> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/connect-to-machines/ssh.md).

# SSH

## Connect with username and password

Connect with username and password on standard port (22/tcp)

```bash
ssh user@10.11.12.13
```

Connect with username and password on non-standard port

```bash
ssh -p 2222 user@10.11.12.13
```

## Connect with private key

Connect with private key

```bash
chmod 600 id_rsa
ssh -i id_rsa user@10.11.12.13
```

## **Disable Host Checking**

Turn off key verification

```bash
ssh -o StrictHostKeyChecking=no -i offsec_ssh_key -p 2222 root@mountaindesserts.com
```

Or even

```bash
ssh -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" learner@192.168.50.52
```

Using the *UserKnownHostsFile=/dev/null* option prevents the server host key from being recorded. This means that every time we connect, it will be treated like a new connection. 

By using the *StrictHostKeyChecking=no* option, we are telling SSH not to verify the authenticity of the server host key.

## **Create key pair with ssh-keygen**

**ssh-keygen** generates, manages and converts authentication keys for ssh. ssh-keygen can create keys for use by SSH protocol version 2. The type of key to be generated is specified with the `-t` option. If invoked without any arguments, ssh-keygen will generate an Ed25519 key.

```bash
ssh-keygen
```

Then add the public key to the `authorized_keys` file on the remote target machine, e.g. with [ssh-copy-id](https://man7.org/linux/man-pages/man1/ssh-copy-id.1.html).

## Usage information

<details>

<summary>ssh -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ ssh
usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface] [-b bind_address]
           [-c cipher_spec] [-D [bind_address:]port] [-E log_file]
           [-e escape_char] [-F configfile] [-I pkcs11] [-i identity_file]
           [-J destination] [-L address] [-l login_name] [-m mac_spec]
           [-O ctl_cmd] [-o option] [-P tag] [-p port] [-R address]
           [-S ctl_path] [-W host:port] [-w local_tun[:remote_tun]]
           destination [command [argument ...]]
       ssh [-Q query_option]

```

</details>

<details>

<summary>ssh-keygen --help</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ ssh-keygen --help
unknown option -- -
usage: ssh-keygen [-q] [-a rounds] [-b bits] [-C comment] [-f output_keyfile]
                  [-m format] [-N new_passphrase] [-O option]
                  [-t dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa]
                  [-w provider] [-Z cipher]
       ssh-keygen -p [-a rounds] [-f keyfile] [-m format] [-N new_passphrase]
                   [-P old_passphrase] [-Z cipher]
       ssh-keygen -i [-f input_keyfile] [-m key_format]
       ssh-keygen -e [-f input_keyfile] [-m key_format]
       ssh-keygen -y [-f input_keyfile]
       ssh-keygen -c [-a rounds] [-C comment] [-f keyfile] [-P passphrase]
       ssh-keygen -l [-v] [-E fingerprint_hash] [-f input_keyfile]
       ssh-keygen -B [-f input_keyfile]
       ssh-keygen -D pkcs11
       ssh-keygen -F hostname [-lv] [-f known_hosts_file]
       ssh-keygen -H [-f known_hosts_file]
       ssh-keygen -K [-a rounds] [-w provider]
       ssh-keygen -R hostname [-f known_hosts_file]
       ssh-keygen -r hostname [-g] [-f input_keyfile]
       ssh-keygen -M generate [-O option] output_file
       ssh-keygen -M screen [-f input_file] [-O option] output_file
       ssh-keygen -I certificate_identity -s ca_key [-hU] [-D pkcs11_provider]
                  [-n principals] [-O option] [-V validity_interval]
                  [-z serial_number] file ...
       ssh-keygen -L [-f input_keyfile]
       ssh-keygen -A [-a rounds] [-f prefix_path]
       ssh-keygen -k -f krl_file [-u] [-s ca_public] [-z version_number]
                  file ...
       ssh-keygen -Q [-l] -f krl_file [file ...]
       ssh-keygen -Y find-principals -s signature_file -f allowed_signers_file
       ssh-keygen -Y match-principals -I signer_identity -f allowed_signers_file
       ssh-keygen -Y check-novalidate -n namespace -s signature_file
       ssh-keygen -Y sign -f key_file -n namespace file [-O option] ...
       ssh-keygen -Y verify -f allowed_signers_file -I signer_identity
                  -n namespace -s signature_file [-r krl_file] [-O option]

```

</details>

## Resources

**Secure Shell** - Wikipedia: <https://en.wikipedia.org/wiki/Secure_Shell>

**ssh** - Linux manual page: <https://man7.org/linux/man-pages/man1/ssh.1.html>

**ssh-copy-id** - Linux manual page: <https://man7.org/linux/man-pages/man1/ssh-copy-id.1.html>

**ssh-keygen** - Linux manual page: <https://man7.org/linux/man-pages/man1/ssh-keygen.1.html>