How to Make a Secure SSH Connection

Learning objectives

• Distinguish hostnames, IP addresses, ports, host keys, and user credentials.
• Connect to a Linux server with PuTTY or the OpenSSH command line.
• Evaluate a first-connection host key prompt safely.
• Apply practical safeguards to routine remote access.

Prerequisites

• Explicit authorization to access the target system.
• The correct hostname or IP address, SSH port, and username.
• A supported authentication method: usually a password or private key.

SSH fundamentals

SSH encrypts traffic between a client and an SSH server. It protects commands and output in transit, but it does not decide whether you are authorized to access a machine. The server listens on a TCP port and applies its own authentication and access policies.

A hostname such as host.example.net is translated by DNS into an IP address. An IPv4 address looks like 203.0.113.10; IPv6 uses a longer colon-separated form. A public address may be reachable over the internet, while private addresses such as 10.x.x.x commonly require the correct local network or VPN.

TCP port 22 is the SSH default. A different configured port is not inherently more secure, and it must be specified explicitly in the client.

Authentication methods

With password authentication, the server checks a secret associated with the account. With public-key authentication, the server stores your public key and challenges the client to prove possession of the matching private key. The private key stays on your device.

Some environments require multiple factors or an identity service. Follow the server operator’s documented method. Never upload a private key to the server’s authorized_keys file, email it, or paste it into a support request.

Connect to a Linux server

With Windows OpenSSH

ssh [email protected]
ssh -p 2222 [email protected]
ssh -i "$HOME\.ssh\work_key" [email protected]

The first command uses port 22. The second selects port 2222. The third requests a particular private key. Quote paths containing spaces.

With PuTTY

Enter the hostname and port on the Session panel, select SSH, and open the connection. For a key, browse to the .ppk file under Connection → SSH → Auth → Credentials before saving the session. Labels can vary slightly by PuTTY version.

Understand host keys

A server host key identifies the server, not your user account. On first connection, the client has no saved identity to compare, so it presents a fingerprint. Obtain the expected fingerprint from the administrator through a trusted source and compare the full value and algorithm.

Safe connection practices and mistakes

• Keep the SSH client and operating system updated from their official sources.
• Use a unique password or an encrypted private key with an appropriate passphrase.
• Verify the target before entering credentials, especially after following copied instructions.
• Do not bypass host key checking as a routine fix.
• Do not expose port 22 through a personal router merely to solve an outbound connection problem.
• Use exit to end the remote shell; close abandoned sessions.

If the connection never reaches authentication, distinguish refused from timed out. If authentication begins but fails, check the username and allowed method. The troubleshooting guide maps each symptom to a safe next check.

Continue learning