Cheat sheets

Cheat sheet: SSH

Log in securely and transfer files with SSH, including keys and tunnels.

Connecting

Log in to a computer ssh user@host
Use a different port ssh -p 2222 user@host
Log in with a specific key ssh -i ~/.ssh/mykey user@host
Run one command and return ssh user@host "uptime"
Via a jump host ssh -J user@jumpserver user@destination
Verbose output for troubleshooting ssh -v user@host

Keys

Create a key pair ssh-keygen -t ed25519 -C "you@example.com"
Copy your key to the server ssh-copy-id user@host
Load a key into the agent ssh-add ~/.ssh/id_ed25519
Show the fingerprint of a key ssh-keygen -lf ~/.ssh/id_ed25519.pub
Remove an old host key (after reinstall) ssh-keygen -R host
Set correct permissions on your key folder chmod 700 ~/.ssh && chmod 600 ~/.ssh/id_ed25519

Transferring files

Copy a file to the server scp file user@host:/path/
Get a file from the server scp user@host:/path/file .
Copy a folder scp -r folder user@host:/path/
Synchronize with rsync rsync -avh --progress folder/ user@host:/path/folder/

Tunnels

Port 8080 here to port 80 on the server (local tunnel) ssh -L 8080:localhost:80 user@host
A port from the server here (reverse) ssh -R 9000:localhost:3000 user@host
A SOCKS proxy on port 1080 ssh -D 1080 user@host
Only a tunnel, no shell, in the background ssh -N -f -L 8080:localhost:80 user@host

Settings

Shorter names and defaults: edit nano ~/.ssh/config
Turn off password login on the server: in /etc/ssh/sshd_config PasswordAuthentication no
Reload the SSH service (Debian and Ubuntu) sudo systemctl reload ssh
Reload the SSH service (Fedora and RHEL) sudo systemctl reload sshd
Check the server configuration sudo sshd -t

Good to know

  • Example for ~/.ssh/config: Host nas / HostName 192.168.1.20 / User admin / IdentityFile ~/.ssh/id_ed25519 (each on its own line). After that ssh nas works.
  • Only turn off password login once you’re sure your key works, and keep a second session open to avoid locking yourself out.
  • A key is just as sensitive as a password: never share the file without .pub.

Sources and attribution

This overview is compiled in our own words. Commands and options change per version: when in doubt, check the official documentation.