Back to All Cheatsheet Libraries
cheatsheets
Connection, key, and tunneling command reference, ~/.ssh/config setup, and a server-hardening checklist.
Total Commands: 0
| Category | Command | Description |
|---|---|---|
| Connect | ssh user@host | Opens a shell session on a remote host. |
| Connect | ssh -p 2222 user@host | Connects on a non-default port. |
| Connect | ssh -i ~/.ssh/id_ed25519 user@host | Connects using a specific private key rather than the default identity. |
| Keys | ssh-keygen -t ed25519 -C "email@example.com" | Generates a new Ed25519 keypair — the modern recommended default over RSA. |
| Keys | ssh-copy-id user@host | Copies the local public key to the remote host's authorized_keys. |
| Transfer | scp file.txt user@host:/path/ | Copies a local file to a remote host over SSH. |
| Transfer | rsync -avz ./dir/ user@host:/path/ | Syncs a directory over SSH, transferring only changed files. |
| Tunneling | ssh -L 8080:localhost:80 user@host | Local port forward — makes a remote service reachable at localhost:8080. |
| Tunneling | ssh -D 1080 user@host | Opens a SOCKS proxy through the SSH connection. |
| Automation | ssh-agent bash -c 'ssh-add; ssh host' | Loads a key into ssh-agent so it's not re-entered on every connection in the session. |
| Debugging | ssh -v user@host | Verbose output showing exactly how the connection/auth negotiation is failing. |
~/.ssh/config
A per-host alias file — turns a long connection command into a short, memorable one.
Host prod
HostName 203.0.113.5
User deploy
Port 2222
IdentityFile ~/.ssh/prod_key
ServerAliveInterval 60
Key File Reference
| File | Purpose |
|---|---|
~/.ssh/id_ed25519 | The private key — never shared, never committed to a repo. |
~/.ssh/id_ed25519.pub | The public key — safe to share, this is what gets added to a server's authorized_keys. |
~/.ssh/authorized_keys | On the server: public keys allowed to log in as that user. |
~/.ssh/known_hosts | Fingerprints of servers previously connected to — how SSH detects a changed/spoofed host key. |
1
Set up key-based login before disabling passwords
ssh-copy-id the key and confirm it logs in successfully — verify first, since a mistake here can lock you out entirely.
2
Disable password authentication
PasswordAuthentication no in /etc/ssh/sshd_config — removes the entire class of brute-force password attacks.
3
Disable root login
PermitRootLogin no — log in as a regular user and use sudo, so every login is attributable to a specific account.
4
Consider a non-default port
Not real security by itself, but cuts down drastically on noise from automated scanners hammering port 22.
Quick Tips
Keep a second session open while changing SSH config
Never close the only connected session while editing sshd_config — verify the new config works in a second window before logging out of the first.
ServerAliveInterval prevents idle disconnects
Some networks/firewalls silently drop idle connections — a periodic keepalive packet in ~/.ssh/config keeps a long session from dying mid-task.
A changed host key warning is not always an attack
Reinstalling a server's OS also changes its host key — but always verify out-of-band (a fingerprint check) before blindly clearing known_hosts.