Rongzhou at 08:02, 30 September 2026

2026-09-30T08:02:31Z

SeedBot: Remove stray MCP-footer line (Wiki: wikibase.ronzz.org)

2026-09-29T20:42:36Z

Remove stray MCP-footer line (Wiki: wikibase.ronzz.org)

← Older revision		Revision as of 20:42, 29 September 2026
Line 234:		Line 234:
	* [https://tldr.sh tldr] — community-maintained short examples		* [https://tldr.sh tldr] — community-maintained short examples
	* [https://explainshell.com explainshell.com] — annotate any command line		* [https://explainshell.com explainshell.com] — annotate any command line

	~~Wiki: wikibase.ronzz.org~~

	[[Category:LinuxCLI]]		[[Category:LinuxCLI]]

SeedBot: Add Category:LinuxCLI (LinuxCLI backfill) (via update-page on MediaWiki MCP Server)

2026-09-29T20:40:14Z

Add Category:LinuxCLI (LinuxCLI backfill) (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 20:40, 29 September 2026
Line 236:		Line 236:

	Wiki: wikibase.ronzz.org		Wiki: wikibase.ronzz.org

			[[Category:LinuxCLI]]

RonzzWikiCowriterAI: Remove stray placeholder line in the Agent section. AI-assisted (RonzzWikiCowriter) (via update-page on MediaWiki MCP Server)

2026-09-29T15:10:38Z

Remove stray placeholder line in the Agent section. AI-assisted (RonzzWikiCowriter) (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 15:10, 29 September 2026
Line 197:		Line 197:
	<syntaxhighlight lang="bash" copy>		<syntaxhighlight lang="bash" copy>
	ssh -A user@host # forward the agent to the server		ssh -A user@host # forward the agent to the server
	~~ssh -c user@host # hmm~~
	ssh-add -c ~/.ssh/id_ed25519 # ...or make every use of a key prompt for confirmation		ssh-add -c ~/.ssh/id_ed25519 # ...or make every use of a key prompt for confirmation
	</syntaxhighlight>		</syntaxhighlight>

RonzzWikiCowriterAI: Create ssh cheatsheet: connecting, keys, ~/.ssh/config, file copying, port forwarding, agent, troubleshooting. AI-assisted (RonzzWikiCowriter) (via create-page on MediaWiki MCP Server)

2026-09-29T15:09:50Z

Create ssh cheatsheet: connecting, keys, ~/.ssh/config, file copying, port forwarding, agent, troubleshooting. AI-assisted (RonzzWikiCowriter) (via create-page on MediaWiki MCP Server)

New page

{{DesktopLinux}}

The everyday OpenSSH client: log into a remote machine, run one-off commands, copy files, and tunnel ports over an encrypted channel. Everything here is typed on your local Linux machine; the remote side only needs a running <syntaxhighlight lang="bash" inline>sshd</syntaxhighlight>.

New to SSH? Every command has a built-in manual — try <syntaxhighlight lang="bash" inline>man ssh</syntaxhighlight>, <syntaxhighlight lang="bash" inline>man ssh_config</syntaxhighlight> or [https://tldr.sh tldr ssh] for short examples.

== Basic example: set up key login ==

<syntaxhighlight lang="bash" copy>
ssh user@host # first connection: type the password
ssh-keygen -t ed25519 -C "user@laptop" # create ~/.ssh/id_ed25519 and its .pub
ssh-copy-id user@host # install the public half on the server
ssh user@host # no password from now on
</syntaxhighlight>

The private key never leaves your machine; the server only stores the public half, one key per line, in <syntaxhighlight lang="text" inline>~/.ssh/authorized_keys</syntaxhighlight>.

== Connecting ==

<syntaxhighlight lang="bash" copy>
ssh host # same username as your local one
ssh user@host # log in as another user
ssh -p 2222 user@host # non-standard port
ssh user@host uptime # run one command instead of a shell
ssh user@host 'df -h; free -h' # several commands: quote them for the remote shell
ssh -t user@host tmux attach # -t: force a TTY, for interactive programs
ssh -J bastion user@host # jump through bastion (ProxyJump)
ssh -J user@bastion:2222 user@host # jump host with its own user and port
ssh -o ProxyCommand="ssh -W %h:%p bastion" user@host # same, on OpenSSH < 7.3
ssh -v user@host # debug the connection; -vv and -vvv go further
</syntaxhighlight>

