SSH Cheat Sheet

Connections, keys, tunnels, and agent forwarding — the standard safe entry point to every server.

Networking5 sections · 33 commands

⌘K

Connecting

ssh user@host

Connect as a user

ssh -i KEY.pem user@host

Connect with a specific key

ssh -p 2222 user@host

Non-standard port

ssh user@host 'command'

Run a command and exit

ssh -o StrictHostKeyChecking=no user@host

Skip host-key prompt (test only)

ssh -vvv user@host

Debug connection verbosely

ssh -v user@host exit

Shorter verbose trace

Keys & Agent

ssh-keygen -t ed25519 -C 'you@example.com'

Modern key generation

ssh-keygen -t rsa -b 4096

RSA fallback for old systems

ssh-copy-id user@host

Install your public key

cat ~/.ssh/id_ed25519.pub

Print the public key

ssh-add ~/.ssh/id_ed25519

Add a key to the agent

ssh-add -l

Keys currently in the agent

ssh-keygen -p

Change a key passphrase

ssh-keygen -lf KEY.pub

Fingerprint for verification

Tunnels & Forwarding

ssh -L 8080:internal:80 user@host

Local forward (browse internal sites)

ssh -R 9000:localhost:3000 user@host

Remote forward (expose local)

ssh -D 1080 user@host

Dynamic SOCKS proxy

ssh -L 5432:db.internal:5432 tunnel@host

Tunnel into a database

ssh -A user@host

Forward the SSH agent

ssh -N -L 8080:internal:80 user@host

No shell, just the tunnel

ssh -o ProxyJump=bastion user@target

Jump through a bastion

~/.ssh/config

Host prod
  HostName 1.2.3.4
  User deploy
  IdentityFile ~/.ssh/prod

Named host shortcut with key

Host *.internal
  ProxyJump bastion

Route a group through a jump host

Host *
  ServerAliveInterval 60

Keep dead links from hanging

Host *
  AddKeysToAgent yes
  UseKeychain yes

Convenience for macOS

Host github.com
  HostName ssh.github.com
  Port 443

GitHub over port 443 (restricted net)

Hardening

PermitRootLogin no

Disable root logins

PasswordAuthentication no

Keys only

Port 2222

Move off default 22

MaxAuthTries 3

Limit auth attempts

AllowUsers alice bob

Only listed users may log in

sshd -t

Validate sshd config