specifies the key type as Ed25519.
• -a 100: Number of KDF (Key Derivation Function) rounds. Higher numbers slow down passphrase guessing attacks.
• -C "comment": A descriptive label to identify the owner of the public key inside authorization files.

After running this, copy the public key to the remote server:

ssh-copy-id -i ~/.ssh/id_ed25519 user@your-server-ip

This automatically appends the contents of your local public key (id_ed25519.pub) to the remote server's ~/.ssh/authorized_keys file and configures the correct directory permissions (700 for .ssh/ and 600 for authorized_keys).

2. Hardening the Daemon Configuration

The SSH Server daemon configuration controls who can authenticate and how. Log in to your remote server and open the configuration file using a text editor:

sudo nano /etc/ssh/sshd_config

Find and modify the following lines to harden server security boundaries:

# Change default port to reduce automated port scan logs
Port 2222

# Prevent root login directly; administrators should use sudo instead
PermitRootLogin no

# Disable all password-based log-ins (forces key-only auth)
PasswordAuthentication no
PubkeyAuthentication yes

# Disable empty passwords
PermitEmptyPasswords no

# Limit connection authentication attempts per IP session
MaxAuthTries 3

# Turn on TCP KeepAlives to drop orphaned sessions cleanly
TCPKeepAlive yes
ClientAliveInterval 300
ClientAliveCountMax 2

Before restarting the daemon, always verify your configuration for syntax errors:

sudo sshd -t

If no errors are returned, restart the SSH service to apply the updates:

sudo systemctl restart ssh

3. Designing a SSH Config Shortcut Map

Rather than memorizing different IP addresses, usernames, and custom ports for all your staging and production environments, configure aliases inside the local client configuration file at ~/.ssh/config on your local computer:

# Staging Environment
Host staging-node
    HostName 10.0.12.45
    User devadmin
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

# Production Database Server
Host prod-db
    HostName database.yourcompany.com
    User dbops
    Port 4500
    IdentityFile ~/.ssh/id_ed25519

Once saved, connecting is simplified to a single alias: ssh staging-node. The system automatically fetches the target IP, port, login username, and path to your private key.

How to Connect from Different Devices

Depending on your device and environment, use one of the following methods to establish a secure SSH connection to your server:

• PowerShell / Command Prompt (Windows/macOS/Linux):
  Open your host machine terminal and execute the connection command (using your actual server IP and username):

  ssh administrator_user@192.168.1.200

  If you configured a custom port (e.g. 2222) during the hardening process, specify the port using the -p flag:

  ssh administrator_user@192.168.1.200 -p 2222

• Termius App (Android / iOS / Desktop):
  Termius is a premium SSH client for managing connections across mobile devices and computers.
  1. Open the Termius application and navigate to the Hosts screen.
  2. Tap the Add Host (or + button) and select New Host.
  3. In the Address field, enter your server's IP address (e.g. 192.168.1.200).
  4. In the Port field, change the default port from 22 to your target server port (e.g. 2222).
  5. Under the Credentials section, enter your administrator Username and Password (or tap Keys to import your generated id_ed25519 private key file).
  6. Save the profile, then double-tap or select the Host to initialize the secure remote terminal connection.

4. Local Port Forwarding Tunnels

For security, backend applications (like databases or dashboards) are often bound to 127.0.0.1 (localhost) inside the server, making them inaccessible from the outside network. You can securely access these internal services using Local Port Forwarding over your encrypted SSH connection.

For example, if a remote PostgreSQL instance is running on port 5432 internally on the server, you can forward it to your local machine on port 9000 by running:

ssh -L 9000:127.0.0.1:5432 staging-node

While this terminal session remains active, you can point your local database client (e.g. pgAdmin or DBeaver) to localhost:9000. All database queries will be routed securely through the encrypted SSH tunnel directly to the remote database port.

5. Summary Checklist

• Ed25519 Keys: High-entropy keypairs generated instead of weak RSA.
• Password Authentication: Disabled globally in sshd_config to block brute-forcing.
• Root Logins: Disabled; administrators connect via standard accounts and escalate privileges with sudo.
• Aliases: Short names configured in ~/.ssh/config for rapid deployments.
• Tunnels: Port forwarding utilized to secure backend ports from exposure.