SSH Cheatsheet

SSH (Secure Shell) is a cryptographic network protocol for operating network services securely over an unsecured network.

Installation

SSH client is pre-installed on most systems. The server must be installed separately.

# Debian / Ubuntu
sudo apt install openssh-client       # Client only (usually pre-installed)
sudo apt install openssh-server       # Server (to accept incoming SSH connections)
 
# RHEL / CentOS / Fedora
sudo dnf install openssh-clients
sudo dnf install openssh-server
 
# Arch Linux
sudo pacman -S openssh
 
# Enable and start the SSH server
sudo systemctl enable --now sshd

Basic Connection

ssh user@hostname                      # Connect to a host
ssh -p 2222 user@hostname              # Connect using a specific port
ssh -i ~/.ssh/id_ed25519 user@host     # Connect using a specific private key

SSH Key Management

Using SSH keys is more secure and convenient than passwords.

# Generate a new SSH key (Ed25519 — currently recommended)
ssh-keygen -t ed25519 -C "[email protected]"
 
# Generate a legacy RSA key (use 4096 bits minimum)
ssh-keygen -t rsa -b 4096 -C "[email protected]"
 
# Copy your public key to a remote server (enables passwordless login)
ssh-copy-id user@hostname
 
# Copy public key using a custom port
ssh-copy-id -p 2222 user@hostname

SSH Agent

The SSH agent caches your decrypted private keys so you don't have to type the passphrase for every connection.

# Start the SSH agent
eval "$(ssh-agent -s)"
 
# Add your key to the agent
ssh-add ~/.ssh/id_ed25519
 
# List keys currently held by the agent
ssh-add -l
 
# Remove all keys from the agent
ssh-add -D

Tunneling and Port Forwarding

# Local Port Forwarding
# Forwards local port 8080 to port 80 on the remote host
# Use case: access a remote web server on your local machine
ssh -L 8080:localhost:80 user@hostname
 
# Remote Port Forwarding
# Makes your local port 3000 accessible on the remote server's port 8080
# Use case: expose a local dev server to the internet via a VPS
ssh -R 8080:localhost:3000 user@hostname
 
# Dynamic Port Forwarding (SOCKS5 Proxy)
# Use case: route web browser traffic through the SSH server
ssh -D 9090 -C -N user@hostname
# -C = compress data, -N = no remote command (just tunnel)

SSH ProxyJump (Bastion Host)

Connect through an intermediate (jump) server.

# Jump through a bastion host to reach an internal server
ssh -J [email protected] [email protected]
 
# Equivalent config in ~/.ssh/config:
# Host internal
#     HostName 10.0.0.5
#     User internaluser
#     ProxyJump [email protected]

SCP (Secure Copy)

# Copy a local file to a remote server
scp file.txt user@hostname:/remote/path/
 
# Copy a remote file to local machine
scp user@hostname:/remote/file.txt ./local/path/
 
# Copy a directory recursively
scp -r ./local-dir user@hostname:/remote/path/
 
# Use a specific port
scp -P 2222 file.txt user@hostname:/remote/path/

SFTP (Secure File Transfer Protocol)

# Start an interactive SFTP session
sftp user@hostname
 
# Common SFTP commands inside the session:
# ls              — List remote files
# lls             — List local files
# cd /remote/dir  — Change remote directory
# lcd /local/dir  — Change local directory
# get file.txt    — Download a file
# put file.txt    — Upload a file
# exit            — Close the session

SSH Config File (`~/.ssh/config`)

Save host configurations to avoid typing long commands.

Host myserver
    HostName 198.51.100.1
    User admin
    Port 2222
    IdentityFile ~/.ssh/id_ed25519
 
Host staging
    HostName staging.example.com
    User deploy
    ProxyJump [email protected]

Now you can connect with just:

ssh myserver
ssh staging

Hardening SSH Server (`/etc/ssh/sshd_config`)

Edit /etc/ssh/sshd_config and restart sshd to apply.

Port 2222                              # Change default port
PermitRootLogin no                     # Disable root login
PasswordAuthentication no              # Disable password login (requires keys)
PubkeyAuthentication yes               # Enable public key authentication
MaxAuthTries 3                         # Limit authentication attempts
AllowUsers admin deploy                # Allow only specific users

# Restart sshd after changes
sudo systemctl restart sshd

Cheatsheets