2. Ports and Protocols: SSH, HTTP, HTTPS, FTP/SFTP and DNS
2.2 SSH (Secure Shell) – Port 22
SSH ha aapla roj cha tool aahe – EC2 la login, files copy (scp/sftp), remote commands. Te encrypted aahe, pan chukiche configuration kela tar attackers sathi pahila target pan tech.
How key-based login works (simple view):
Your laptop Server (EC2)
private key mykey.pem (never leaves) ~/.ssh/authorized_keys (public key)
| 1. TCP connect to port 22 |
| 2. Server proves its identity (host key) ---->| you accept fingerprint once
| 3. Encrypted channel agreed (key exchange) |
| 4. Server sends a challenge |
| 5. Laptop signs it with the PRIVATE key ----->| verified with PUBLIC key
| 6. Login allowed, shell opened |
ssh -i mykey.pem ec2-user@<PUBLIC_IP> # Amazon Linux
ssh -i mykey.pem ubuntu@<PUBLIC_IP> # Ubuntu
ssh-keygen -t ed25519 -C "raja@lab" # create your own key pair
cat ~/.ssh/known_hosts # servers you have trusted before
Why this matters for security
Internet-facing SSH receives automated password-guessing (brute force) attempts all the time. Key-based authentication (ओळख पडताळणी), disabling password and root login, limiting port 22 to your own IP and tools like fail2ban (Part 11) are the standard defences. A leaked private key is as bad as a leaked password – anyone holding it can log in.
Ravindra Bagale's Tip
When "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED" appears, many students immediately delete known_hosts. Wait! If you've just launched a new EC2 instance this is normal, but otherwise it can be a sign of a man-in-the-middle attack. First understand the reason, then remove only that one line: ssh-keygen -R <IP>.
Ravindra Bagale's Tip – मराठी
"WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED" दिसलं की बरेच students लगेच known_hosts delete करतात. थांबा! EC2 नवीन launch केला असेल तर हे normal आहे, पण नाहीतर हे man-in-the-middle चं लक्षण असू शकतं. आधी कारण समजून घ्या, मग फक्त ती एक line काढा: ssh-keygen -R <IP>.
Ravindra Bagale's Tip – हिंदी
"WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED" दिखते ही बहुत से students तुरंत known_hosts delete कर देते हैं. रुको! अगर नया EC2 launch किया है तो यह normal है, वरना यह man-in-the-middle का संकेत हो सकता है. पहले वजह समझो, फिर सिर्फ़ वह एक line हटाओ: ssh-keygen -R <IP>.
Practice task
Generate an ED25519 key pair with ssh-keygen, look at both files in ~/.ssh/, and explain which file you may share and which you must never share.