Connecting via SSH is an essential skill for anyone who manages a website or server. SSH (Secure Shell) offers a secure, encrypted connection to your server with which you can run commands, manage files and adjust configurations. In this complete guide you will learn step by step how to connect via SSH, whether you use Windows, Mac or Linux.

What is SSH and why connect via SSH?

SSH vs. other connection methods

Protocol	Encrypted	Use	Security
SSH	Yes (fully)	Server management, file transfer	Excellent
FTP	No	File transfer	Insecure
SFTP	Yes (over SSH)	File transfer	Excellent
Telnet	No	Server management (outdated)	Insecure
RDP	Yes	Windows remote desktop	Good

As you can see, SSH is much safer than traditional protocols such as FTP and Telnet. Where you previously used FTP for file transfer, with SSH you can also manage files through SFTP or SCP.

What do you need to connect via SSH?

• Server IP address or hostname - the address of your server
• Username - often "root" for a new VPS, or a custom user
• Password or SSH key - your authentication method
• Port number - default port 22, but sometimes changed for extra security
• SSH client - software with which you make the connection

Connecting via SSH on Windows

Method 1: Windows Terminal or PowerShell

1. Open Windows Terminal or PowerShell (search in the start menu)
2. Type the SSH command: ssh username@ip-address
3. If the port is not the default (22), use: ssh -p portnumber username@ip-address
4. On the first connection, SSH asks whether you trust the server fingerprint, type "yes"
5. Enter your password (the characters are not shown, this is normal)
6. You are now connected to your server

Method 2: PuTTY (the classic SSH client)

PuTTY has been the most popular SSH client for Windows for years and offers extra features such as saved sessions and port forwarding:

1. Download PuTTY from the official website (putty.org)
2. Open PuTTY and enter the IP address under "Host Name"
3. Check that the port is correct (default 22)
4. Select "SSH" as the connection type
5. Optionally: save the session for later use
6. Click Open
7. Accept the server fingerprint on the first connection
8. Log in with your username and password

Connecting via SSH on macOS

1. Open Terminal (Applications > Utilities > Terminal, or search through Spotlight)
2. Type: ssh username@ip-address
3. For a non-default port: ssh -p portnumber username@ip-address
4. Accept the server fingerprint on the first connection ("yes")
5. Enter your password
6. You are connected

Connecting via SSH on Linux

Setting up SSH keys: safer than passwords

Generating an SSH key

1. Open your terminal (on Windows: PowerShell)
2. Run the command: ssh-keygen -t ed25519 -C "your-email@domain.com"
3. Choose a location for the key (the default is fine)
4. Optionally enter a passphrase for extra security
5. Two files are created: the private key (keep it secret) and the public key (.pub)

Copying the public key to the server

Copy your public key to the server with the ssh-copy-id command:

ssh-copy-id -i ~/.ssh/id_ed25519.pub username@ip-address

After copying, you can log in without a password. The server verifies your identity using your private key that is stored on your computer.

SSH configuration file: saving connections

Example SSH config

In your SSH configuration file you can create a block for each server with the hostname, the IP address, the username, the port number and the path to the correct SSH key. After configuration you only need to type a short alias to connect, instead of the full command with all parameters.

Transferring files over SSH

SCP (Secure Copy)

• Uploading a file: scp file.txt user@server:/path/to/target/
• Downloading a file: scp user@server:/path/to/file.txt ./local/
• Uploading a folder: scp -r foldername/ user@server:/path/to/target/

SFTP (SSH File Transfer Protocol)

SFTP offers an interactive file transfer session over SSH. You can navigate, view files and transfer them with commands such as ls, cd, get and put. Many graphical FTP clients such as FileZilla also support SFTP connections.

SSH tunneling and port forwarding

Local port forwarding

With local port forwarding you make a service on the server reachable through a port on your local computer. This lets you, for example, open phpMyAdmin in your browser through localhost, while it actually runs on the server.

Remote port forwarding

Remote port forwarding works in the opposite direction: it makes a service on your local computer reachable through the server. This is handy for demonstrating a local development environment to others.

Solving common SSH problems

Connection refused

This means the SSH service is not running on the server or that a firewall is blocking the connection. Check whether the SSH service is active and whether the correct port is open in the firewall.

Permission denied

Your password or SSH key is not being accepted. Check whether you are using the correct username and password. With SSH keys, verify that your public key is correctly stored on the server and that the permissions of the .ssh folder are correct (700 for the folder, 600 for the files).

Connection timed out

The server does not respond. Check whether the IP address is correct, whether the server is online and whether there are no network problems. Also check whether the SSH port has not been changed.

Host key verification failed

The fingerprint of the server has changed since your last connection. This can happen after a reinstallation of the server. If you are sure the server is legitimate, remove the old key from your known_hosts file.

SSH security best practices

• Use SSH keys instead of passwords
• Disable password authentication after setting up keys
• Change the default SSH port from 22 to a random number
• Block root login over SSH (use a sudo user)
• Install fail2ban to block brute-force attacks
• Keep your SSH client and server up to date
• Use a passphrase on your private key

Also see our guide on securing your website for more security measures you can take after setting up an SSH connection.

