SSH Cheat Sheet
SSH remote access and security: keys, config aliases, file transfer, forwarding, agents, host verification, and permissions.
SSH provides encrypted remote shells, command execution, tunneling, and file transfer over an authenticated connection. Prefer modern public-key authentication, verify host keys, and keep private keys readable only by their owner.
Connect and run commands
The basic form is ssh [options] [user@]host. Use -p when the server listens on a non-default port; the uppercase -P belongs to some other tools such as scp on certain platforms, not OpenSSH.
ssh user@example.com
ssh -p 2222 user@example.com
ssh user@example.com 'uname -a'
ssh -i ~/.ssh/id_ed25519 user@example.com
| Option | Purpose |
|---|---|
-p PORT | Connect to a server port. |
-i FILE | Select a private identity file. |
-v, -vv, -vvv | Increase connection diagnostics. |
-o NAME=VALUE | Set one configuration option inline. |
-T | Disable pseudo-terminal allocation. |
-N | Do not run a remote command; useful for tunnels. |
-C | Request compression. |
-4 / -6 | Prefer IPv4 or IPv6. |
Generate and use keys
Ed25519 is a strong default for new keys. RSA remains useful for compatibility; choose a sufficiently large key and protect either type with a passphrase.
ssh-keygen -t ed25519 -C 'user@example.com'
ssh-keygen -t rsa -b 4096 -C 'user@example.com'
ssh-keygen -lf ~/.ssh/id_ed25519.pub
Accept the suggested file path or choose a distinct name when rotating keys. The private key stays local; share only the .pub file. A passphrase limits damage if the private key file is copied.
Config aliases
~/.ssh/config turns repeated options into a named host alias. The Host pattern is local configuration; HostName is the actual DNS name or address.
Host staging
HostName staging.example.com
User deploy
Port 2222
IdentityFile ~/.ssh/id_ed25519
IdentitiesOnly yes
ServerAliveInterval 60
ssh staging
ssh -G staging | less
Use Include for organized configuration fragments. Do not put private key material or passwords in the config file.
Copy files and synchronize
scp copies individual files over SSH. rsync -e ssh is usually better for repeated directory synchronization because it transfers only changed data and can preserve metadata.
scp ./app.tar.gz user@example.com:/tmp/
scp user@example.com:/var/log/app.log ./
scp -r ./public user@example.com:/srv/site/
rsync -avz -e ssh ./public/ user@example.com:/srv/site/
rsync -avzn -e ssh ./public/ user@example.com:/srv/site/
The -n rsync dry run previews changes. A trailing slash changes whether the directory itself or only its contents are copied.
Forwarding and tunnels
Forwarding carries traffic through an SSH connection. Local forwarding (-L) exposes a remote service locally; remote forwarding (-R) exposes a local service from the remote side; dynamic forwarding (-D) creates a SOCKS proxy.
ssh -N -L 15432:db.internal:5432 bastion.example.com
ssh -N -R 9000:localhost:3000 user@example.com
ssh -N -D 1080 user@example.com
Use ExitOnForwardFailure yes when a tunnel must fail clearly if its listener cannot bind. Restrict forwarding on servers when users do not need it.
Agents, hosts, and access
ssh-agent caches decrypted keys for a session. ssh-add loads a private key into that agent; remove it when the work session ends. ssh-copy-id appends a public key to a remote account’s authorized_keys.
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
ssh-add -l
ssh-add -D
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@example.com
ssh-keygen -F example.com
ssh-keygen -R example.com
OpenSSH records host keys in ~/.ssh/known_hosts. StrictHostKeyChecking ask is a safer default than silently accepting changes; investigate a changed key rather than deleting it automatically.
Permissions and troubleshooting
The directory and key permissions commonly expected by OpenSSH are restrictive. Fix ownership and modes before debugging authentication.
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519 ~/.ssh/config
chmod 644 ~/.ssh/id_ed25519.pub ~/.ssh/known_hosts
ssh -vvv user@example.com
ssh -o PreferredAuthentications=publickey user@example.com
The server-side ~/.ssh directory should also be 700, and authorized_keys is commonly 600. Check the remote username, key path, server port, account shell, and server authentication logs when a connection fails.