SSH & Remote Servers

What is SSH

SSH stands for Secure Shell. It lets you control a remote computer from your terminal. All communication between your machine and the remote server is encrypted.

This is how you connect to HPC clusters, cloud servers, and lab workstations. If you run a bioinformatics pipeline on a remote machine, SSH is how you get there.

Connecting to a Remote Server

The basic SSH command takes a username and a hostname:

$ ssh jane@hpc.university.edu

The first time you connect to a new server, you will see a fingerprint prompt:

The authenticity of host 'hpc.university.edu (192.168.1.50)' can't be established.
ED25519 key fingerprint is SHA256:AbCdEf1234567890...
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Type yes to accept. SSH saves the fingerprint so you are not asked again.

Connecting to an AWS EC2 Instance

AWS instances use a private key file instead of a password. You specify the key with the -i flag:

$ ssh -i ~/.ssh/my-aws-key.pem ec2-user@ec2-54-123-45-67.compute-1.amazonaws.com

Make sure the key file has the correct permissions. SSH will refuse to use a key that is too open:

$ chmod 400 ~/.ssh/my-aws-key.pem

SSH Keys

Why Passwords Are Not Enough

Passwords can be guessed or brute-forced. SSH keys use cryptographic key pairs, which are far more secure. Many servers disable password authentication entirely.

Generating a Key Pair

Use ssh-keygen to create a public and private key pair:

$ ssh-keygen -t ed25519 -C "jane@lab"
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/jane/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Your identification has been saved in /home/jane/.ssh/id_ed25519
Your public key has been saved in /home/jane/.ssh/id_ed25519.pub

This creates two files:

• ~/.ssh/id_ed25519 is your private key. Never share this file.
• ~/.ssh/id_ed25519.pub is your public key. This goes on the remote server.

Copying the Public Key to a Server

The easiest way is ssh-copy-id:

$ ssh-copy-id jane@hpc.university.edu

This appends your public key to the ~/.ssh/authorized_keys file on the remote server. After this, you can log in without a password.

If ssh-copy-id is not available, you can copy the key manually:

$ cat ~/.ssh/id_ed25519.pub | ssh jane@hpc.university.edu "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

SSH Config File

Typing long SSH commands every time is tedious. The SSH config file lets you save connection details as shortcuts.

Create or edit ~/.ssh/config:

Host labserver
    HostName hpc.university.edu
    User jane
    Port 22

Host aws-pipeline
    HostName ec2-54-123-45-67.compute-1.amazonaws.com
    User ec2-user
    IdentityFile ~/.ssh/my-aws-key.pem

Now you can connect with a short alias:

# Instead of: ssh jane@hpc.university.edu
$ ssh labserver

# Instead of: ssh -i ~/.ssh/my-aws-key.pem ec2-user@ec2-54-123-45-67.compute-1.amazonaws.com
$ ssh aws-pipeline

This also works with scp and rsync, as shown below.

Copying Files with scp

scp copies files between your machine and a remote server. The syntax is similar to cp, but one side includes a hostname.

Download a Results File

$ scp jane@hpc.university.edu:/data/results/deseq2_results.csv ./

Or using your SSH config alias:

$ scp labserver:/data/results/deseq2_results.csv ./

Upload a Samplesheet

$ scp samplesheet.csv labserver:/data/rnaseq/

Copy a Directory

Use the -r flag for directories:

$ scp -r labserver:/data/fastqc_reports/ ./qc_results/

rsync for Large Transfers

rsync is better than scp for large or repeated transfers. It only sends files that have changed. If a transfer is interrupted, you can resume it.

Basic Usage

$ rsync -avz labserver:/data/rnaseq/results/ ./results/

The flags:

• -a preserves file permissions, timestamps, and directory structure
• -v shows verbose output
• -z compresses data during transfer

Show Transfer Progress

Add --progress to see per-file transfer progress:

$ rsync -avz --progress labserver:/data/rnaseq/results/ ./results/
sending incremental file list
counts_matrix.tsv
         12,456,789 100%   45.23MB/s    0:00:00 (xfr#1, to-chk=4/6)
deseq2_results.csv
            234,567 100%   22.10MB/s    0:00:00 (xfr#2, to-chk=3/6)

Exclude Files

Use --exclude to skip files you do not need:

$ rsync -avz --progress --exclude="*.bam" --exclude="*.fastq.gz" labserver:/data/rnaseq/ ./local_results/

This downloads the analysis output without copying large raw data files.

Running Commands Remotely

You can run a single command on a remote server without opening an interactive session. Put the command in quotes after the SSH connection string:

$ ssh labserver "ls -lh /data/rnaseq/results/"
total 48M
-rw-r--r-- 1 jane bioinfo  12M Mar 28 10:15 counts_matrix.tsv
-rw-r--r-- 1 jane bioinfo 235K Mar 28 10:20 deseq2_results.csv
-rw-r--r-- 1 jane bioinfo 4.5K Mar 28 10:20 summary_stats.txt

This is useful for quick checks. You can see if a pipeline is still running:

$ ssh labserver "squeue -u jane"

Or check disk usage:

$ ssh labserver "du -sh /data/rnaseq/*"

Keeping Sessions Alive

If you close your laptop or lose your network connection, any running process on the remote server will be killed. This is a problem for pipelines that take hours or days.

Use tmux to keep sessions alive. tmux runs on the remote server and persists even when you disconnect.

Start a New tmux Session

$ ssh labserver
$ tmux new -s rnaseq-pipeline

This opens a new terminal session named rnaseq-pipeline. Start your long-running command inside it:

$ nextflow run nf-core/rnaseq -profile singularity --input samplesheet.csv --outdir results

Detach from the Session

Press Ctrl+b, then d to detach. You are back at the regular terminal. The pipeline keeps running inside tmux.

You can now safely close your laptop or disconnect from SSH.

Reconnect to the Session

Log back in and reattach:

$ ssh labserver
$ tmux attach -t rnaseq-pipeline

Your pipeline output is right where you left it.

List All tmux Sessions

$ tmux ls
rnaseq-pipeline: 1 windows (created Sat Mar 28 14:30:00 2026)

Tip

Always start long-running pipelines inside tmux. This includes Nextflow runs, large file downloads, and genome indexing. You will lose hours of work if your connection drops without tmux.

Quick Reference

Task	Command
Connect to a server	ssh user@hostname
Connect with a key file	ssh -i key.pem user@hostname
Generate an SSH key pair	ssh-keygen -t ed25519
Copy public key to server	ssh-copy-id user@hostname
Copy file from server	scp server:/path/file.csv ./
Copy file to server	scp file.csv server:/path/
Sync a directory	rsync -avz server:/path/ ./local/
Run a remote command	ssh server "command"
Start a tmux session	tmux new -s name
Detach from tmux	Ctrl+b, then d
Reattach to tmux	tmux attach -t name

Next Steps

Now that you can work with Linux locally and remotely, the next section covers containers for reproducible environments.