Connecting via SSH is a fundamental skill that every website and server administrator should master. With the steps in this guide you can connect securely to your server, transfer files and use advanced features such as SSH tunneling. Start with the basic functions and expand your knowledge gradually as you gain more experience with server management.

SSH in practice: common workflows

Managing multiple servers with SSH

If you manage multiple servers, a well-organised SSH configuration file becomes indispensable. Define aliases for all your servers so that you can connect with a short command. Use tools such as Ansible or Fabric to run the same commands on multiple servers at once. This saves an enormous amount of time on tasks such as rolling out updates or checking server status.

SSH agent forwarding

SSH agent forwarding lets you use your local SSH keys through an intermediate server. This is useful when you connect to internal servers from a bastion host. Instead of placing your private key on the intermediate server, the authentication is forwarded to your local SSH agent. This increases security considerably.

Automated tasks over SSH

Combine connecting via SSH with scripting to automate tasks. From a local script you can run SSH commands on a remote server without logging in interactively. This is the basis for deployment scripts, monitoring checks and automated backups. Make sure the SSH key authentication is configured correctly for passwordless access.

SSH alternatives and additional tools

Connecting via SSH: advanced configuration with a config file

The config file is located at ~/.ssh/config and contains blocks per server with all connection settings. This lets you use a short alias instead of a long command with the port, username and key file.

Handy SSH config options

Option	Function	Example
Host	Alias for the connection	Host my-server
HostName	IP address or domain name	HostName 192.168.1.100
User	Username	User admin
Port	SSH port number	Port 7777
IdentityFile	Path to the private key	IdentityFile ~/.ssh/id_server
ServerAliveInterval	Keep-alive interval in seconds	ServerAliveInterval 60
ProxyJump	Connect through another server	ProxyJump bastion

With ProxyJump you can connect through a bastion host or jump server to servers that are not directly reachable over the internet. This is a widely used security measure in which all SSH access is routed through a central point.

Connecting via SSH: tunneling and port forwarding

There are three forms of SSH port forwarding:

• Local port forwarding (-L): make a service on the server reachable through a local port. Ideal for reaching phpMyAdmin or Grafana locally, for example, without opening them publicly.
• Remote port forwarding (-R): make a local service reachable through the server. Handy for testing webhooks or sharing a local development environment.
• Dynamic port forwarding (-D): create a SOCKS proxy through the server. All your traffic is routed encrypted through the SSH connection.

Local port forwarding is the most used variant. Suppose you run a MySQL database on your server that is only reachable locally (best practice for VPS security). With local port forwarding you connect your local port 3306 to the MySQL port on the server, so that you can work with a local database client as if the database runs on your own computer.

SSH security: key management and best practices

1. Use ED25519 keys: this is the most modern and secure key type. RSA keys are still secure at 4096 bits, but ED25519 is faster and more compact.
2. Protect keys with a passphrase: a passphrase on your private key protects you even if someone gains access to your computer. Use ssh-agent to cache the passphrase so that you do not have to enter it every time.
3. Rotate keys periodically: generate new key pairs each year and remove old public keys from your servers.
4. Limit keys per server: use separate key pairs for different servers. If one key is compromised, this limits the damage.
5. Configure AllowUsers: specify in sshd_config which users may log in over SSH. This prevents access through unintended accounts.

Combine SSH security with two-factor authentication for maximum protection. Use Linux commands to regularly check your SSH configuration and connected keys on your server.

Connecting via SSH: solving common problems

The most common problem is "Connection refused". This means the SSH service is not running on the server or that a firewall is blocking the connection. Check through the hosting panel whether the server is switched on and whether the SSH port is open. "Permission denied (publickey)" indicates that your SSH key is not being accepted. Check whether your public key has been added correctly to the authorized_keys file on the server and whether the file permissions are set correctly (700 for the .ssh directory and 600 for authorized_keys).

"Connection timed out" often points to a network problem or a wrong hostname and port. Check whether you are using the correct IP address and port number. With "Host key verification failed", the server key has changed since your last connection, which can indicate a reinstallation but also a man-in-the-middle attack. Verify through an alternative channel that the server has actually been changed before you remove the old key.

Connecting via SSH: SFTP and SCP for file transfer

SCP (Secure Copy) is ideal for fast, one-off file transfers. The syntax resembles the cp command but works over the network. SFTP (SSH File Transfer Protocol) offers an interactive session comparable to traditional FTP but fully encrypted. SFTP also supports resuming interrupted transfers, directory listings and file management on the server. For graphical file transfer you can use tools such as FileZilla, WinSCP or Cyberduck. These support SFTP and offer a familiar drag-and-drop interface for file management on your server.

SSH connections: automation and scripting

Remote command execution over SSH lets you run tasks on multiple servers at once. This is particularly valuable for applying security updates, checking server status or rolling out configuration changes to a fleet of servers. Tools such as Ansible, Puppet and Chef build on SSH to automate full server configuration and make it reproducible.

For simple automation, a Bash script that runs commands over SSH on your servers is enough. Combine this with cron jobs for periodic tasks such as checking disk space, renewing SSL certificates or making backups. Make sure you use SSH keys without a passphrase for automated tasks, but restrict these keys through the authorized_keys file to specific commands so that they cannot be abused for unlimited access.