SSH trust, keys, forwarding and tmux sessions

Remote machines do the heavy work. Keys plus tmux turn a fragile connection into a durable session with no password typed twice.

implement

You can now

Create ed25519 keys, configure hosts, copy keys and disable password authentication.
Forward a remote port to localhost and run it in the background without secrets in logs.
Run a task in a named tmux session that survives disconnects and reattach cleanly.

Covers

SSH trust, keys, forwarding and durable tmux sessions

Study, in this order

2 steps

Command-line environment: remote machines
The Missing Semester of Your CS Education

Remote Machines: ssh invocation, key generation with ssh-keygen -a 100 -t ed25519, ssh-copy-id, ~/.ssh/config entries and LocalForward; Exercises under Remote Machines (SSH)

Done
Command-line environment: terminal multiplexers
The Missing Semester of Your CS Education

Terminal Multiplexers: tmux sessions, detaching and reattaching, windows and panes; Exercises under Terminal Multiplexers

Done

Focus on

Host trust and user trust are different files: known_hosts authenticates the server, authorized_keys authenticates you. Read first-connection prompts instead of reflex-typing yes.
One key per client, passphrase protected, loaded in the agent. The private key never leaves the client; copy the .pub with ssh-copy-id.
LocalForward exposes a remote port locally, and -N -f backgrounds the tunnel. Never paste tokens or keys into commands that land in shell history or logs.
tmux owns the session, not the correctness. Name sessions, detach with the prefix plus d, reattach with tmux a -t. A host reboot or a killed tmux server still ends the session.

Reproduce closed-book

Generate ssh-keygen -a 100 -t ed25519 demokey and get demokey plus demokey.pub. Add a Host vm entry with HostName, User and IdentityFile, then verify with ssh -G vm that hostname, user, port and identityfile resolve (observed with OpenSSH 10.2). Then run tmux new -d -s atlas, tmux ls, detach, reattach and kill-session (observed with tmux 3.6a).

Traps

Agent forwarding to untrusted hosts. A root user on the remote can use your agent, so forward only where needed and prefer ProxyJump.
Leaving password authentication enabled. Keys plus disabled passwords close brute force; the exercises walk through sshd_config.
Treating tmux as supervision. It survives disconnects, not reboots or out-of-memory kills; real services need a supervisor.

Practice

Missing Semester SSH exercise chain

Exercises under Remote Machines (SSH), items 1 to 5 and 7: key pair, Host vm config, ssh-copy-id, a webserver on 8888 reached at localhost:9999, PasswordAuthentication off, and -N -f background forwarding

Missing Semester tmux tutorial exercise

Exercises under Terminal Multiplexers: follow the linked tmux tutorial, then customize tmux.conf

Self-test

known_hosts versus authorized_keys: who trusts whom?
What does LocalForward 9999 localhost:8888 in Host vm do?
SSH drops mid-run inside tmux. What survives?
Why is ssh -N -f useful for forwarding, and what do the flags do?

Completion criterion

Stop when

You reach the remote with no password prompt, the forwarded port serves locally, and a reattached session shows the task log intact after a disconnect.

Mark passed, then open 5.8 Only mark this when you can do it without notes.

Leads to

5.8 Dependency locks, run manifests and quality gates Run clean-environment builds on the remote host you can now reach reliably.
6.7 Health checks, containers, supervision and runbooks Supervise remote services beyond a personal tmux session.

Comes after

5.5 Shell streams, exit status, signals, processes and permissionsRun the same fail-fast scripts on remote hosts over SSH inside tmux.

Resources for this unit

The Missing Semester of Your CS Education
MITprimarycourse
Complete the 2026 lectures on the shell, command-line environment, development tools, debugging and profiling, Git, packaging and shipping code, and code quality. Apply every exercise to the same stage project.

Also in this section

pytest documentation
pytestrequiredimplementation
Use Get Started, fixtures, parametrization, monkeypatch, caplog and temporary paths to build behavior and failure-path tests without order dependence.
Hypothesis documentation
Hypothesisrequiredpractice
Follow the Quick start and property-based testing guides, then generate operation histories and retain the minimized example for one real defect.
The Art of Debugging
Stas Bekmansupportpractice
Use the Unix, Python and compiled-code sections during a real seeded defect. Follow the evidence and tiny-reproducer workflow rather than reading the unfinished book front to back.
Pro Git
Git projectsupportreference
Use Chapters 2-3 and the sections on debugging, internals and recovery while constructing a history for bisect and recovering a deliberately displaced commit.
Stas' Python Cookbook - debugging and testing
Stas Bekmansupportreference
Use Part III and the packaging sections for debugger, traceback, pytest, logging, profiling and clean-environment recipes.
AlgoMaster Python - mocking
AlgoMastersupportcourse
Use the Mocking lesson for unittest.mock: Mock versus MagicMock, patch targets, autospec and the over-mocking trap. The pytest docs remain the reference for fixtures and monkeypatch.