SSH Cheatsheet - SSH Connection & Configuration Command Reference
Essential SSH commands organized by Login & Auth, Key Management, Config File, and Port Forwarding. Reference directly for passwordless login and tunneling.
Back to SysOpsConnection & Auth 5
ssh user@hostLogin on default port 22, omits user for current username
ssh -p 2222 user@hostSpecify port when server uses non-default port
ssh -i ~/.ssh/id_ed25519 user@hostSpecify private key, common with multiple keys
ssh -vvv user@hostVerbose debug output for troubleshooting auth failures
ssh -o ConnectTimeout=5 user@hostSet connection timeout to prevent hanging
Key Management 5
ssh-keygen -t ed25519 -C "tom@example.com"Generate ed25519 key, shorter and faster than RSA
ssh-keygen -t rsa -b 4096 -C "tom@example.com"Generate RSA 4096-bit key, compatible with older servers
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@hostCopy public key to server for passwordless login
ssh-keygen -lf ~/.ssh/id_ed25519.pubView key fingerprint and length, verify server host key
eval $(ssh-agent) && ssh-add ~/.ssh/id_ed25519Start agent and load private key, avoid repeated passwords
Config File ~/.ssh/config 6
Host prodDefine host alias, then ssh prod connects directly
HostName 1.2.3.4Actual IP or domain to connect to
User deployDefault login user, saves typing user@host each time
IdentityFile ~/.ssh/id_ed25519Specify private key for this host
ProxyJump bastionConnect through a jump host, replaces ssh -t ssh -t multi-hop
LocalForward 8080 127.0.0.1:80Auto-setup local port forwarding on login
Port Forwarding & Proxy 5
ssh -L 8080:127.0.0.1:80 user@hostLocal port forwarding, access local:8080 = remote:80
ssh -R 9090:127.0.0.1:80 user@hostRemote port forwarding, expose local service remotely
ssh -D 1080 user@hostDynamic SOCKS5 proxy, all traffic goes through remote
ssh -N -L 8080:127.0.0.1:80 user@hostForward only, no command execution, for background tunnels
ssh -J bastion user@internalDirect connection through jump host, equivalent to ProxyJump
💡 Tips
- Use ssh-copy-id for passwordless login — manually editing authorized_keys is error-prone with permissions and format.
- ~/.ssh directory must be 700, private keys must be 600 — SSH refuses keys with loose permissions.
- Add -N -f to run port forwarding in the background, but remember to stop with ssh -O exit or kill to avoid lingering processes.