SSH Cheatsheet - SSH Connection & Configuration Command Reference

Check three things in order. On the server, run sshd -T | grep authorizedkeysfile to confirm the authorized keys path actually matches where you dropped the file — some distros expect .ssh/authorized_keys2 or a different home. Then verify ownership and permissions: .ssh must be 700 and authorized_keys 600, and sshd silently ignores keys that are group- or world-readable. Finally run ssh -vvv user@host on the client and look for an "Offering public key" line. If it never appears, the client never picked up the private key — usually the agent has no key loaded, or IdentityFile in ~/.ssh/config points at the wrong path.

Almost always it is indentation. Keywords such as Host, HostName, User and IdentityFile must start at column zero — no leading spaces or tabs — while their values may be indented. Second, ssh uses the first matching Host block, so wildcard aliases have to sit above specific hosts or they will never be reached. Verify with ssh -G alias, which prints the fully resolved configuration, instead of repeatedly attempting connections.

It depends on whether the destination is known. ssh -L 8080:127.0.0.1:80 is local forwarding with a fixed target — ideal for reaching one known remote service, here mapping remote port 80 to local 8080. ssh -D 1080 is dynamic forwarding: it opens a SOCKS5 proxy and the client picks the destination per request, which suits browsing multiple remote sites or temporarily routing all egress through the far end. Adding -N to either turns it into a pure tunnel with no command execution, which is how you run it in the background.

Run ssh -vvv and read the last few lines before the drop. If it stops at kex_exchange_identification, the session never reached authentication — usually sshd is down, the port is firewalled, or MaxStartups is rate-limiting you. If it disconnects immediately after auth succeeds, the remote user shell is probably exiting with a non-zero status from a startup script, or a LocalCommand failed. Two targeted probes help: force IPv4 with -o AddressFamily=inet in case name resolution returns an unreachable AAAA record, and add -o ServerAliveInterval=15 to rule out idle timeouts.

Use ed25519 for anything new — keys are shorter, handshakes are faster, and modern OpenSSH (7.2+) supports it everywhere. RSA 4096 is worth keeping for two cases: legacy appliances or embedded devices that only speak RSA, and old clients that predate ed25519 support. Be aware that RSA below 3072 bits is rejected outright by the newer default policies shipped with several distros, so if you go RSA, go 4096. When both key types exist, the client tries ed25519 first; use IdentityFile inside a Host block in ~/.ssh/config to pin a specific key.