Secure file transfer with SSH, scp and rsync
Keys, scp, sftp and rsync.
Level 201 · 22 lessons · 18 practice labs
Lessons
Connecting and keys
- Your first SSH connection and the host fingerprint: You will understand what the host fingerprint shown on a first SSH connection means and why it should be verified.
- SSH keys and ssh-copy-id: You learn to use an SSH key pair instead of a password, place the public key on a server with ssh-copy-id, and protect the private key.
- ssh-agent and passphrase-protected keys
- ~/.ssh/config and short aliases: You learn to define short names and settings for servers in ~/.ssh/config so that connections stay tidy and less error-prone.
- known_hosts: what to do when a host key changes
- Short task: log in to three servers without passwords, by short name
Transferring files
- Copying securely with scp over SSH: You learn to copy files between two machines in encrypted form with scp and to check what went where.
- Interactive transfer with sftp over SSH: You learn to browse a server's files with sftp and download or upload them interactively and securely.
- Synchronising folders with rsync over SSH: You learn to keep two folders in sync with rsync by sending only what changed, and how this helps with backups.
- Incremental backups with rsync, --delete and dry runs
- An sftp-only user in a chroot
- Short task: sync a web directory to the backup server every night
Tunnels and jump hosts
- Reaching an internal service with local port forwarding
- Remote port forwarding and its risks
- Dynamic forwarding: a SOCKS proxy
- Connecting through a jump host with ProxyJump
- Short task: reach an internal database safely through the jump host
The server side
- Hardening the SSH server: On your own server you learn to shrink the attack surface of SSH, for example by turning off password and root logins.
- User and host certificates with an SSH certificate authority
- Following SSH logins and attempts in the logs
- Short task: audit an sshd configuration and close three weaknesses
Wrap-up
- Capstone: a secure deployment flow with SSH: In a fictional company you build a small flow that deploys an application to a server using key-based login and secure transfer.
Practice labs
- Passwordless login: a new server: Create a new key pair, install it on the lab server and show that you log in without being asked for a password.
- The key is there but it still asks for a password: Find the permission and ownership mistakes breaking key login (.ssh directory, authorized_keys), fix them and show in ssh -v output that the key is accepted.
- Whose keys are inside? An authorized_keys audit: Find keys belonging to former staff and unrestricted keys in the server’s authorized_keys files, remove them or restrict them with from= and command=, and test the remaining access.
- The server was rebuilt: a warning appears: Verify the rebuilt server’s fingerprint, replace the old known_hosts entry safely and connect without a warning.
- Which fingerprint is the real one?: Compare the fingerprints taken from the server console with the ones shown when connecting, and decide which of two addresses is the real server.
- A tangled ssh config file: Fix a ~/.ssh/config whose clashing Host blocks connect with the wrong user and key, and prove with ssh -G that each alias reaches the right server with the right identity.
- Collect logs from two servers: Copy the given log files from two servers to your machine with scp and verify with sha256sum that they arrived intact.
- Do the night upload with an sftp batch file: Write an sftp batch file that uploads the given folder, renames the old version, and runs without any interaction.
- Blue Harbour Cargo: the sftp user can’t connect: Fix the directory ownership and sshd Match mistakes stopping a chrooted sftp-only user from connecting, and show the user sees only their own folder and gets no shell.
- An archive transfer cut off halfway: Resume a large archive transfer that was cut off, using rsync, and show that file count and size match on both sides.
- Don’t let --delete wipe the wrong folder: Show with a dry run what a faulty backup script would delete with --delete, fix the target path and excludes, then run it safely.
- Daily snapshot backups for Ekin Co-op: Build a backup scheme with --link-dest that keeps a folder per day without spending space on unchanged files, and restore a file from a given day.
- Reach a panel that only opens from inside: Use local port forwarding to open, from your machine, a management panel that is only reachable from the server itself, and write down the page title.
- A two-hop connection: Connect to an internal server through two jump hosts in one ProxyJump command, and make it permanent in your config file.
- A reverse tunnel left wide open: Find a reverse tunnel exposed to the outside using ss and the sshd settings, close it with GatewayPorts and AllowTcpForwarding, and show the internal service is reachable only through a SOCKS tunnel.
- Turn off root and password login: Disable root and password login in sshd, validate the config with sshd -t and show that a normal user can still log in with a key.
- Addresses trying all night: Count failed attempts in the lab server’s auth logs, list the most active addresses and find one suspicious successful login.
- Logging in with short-lived certificates: Set up an SSH certificate authority, sign a one-hour certificate for a user, make the server trust the CA and show that an expired certificate is rejected.
About this course
Keys, scp, sftp and rsync.
What you will learn
- Connecting and keys
- Transferring files
- Tunnels and jump hosts
- The server side
- Wrap-up
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.