{| class="wikitable"
! Flag !! Effect
|-
| <syntaxhighlight lang="bash" inline>-p port</syntaxhighlight> || connect to a port other than 22
|-
| <syntaxhighlight lang="bash" inline>-i key</syntaxhighlight> || authenticate with a specific private key
|-
| <syntaxhighlight lang="bash" inline>-t</syntaxhighlight> / <syntaxhighlight lang="bash" inline>-T</syntaxhighlight> || force / disable pseudo-terminal allocation
|-
| <syntaxhighlight lang="bash" inline>-N</syntaxhighlight> || no remote command: forward ports only
|-
| <syntaxhighlight lang="bash" inline>-f</syntaxhighlight> || go to the background just before running the command
|-
| <syntaxhighlight lang="bash" inline>-J host</syntaxhighlight> || connect via a jump host; comma-separated for several
|-
| <syntaxhighlight lang="bash" inline>-L</syntaxhighlight> / <syntaxhighlight lang="bash" inline>-R</syntaxhighlight> / <syntaxhighlight lang="bash" inline>-D</syntaxhighlight> || port forwarding (see below)
|-
| <syntaxhighlight lang="bash" inline>-A</syntaxhighlight> || forward your local ssh-agent to the server (see the caution below)
|-
| <syntaxhighlight lang="bash" inline>-o OPT=value</syntaxhighlight> || set any ssh_config option on the command line
|}

Escape sequences are recognised only at the start of a line, inside an interactive session:

{| class="wikitable"
! Escape !! Action
|-
| <syntaxhighlight lang="text" inline>~.</syntaxhighlight> || disconnect
|-
| <syntaxhighlight lang="text" inline>~^Z</syntaxhighlight> || suspend ssh, back to the local shell
|-
| <syntaxhighlight lang="text" inline>~#</syntaxhighlight> || list the forwarded connections
|-
| <syntaxhighlight lang="text" inline>~C</syntaxhighlight> || command line: add <syntaxhighlight lang="bash" inline>-L</syntaxhighlight>, <syntaxhighlight lang="bash" inline>-R</syntaxhighlight> or <syntaxhighlight lang="bash" inline>-D</syntaxhighlight> to the live session
|-
| <syntaxhighlight lang="text" inline>~?</syntaxhighlight> || list all escapes
|}

== Keys ==

<syntaxhighlight lang="bash" copy>
ssh-keygen -t ed25519 # new key in ~/.ssh/id_ed25519 (+ .pub)
ssh-keygen -t ed25519 -f ~/.ssh/id_work -C "deploy@laptop" # a named key, with a comment
ssh-keygen -t rsa -b 4096 # RSA, when a server is too old for ed25519
ssh-keygen -p -f ~/.ssh/id_ed25519 # change the passphrase
ssh-keygen -y -f ~/.ssh/id_ed25519 # print the public half of a private key
ssh-keygen -l -f ~/.ssh/id_ed25519.pub # fingerprint of a key
ssh-keygen -R host # forget a host's key in known_hosts
ssh-copy-id user@host # install the default key on a server
ssh-copy-id -i ~/.ssh/id_work.pub user@host # install one specific key
ssh -i ~/.ssh/id_work user@host # use a key without touching any config
</syntaxhighlight>

<blockquote>
'''Permissions are enforced:''' <syntaxhighlight lang="bash" inline>ssh</syntaxhighlight> silently ignores a private key that anyone else can read. Keep <syntaxhighlight lang="text" inline>~/.ssh</syntaxhighlight> at <syntaxhighlight lang="text" inline>700</syntaxhighlight> and private keys at <syntaxhighlight lang="text" inline>600</syntaxhighlight> (<syntaxhighlight lang="bash" inline>chmod 600 ~/.ssh/id_ed25519</syntaxhighlight>). Protect the key with a passphrase and load it into an [[#Agent|agent]] rather than leaving it unencrypted.
</blockquote>

== ~/.ssh/config ==

The place to turn a long command line into a name you can type.

<syntaxhighlight lang="text" copy>
Host web # `ssh web` connects as deploy@203.0.113.10 on port 2222
HostName 203.0.113.10
User deploy
Port 2222
IdentityFile ~/.ssh/id_work

Host *.internal.example.com
ProxyJump bastion

Host legacy
HostKeyAlgorithms +ssh-rsa # for old servers only
PubkeyAcceptedAlgorithms +ssh-rsa

Host * # global defaults: keep this block LAST
ServerAliveInterval 30 # ping every 30 s, so idle NAT and firewall sessions survive
ServerAliveCountMax 3
AddKeysToAgent yes # load a key into the agent on first use
ControlMaster auto # reuse one TCP connection for every later session
ControlPath ~/.ssh/cm/%C
ControlPersist 10m
</syntaxhighlight>

