Introduction
SSH provides encrypted command-line access to another Linux account, while SCP uses the same authentication and transport to copy files. A safe first connection verifies the server's host key; later connections can use a personal key instead of repeatedly sending an account password.
This lab uses an isolated remoteuser account on localhost as the remote host. Although both accounts share one training VM, the SSH protocol, authentication prompts, remote home directory, and file transfers behave like a basic two-host workflow. The default labex SSH access path is not changed.
Inspect the SSH Target
In this step, you will identify the SSH client, resolve the target name, confirm a listening server, and preview its public host key.
Enter the local workspace:
cd /home/labex/project/ssh-lab
Display the OpenSSH client version. This program writes its version to standard error, so 2>&1 combines it with standard output:
ssh -V 2>&1
Resolve the local target through the system name-service configuration:
getent hosts localhost
Confirm that an SSH server listens on TCP port 22:
sudo ss -ltnp | grep ':22'
ssh-keyscan retrieves public host keys without logging in. Pipe the ED25519 key to ssh-keygen -lf - to display its fingerprint:
ssh-keyscan -t ed25519 localhost 2>/dev/null | ssh-keygen -lf -
In a real environment, compare this fingerprint with a trusted value from the administrator before accepting it. Save a compact target summary:
printf 'target=localhost\nport=22\nuser=remoteuser\n' > ssh-target.txt
cat ssh-target.txt
Open Your First Remote Shell
In this step, you will verify a host key, authenticate with a password, inspect the remote account, and close the remote shell.
Connect with the user@host form:
ssh remoteuser@localhost
Because setup removed any previous localhost host-key record, SSH asks whether you trust the displayed fingerprint. After comparing it with Step 1, type:
yes
At the password prompt, enter:
RemoteLab123!
The password is not displayed while you type. After login, the prompt belongs to remoteuser, not labex. Confirm the remote identity, host, and current directory:
whoami
hostname
pwd
Create a remote marker in the remote account's home directory:
mkdir -p ~/ssh-lab
printf 'connected as %s\n' "$(whoami)" > ~/ssh-lab/connected.txt
Close the remote shell and return to the local labex prompt:
exit
The exit command ends only the remote shell; the local terminal remains open.
Run a Remote Command
In this step, you will run commands remotely without opening a long-lived interactive shell and save their output locally.
Return to the local workspace if needed:
cd /home/labex/project/ssh-lab
Place a quoted command after the host. SSH runs it remotely and returns its output to your local terminal:
ssh remoteuser@localhost 'whoami; uname -srm; uptime'
Enter RemoteLab123! when prompted. The semicolons separate commands interpreted by the remote shell.
Run a second remote command and redirect the returned output into a local file:
ssh remoteuser@localhost 'printf "remote_user=%s\nremote_home=%s\n" "$(whoami)" "$HOME"' > remote-context.txt
Enter the password again. The > redirection is handled by your local shell, so remote-context.txt is created in the local workspace:
cat remote-context.txt
The file should identify remoteuser and /home/remoteuser.
Transfer a File with SCP
In this step, you will upload a local file, inspect it remotely, and download it under a new local name.
Create a local configuration sample:
cd /home/labex/project/ssh-lab
printf 'mode=training\nport=8080\n' > app.conf
SCP uses user@host:path for a remote path. Upload the file to the prepared remote incoming directory:
scp app.conf remoteuser@localhost:/home/remoteuser/incoming/app.conf
Enter RemoteLab123! when prompted. Confirm the remote content through SSH:
ssh remoteuser@localhost 'cat /home/remoteuser/incoming/app.conf'
Enter the password again. Now reverse the source and destination to download the file:
scp remoteuser@localhost:/home/remoteuser/incoming/app.conf downloaded-app.conf
Enter the password, then compare the local original and downloaded copy:
cmp app.conf downloaded-app.conf && echo "The files match"
Transfer a Directory Recursively
In this step, you will use SCP recursive mode to copy a directory tree to the remote account.
Create a small local project tree:
cd /home/labex/project/ssh-lab
mkdir -p site/assets
printf '<h1>SSH transfer practice</h1>\n' > site/index.html
printf 'body { color: navy; }\n' > site/assets/style.css
The -r option copies directories and their contents recursively:
scp -r site remoteuser@localhost:/home/remoteuser/incoming/
Enter RemoteLab123! when prompted. List the remote tree with a one-shot SSH command:
ssh remoteuser@localhost 'find /home/remoteuser/incoming/site -type f -printf "%P\n" | sort'
Enter the password again. You should see assets/style.css and index.html.
Generate a Personal SSH Key
In this step, you will create a dedicated ED25519 key pair and inspect its permissions and fingerprint.
A key pair contains a private key that stays with you and a public key that can be installed on a remote account. Generate a dedicated practice key without a passphrase so automated validation can use it:
mkdir -p ~/.ssh
chmod 700 ~/.ssh
ssh-keygen -t ed25519 -f ~/.ssh/labex_remote_ed25519 -N '' -C 'labex-remote-practice'
The -t option selects the algorithm, -f selects the file, -N '' sets an empty practice passphrase, and -C adds a label. Production keys should normally use a strong passphrase when automation constraints do not forbid it.
Inspect the two files and their permissions:
ls -l ~/.ssh/labex_remote_ed25519 ~/.ssh/labex_remote_ed25519.pub
The private key should be readable only by labex. The .pub file is designed to be shared. Display the public-key fingerprint:
ssh-keygen -lf ~/.ssh/labex_remote_ed25519.pub
Never copy or disclose the private key.
Install and Use the Public Key
In this step, you will install the public key for remoteuser, connect without a password prompt, and verify key-based file transfer.
ssh-copy-id appends a public key to the remote account's ~/.ssh/authorized_keys with suitable permissions:
ssh-copy-id -i ~/.ssh/labex_remote_ed25519.pub remoteuser@localhost
Enter RemoteLab123! for this final password-authenticated action. Test the dedicated private key with -i:
ssh -i ~/.ssh/labex_remote_ed25519 remoteuser@localhost 'printf "key authentication works\n" > ~/ssh-lab/key-authenticated.txt; cat ~/ssh-lab/key-authenticated.txt'
This command should not ask for the remote account password. Use the same identity for SCP:
scp -i ~/.ssh/labex_remote_ed25519 remoteuser@localhost:~/ssh-lab/key-authenticated.txt key-authenticated.txt
cat key-authenticated.txt
The downloaded file should contain key authentication works. The host key authenticates the server; your private key authenticates you to the remote account. They solve different trust problems.
Summary
You verified an SSH host key, opened and exited a remote shell, ran one-shot remote commands, and distinguished local redirection from remote execution. You uploaded and downloaded files with SCP and copied a directory recursively.
You also generated a dedicated ED25519 key pair, protected the private key, installed only the public key, and reused the identity for passwordless SSH and SCP. These are the core skills needed for safe beginner remote administration.
