SSH Deep Dive Cheat Sheet
Advanced SSH usage covering key-based auth, config file shortcuts, port forwarding, and agent forwarding for secure remote access.
2 PagesAdvancedFeb 8, 2026
Key-Based Authentication
Generate and deploy SSH keys.
bash
ssh-keygen -t ed25519 -C "[email protected]" # Generate a modern keypairssh-copy-id user@host # Copy public key to remote authorized_keysssh-add ~/.ssh/id_ed25519 # Add key to running ssh-agentssh-add -l # List keys loaded in agent
~/.ssh/config
Define per-host shortcuts and connection options.
bash
Host prod HostName 203.0.113.10 User deploy Port 2222 IdentityFile ~/.ssh/id_ed25519_prod ForwardAgent yesHost jump HostName bastion.example.com User opsHost internal HostName 10.0.0.5 ProxyJump jump
Port Forwarding
Tunnel traffic through an SSH connection.
bash
# Local forward: access remote:5432 via localhost:5432ssh -L 5432:localhost:5432 user@dbhost# Remote forward: expose local:3000 on the remote host's port 8080ssh -R 8080:localhost:3000 user@remotehost# Dynamic forward (SOCKS proxy) on localhost:1080ssh -D 1080 user@host
Key Flags & Commands
Frequently used SSH client options.
- -i <file>- Use a specific private key instead of the default
- -J user@jump- Connect through a jump/bastion host (ProxyJump shorthand)
- -N- Do not execute a remote command; useful with -L/-D for tunnel-only sessions
- -v / -vv / -vvv- Increasing verbosity for debugging connection/auth failures
- scp -r- Recursively copy a directory over SSH (legacy; consider rsync -e ssh)
- rsync -avz -e ssh- Efficient incremental file sync over SSH
SSH Certificates (CA-Signed Keys)
Sign user/host keys with a CA to avoid distributing and trusting raw public keys.
bash
# On the CA host: generate a signing key oncessh-keygen -t ed25519 -f ca_user_key -C "ssh-user-ca"# Sign a user's public key, valid 8 hours, restricted principalsssh-keygen -s ca_user_key -I "alice-session" \ -n alice,deploy -V +8h id_ed25519.pub# Produces id_ed25519-cert.pub# On each server, trust the CA instead of individual keysecho "cert-authority $(cat ca_user_key.pub)" >> /etc/ssh/ca_trusted_user_keys# sshd_config: TrustedUserCAKeys /etc/ssh/ca_trusted_user_keysssh-keygen -Lf id_ed25519-cert.pub # Inspect a certificate's principals/validity
Connection Multiplexing (ControlMaster)
Reuse one TCP/auth handshake for many subsequent SSH sessions to the same host.
bash
# ~/.ssh/configHost * ControlMaster auto ControlPath ~/.ssh/sockets/%r@%h-%p ControlPersist 10m# First connection creates the master; later ones reuse it instantlyssh user@host # slow: full handshakessh user@host # fast: multiplexed, no re-authssh -O check user@host # Query whether a control master is activessh -O exit user@host # Tear down the shared connection
sshd_config Hardening
Server-side settings that meaningfully reduce SSH attack surface.
bash
# /etc/ssh/sshd_configPermitRootLogin noPasswordAuthentication noKbdInteractiveAuthentication noPubkeyAuthentication yesAuthenticationMethods publickeyMaxAuthTries 3LoginGraceTime 20AllowUsers deploy opsAllowTcpForwarding local # disable arbitrary remote/dynamic tunnelsX11Forwarding noClientAliveInterval 300ClientAliveCountMax 2# Apply and validate before restartingsshd -t && systemctl restart sshd
known_hosts Pinning & Multi-Hop Jumps
Verify host keys out-of-band and chain through several bastions in one command.
bash
# Fetch and pin a host key fingerprint before first connectssh-keyscan -t ed25519 host.example.com >> ~/.ssh/known_hostsssh-keygen -lf ~/.ssh/known_hosts # Verify fingerprint out-of-band (e.g. against provider console)# Chain through two bastions to reach an internal hostssh -J bastion1.example.com,bastion2.internal [email protected]# Equivalent using ~/.ssh/config ProxyJump chaining# Host target# ProxyJump bastion1,bastion2# HostName 10.0.5.20
Advanced Flags & Escape Sequences
Lesser-known client behaviors for scripting and troubleshooting.
- ~.- Escape sequence typed at the start of a line to forcibly terminate a hung SSH session
- ~#- List forwarded connections active on the current session
- -o StrictHostKeyChecking=accept-new- Auto-trust new hosts but still reject changed keys, safer than 'no' for automation
- -o ExitOnForwardFailure=yes- Abort immediately if a requested port forward can't be bound, useful in scripts
- ssh -G host- Print the fully resolved config for a host alias without connecting
- ssh -T- Disable pseudo-terminal allocation, needed for git-over-ssh and piping commands
- IdentitiesOnly yes- Restrict auth to keys explicitly listed in IdentityFile, avoiding agent key exhaustion
Pro Tip
Disable ForwardAgent except on hosts you fully trust — a compromised jump host with agent forwarding enabled can hijack your agent to authenticate as you on any downstream server.
Was this cheat sheet helpful?
Explore Topics
#SSHDeepDive#SSHDeepDiveCheatSheet#DevOps#Advanced#KeyBasedAuthentication#SshConfig#PortForwarding#KeyFlagsCommands#CheatSheet#SkillVeris
