2. Ports and Protocols: SSH, HTTP, HTTPS, FTP/SFTP and DNS
2.2 SSH (Secure Shell) – Port 22
SSH ha aapla roj cha tool aahe – EC2 la login, files copy (scp/sftp), remote commands. Te encrypted aahe, pan chukiche configuration kela tar attackers sathi pahila target pan tech.
How key-based login works (simple view):
Your laptop Server (EC2)
private key mykey.pem (never leaves) ~/.ssh/authorized_keys (public key)
| 1. TCP connect to port 22 |
| 2. Server proves its identity (host key) ---->| you accept fingerprint once
| 3. Encrypted channel agreed (key exchange) |
| 4. Server sends a challenge |
| 5. Laptop signs it with the PRIVATE key ----->| verified with PUBLIC key
| 6. Login allowed, shell opened |
ssh -i mykey.pem ec2-user@<PUBLIC_IP> # Amazon Linux
ssh -i mykey.pem ubuntu@<PUBLIC_IP> # Ubuntu
ssh-keygen -t ed25519 -C "raja@lab" # create your own key pair
cat ~/.ssh/known_hosts # servers you have trusted before
Why this matters for security
Internet-facing SSH receives automated password-guessing (brute force) attempts all the time. Key-based authentication (ओळख पडताळणी), disabling password and root login, limiting port 22 to your own IP and tools like fail2ban (Part 11) are the standard defences. A leaked private key is as bad as a leaked password – anyone holding it can log in.
Ravindra Bagale's Tip
"WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED" disla ki khup students laghech known_hosts delete kartat. Thamba! EC2 navin launch kela asel tar he normal aahe, pan nahi tar he man-in-the-middle che lakshan asu shakta. Aadhi karan samja, mag fakt ti ek line kadha: ssh-keygen -R <IP>.
Practice task
Generate an ED25519 key pair with ssh-keygen, look at both files in ~/.ssh/, and explain which file you may share and which you must never share.