SSH Cheatsheet - SSH Connection & Configuration Command Reference

For developers and ops who want passwordless login, hop through bastion hosts into the internal network, or map a remote port to localhost for debugging. The value of SSH lies in reusing keys and config: pin frequently used Hosts, jump hosts, and port forwards into ~/.ssh/config instead of retyping long argument sets each time. By the end you can generate and correctly permission a key pair for passwordless login, hop through bastions with ProxyJump, and expose a remote service on localhost with -L for debugging.

SysOps·21 commands·Last updated 2026-07-21

Connection & Auth 5

ssh user@host

ssh -p 2222 user@host

Specify port when server uses non-default port

ssh -i ~/.ssh/id_ed25519 user@host

Specify private key, common with multiple keys

ssh -vvv user@host

Verbose debug output for troubleshooting auth failures

ssh -o ConnectTimeout=5 user@host

Set connection timeout to prevent hanging

Key Management 5

ssh-keygen -t ed25519 -C "tom@example.com"

Generate ed25519 key, shorter and faster than RSA

ssh-keygen -t rsa -b 4096 -C "tom@example.com"

Generate RSA 4096-bit key, compatible with older servers

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host

Copy public key to server for passwordless login

ssh-keygen -lf ~/.ssh/id_ed25519.pub

View key fingerprint and length, verify server host key

eval $(ssh-agent) && ssh-add ~/.ssh/id_ed25519

Start agent and load private key, avoid repeated passwords

Config File ~/.ssh/config 6

Host prod

Define host alias, then ssh prod connects directly

HostName 1.2.3.4

Actual IP or domain to connect to

User deploy

Default login user, saves typing user@host each time

IdentityFile ~/.ssh/id_ed25519

Specify private key for this host

ProxyJump bastion

Connect through a jump host, replaces ssh -t ssh -t multi-hop

LocalForward 8080 127.0.0.1:80

Auto-setup local port forwarding on login

Port Forwarding & Proxy 5

ssh -L 8080:127.0.0.1:80 user@host

Local port forwarding, access local:8080 = remote:80

ssh -R 9090:127.0.0.1:80 user@host

Remote port forwarding, expose local service remotely

ssh -D 1080 user@host

Dynamic SOCKS5 proxy, all traffic goes through remote

ssh -N -L 8080:127.0.0.1:80 user@host

Forward only, no command execution, for background tunnels

ssh -J bastion user@internal

Direct connection through jump host, equivalent to ProxyJump

Tips

Use ssh-copy-id for passwordless login — manually editing authorized_keys is error-prone with permissions and format.
~/.ssh directory must be 700, private keys must be 600 — SSH refuses keys with loose permissions.
Add -N -f to run port forwarding in the background, but remember to stop with ssh -O exit or kill to avoid lingering processes.

Official References

Each command links to its official documentation below, so you can verify the latest usage and read deeper.

Linux man-pages

Maintained by LaoHand

Publicly updated on Jul 21, 2026, continuously proofread against official docs.

Contact Us

Wrong command or description? Send us corrections, business inquiries or product feedback by email.