Linux Tutorial / Connect with SSH and Transfer Files with scp and sftp

Linux

Secure Shell (SSH) provides encrypted remote login and command execution, while OpenSSH tools also support file transfer through scp and sftp. Verify the server host-key fingerprint on first connection and retain the existing login method until key authentication has been tested.

Check private-key modes with file permissions and investigate timeouts or name failures with network diagnostics. On Ubuntu, inspect socket activation as well as the service using systemctl status ssh.service ssh.socket; this does not mean both units must always be active.

System configuration exercises use a conventional Ubuntu 26.04 LTS or Rocky Linux 9 VM as the reference environment. Containers, WSL, and other releases can differ in service and package configuration. Prepare console recovery and record your versions using the virtual machine setup lesson.

Install the client and server in the correct places

The computer where you type the command is the client; the Linux machine you log into is the server. The server needs a reachable address, an existing user account, sshd, and network rules allowing the actual SSH port. Use only the installation block matching your distribution. On Ubuntu, apt update refreshes package metadata.

sudo apt update
sudo apt install openssh-server
sudo systemctl enable --now ssh

sudo dnf install openssh-server
sudo systemctl enable --now sshd

Ubuntu commonly uses ssh and Rocky Linux uses sshd, but inspect the installed service. Host firewalls, cloud security rules, and NAT forwarding are separate. Keep an existing session open and establish console recovery before restricting authentication or changing the SSH port.

Verify server identity before accepting the first key

Use an already trusted channel, such as the server console, to obtain its host-key fingerprint. Run the first command on the server and the second on the client. Replace user and server.example with actual values. If Ed25519 is unavailable or disallowed by policy, verify the actual host key used by the server.

sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
ssh user@server.example

Compare the client prompt with the trusted SHA256 fingerprint before accepting it. A changed-host-key warning requires investigation: it may follow a legitimate reinstall or indicate interception. Do not delete the entire known_hosts file or turn verification off to silence it. Update only the relevant entry after confirming a legitimate replacement.

Create a key pair and install only the public key

ssh-keygen -t ed25519 -f ~/.ssh/linux-course-key
ssh-copy-id -i ~/.ssh/linux-course-key.pub user@server.example
ssh -i ~/.ssh/linux-course-key user@server.example

If key generation asks to overwrite an existing file, stop and choose a different filename. Protect the private key with a passphrase and keep it on the client; install only the .pub key on the server. Where ssh-copy-id is unavailable, append the public-key line to the account’s ~/.ssh/authorized_keys through an approved method. Common permissions are 700 for .ssh and 600 for authorized_keys, with correct ownership.

Test from a new terminal. Supplying a key path does not by itself prove that key was used; the agent or password fallback may authenticate instead. When needed, inspect ssh -v -o IdentitiesOnly=yes -i ... output for the successful method. Choose an approved supported key type in environments with specific cryptographic or FIPS policies.

Send and retrieve a small file with scp

printf "SSH transfer test\n" > transfer-test.txt
scp -i ~/.ssh/linux-course-key transfer-test.txt user@server.example:~/transfer-test.txt
scp -i ~/.ssh/linux-course-key user@server.example:~/transfer-test.txt ./transfer-returned.txt
cmp transfer-test.txt transfer-returned.txt

Run this example on the client using a lab account, after confirming the remote filename is unused: scp can overwrite it. If cmp exits with status 0 and no output, the returned file matches. Recent OpenSSH scp versions use SFTP by default; check compatibility with older servers instead of assuming legacy SCP behavior.

Use interactive sftp and custom ports

sftp -i ~/.ssh/linux-course-key user@server.example

Enter the following commands at the sftp prompt. pwd and ls refer to the remote side; lpwd and lls refer to the local side. Check both locations before uploading or downloading.

pwd
lpwd
ls
put transfer-test.txt
get transfer-test.txt transfer-sftp.txt
bye

For port 2222, ssh uses -p 2222, whereas scp and sftp use -P 2222. Investigate the listener and policy for connection refusal, and username, keys, and permissions for authentication failure. Verbose logs can expose addresses and account paths, so redact them before sharing. Remove only the lab files and public-key registration you no longer need.

Official references

Linux