Back to All Cheatsheet Libraries cheatsheets

SSH

Connection, key, and tunneling command reference, ~/.ssh/config setup, and a server-hardening checklist.

Total Commands: 0
Category Command Description
Connectssh user@hostOpens a shell session on a remote host.
Connectssh -p 2222 user@hostConnects on a non-default port.
Connectssh -i ~/.ssh/id_ed25519 user@hostConnects using a specific private key rather than the default identity.
Keysssh-keygen -t ed25519 -C "email@example.com"Generates a new Ed25519 keypair — the modern recommended default over RSA.
Keysssh-copy-id user@hostCopies the local public key to the remote host's authorized_keys.
Transferscp file.txt user@host:/path/Copies a local file to a remote host over SSH.
Transferrsync -avz ./dir/ user@host:/path/Syncs a directory over SSH, transferring only changed files.
Tunnelingssh -L 8080:localhost:80 user@hostLocal port forward — makes a remote service reachable at localhost:8080.
Tunnelingssh -D 1080 user@hostOpens a SOCKS proxy through the SSH connection.
Automationssh-agent bash -c 'ssh-add; ssh host'Loads a key into ssh-agent so it's not re-entered on every connection in the session.
Debuggingssh -v user@hostVerbose output showing exactly how the connection/auth negotiation is failing.

~/.ssh/config

A per-host alias file — turns a long connection command into a short, memorable one.

A typical host entry

Reduces `ssh -i ~/.ssh/prod_key -p 2222 deploy@203.0.113.5` to just `ssh prod`.

Host prod HostName 203.0.113.5 User deploy Port 2222 IdentityFile ~/.ssh/prod_key ServerAliveInterval 60

Key File Reference

File Purpose
~/.ssh/id_ed25519The private key — never shared, never committed to a repo.
~/.ssh/id_ed25519.pubThe public key — safe to share, this is what gets added to a server's authorized_keys.
~/.ssh/authorized_keysOn the server: public keys allowed to log in as that user.
~/.ssh/known_hostsFingerprints of servers previously connected to — how SSH detects a changed/spoofed host key.

Hardening a Server's SSH Access

The baseline changes worth making on any internet-facing server.

1

Set up key-based login before disabling passwords

ssh-copy-id the key and confirm it logs in successfully — verify first, since a mistake here can lock you out entirely.

2

Disable password authentication

PasswordAuthentication no in /etc/ssh/sshd_config — removes the entire class of brute-force password attacks.

3

Disable root login

PermitRootLogin no — log in as a regular user and use sudo, so every login is attributable to a specific account.

4

Consider a non-default port

Not real security by itself, but cuts down drastically on noise from automated scanners hammering port 22.

Quick Tips

Keep a second session open while changing SSH config
Never close the only connected session while editing sshd_config — verify the new config works in a second window before logging out of the first.
ServerAliveInterval prevents idle disconnects
Some networks/firewalls silently drop idle connections — a periodic keepalive packet in ~/.ssh/config keeps a long session from dying mid-task.
A changed host key warning is not always an attack
Reinstalling a server's OS also changes its host key — but always verify out-of-band (a fingerprint check) before blindly clearing known_hosts.