What Is SSH? How to Connect to a Server

How does SSH work?

SSH follows a client-server model. On the server, an SSH server (sshd) listens on TCP port 22 by default. You connect to that port with the SSH client on your computer.

When the connection opens, both sides first agree on encryption keys, and from then on all traffic is encrypted. Then the server checks who you are. There are two ways:

• Password login: you enter a user name and password. Simple, but exposed to password-guessing attacks.
• Key login: you create a key pair on your computer. You put the public key on the server and keep the private key to yourself. The server verifies that you hold the private key without the key ever being sent. This is far more secure.

The host fingerprint

The first time you connect to a server, you see this message:

The authenticity of host '203.0.113.10' can't be established.
ED25519 key fingerprint is SHA256:...
Are you sure you want to continue connecting (yes/no)?

It means you are recording the server's identity for the first time. When you type yes, the fingerprint is saved in the known_hosts file on your computer. If the fingerprint changes on a later connection, SSH warns you; that can mean the server was reinstalled, or that someone is in the middle.

How to connect to a server with SSH

You need three things: the server's IP address, the user name (usually root on a new server) and a password or key. At Nodesty, these details appear in the customer panel and are sent by email once your server is set up.

From Windows

Windows 10 and 11 need no extra software. Open PowerShell or Command Prompt and type:

ssh root@203.0.113.10

When asked for the password, nothing appears on screen as you type; that is normal. Type it and press Enter. If you prefer a graphical tool, PuTTY or Windows Terminal work too.

From macOS and Linux

Open the Terminal app and run the same command:

ssh root@203.0.113.10

If SSH runs on a port other than 22, add -p:

ssh -p 2222 root@203.0.113.10

Type exit to close the connection.

How to create an SSH key

Key login is both more secure and more convenient, because you no longer type a password every time. Create a modern, compact ed25519 key on your computer:

ssh-keygen -t ed25519 -C "my-laptop"

The command asks where to save the key and whether you want a passphrase. We recommend one: even if your laptop is stolen, the private key is useless on its own. When it finishes, you have two files:

• ~/.ssh/id_ed25519: the private key. Never share it.
• ~/.ssh/id_ed25519.pub: the public key. This is what you add to servers.

Adding the public key to the server

On macOS and Linux, one command does it:

ssh-copy-id root@203.0.113.10

Windows has no ssh-copy-id, so use this in PowerShell instead:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@203.0.113.10 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

From now on, ssh root@203.0.113.10 logs you in without a password.

SSH security: first steps

Every server that is reachable from the internet faces automated password-guessing attacks within minutes of going online. Hundreds of failed attempts in /var/log/auth.log are perfectly normal. These steps make those attacks useless:

1. Create a regular user. Instead of working as root all the time, create a user with sudo rights and add your public key to its ~/.ssh/authorized_keys.
2. Confirm that key login works. Don't move on until you can connect as the new user in a separate terminal.
3. Turn off password and root login. Set these lines in /etc/ssh/sshd_config:

   PasswordAuthentication no
   PermitRootLogin no
   

   
   Then restart the service with sudo systemctl restart ssh. On some distributions the service is called sshd.
4. Keep SSH open in the firewall. If you use ufw, run sudo ufw allow OpenSSH before enabling the firewall, or you will lock yourself out.
5. Install Fail2ban. It temporarily blocks IP addresses that fail to log in repeatedly.

Moving SSH from port 22 to another number cuts down log noise, but it is not a security measure on its own. Key login is what actually protects you.

If you do lock yourself out, don't panic: the web console (VNC) in the Nodesty customer panel gives you the server's screen independently of SSH, so you can fix the setting from there.

Common SSH errors

• Connection refused: The SSH service is not running on the server, or you are using the wrong port. Check the service with systemctl status ssh from the web console.
• Connection timed out: The server can't be reached at all. Check the IP address, that the server is running and that the SSH port is open in the firewall.
• Permission denied (publickey): The server expects a key but you are not sending the right one. Make sure the public key is in the right user's authorized_keys and that permissions are correct (700 for ~/.ssh, 600 for authorized_keys).
• REMOTE HOST IDENTIFICATION HAS CHANGED: The server's fingerprint has changed. If you reinstalled the server, that is expected; remove the old entry with ssh-keygen -R 203.0.113.10 and connect again. If you didn't, be careful.

When do you need SSH?

SSH is the basic tool for any Linux server you manage yourself, whether it is a VPS, a dedicated server or a game server. On shared web hosting, the provider manages the server; you use the control panel and FTP, and you don't need SSH.

Nodesty's AMD Ryzen 9 9950X VPS and AMD EPYC 7763 VPS plans come with full root access. OpenSSH is preinstalled on Ubuntu, Debian and AlmaLinux, your login details appear in the panel as soon as setup finishes, and the web console is always there if SSH access breaks.