<syntaxhighlight lang="bash" copy>
mkdir -p ~/.ssh/cm # ControlPath does not create the directory
ssh -G web # print the configuration and options actually used
ssh -F ~/.ssh/otherconf host # use an alternative config file
ssh -o StrictHostKeyChecking=accept-new host # accept an unknown host key once
ssh -O check host # is a shared connection open?
ssh -O exit host # close it, and every session using it
</syntaxhighlight>

<blockquote>
'''For each option, the first value found wins.''' Put the specific <syntaxhighlight lang="text" inline>Host</syntaxhighlight> blocks at the top of the file and the catch-all <syntaxhighlight lang="text" inline>Host *</syntaxhighlight> at the bottom, or the defaults will shadow the specifics. <syntaxhighlight lang="text" inline>IdentityFile</syntaxhighlight> is the exception: every entry is tried in order.
</blockquote>

<blockquote>
'''Connection sharing''' (the <syntaxhighlight lang="text" inline>ControlMaster</syntaxhighlight> block) makes the second and later connections to a host start instantly, because they reuse the first, already-authenticated one; later <syntaxhighlight lang="bash" inline>scp</syntaxhighlight>, <syntaxhighlight lang="bash" inline>rsync</syntaxhighlight> and <syntaxhighlight lang="bash" inline>git</syntaxhighlight> calls to that host skip the handshake too.
</blockquote>

== Copying files ==

<syntaxhighlight lang="bash" copy>
scp file1.txt user@host:/tmp/ # upload
scp user@host:/tmp/file1.txt . # download to the current directory
scp -r dir/ user@host:/tmp/ # a whole directory
scp -P 2222 file1.txt user@host:/tmp/ # note: -P (capital) is scp's port flag
scp 'user@host:/var/log/*.log' . # quote the remote glob
rsync -avz --progress dir/ user@host:/tmp/ # only what changed, resumable
sftp user@host # interactive: ls, get, put, bye
</syntaxhighlight>

<blockquote>
'''<syntaxhighlight lang="bash" inline>scp</syntaxhighlight> has spoken SFTP since OpenSSH 9.0''', and it reads the same <syntaxhighlight lang="text" inline>~/.ssh/config</syntaxhighlight> blocks: <syntaxhighlight lang="bash" inline>scp web:file1.txt .</syntaxhighlight> works once <syntaxhighlight lang="text" inline>Host web</syntaxhighlight> exists. For large or repeated transfers prefer <syntaxhighlight lang="bash" inline>rsync</syntaxhighlight>, which transfers only the differences and can resume — it must be installed on both machines.
</blockquote>

== Port forwarding ==

<syntaxhighlight lang="bash" copy>
ssh -L 8080:localhost:80 user@host # local 8080 → port 80, as seen from the server
ssh -L 5432:db.internal:5432 user@host # reach a host only the server can reach
ssh -R 9000:localhost:3000 user@host # the server's 9000 → your local 3000
ssh -D 1080 user@host # SOCKS5 proxy on localhost:1080
ssh -N -f -L 8080:localhost:80 user@host # tunnel only, in the background
ssh -O exit user@host # close the backgrounded tunnel
</syntaxhighlight>

{| class="wikitable"
! Flag !! Listens on !! Traffic goes to
|-
| <syntaxhighlight lang="bash" inline>-L 8080:host:80</syntaxhighlight> || your machine, port 8080 || <syntaxhighlight lang="text" inline>host</syntaxhighlight>, as resolved from the server
|-
| <syntaxhighlight lang="bash" inline>-R 9000:host:3000</syntaxhighlight> || the server, port 9000 || <syntaxhighlight lang="text" inline>host</syntaxhighlight>, as resolved from your machine
|-
| <syntaxhighlight lang="bash" inline>-D 1080</syntaxhighlight> || your machine, port 1080 || whatever the SOCKS client asks for
|}

The same forwardings in config, for a tunnel you start by name:

<syntaxhighlight lang="text" copy>
Host dbtunnel
HostName db.example.com
LocalForward 5432 localhost:5432 # 5432 as seen from the server
SessionType none # no shell, just the tunnel (OpenSSH 8.4+)
</syntaxhighlight>

<blockquote>
'''<syntaxhighlight lang="bash" inline>-L</syntaxhighlight> listens on your machine, <syntaxhighlight lang="bash" inline>-R</syntaxhighlight> on the server's.''' Both bind to loopback by default, so only that machine can reach the port — exposing it to a network needs an explicit bind address (<syntaxhighlight lang="bash" inline>-L 0.0.0.0:8080:localhost:80</syntaxhighlight>), and ports below 1024 require root.
</blockquote>

== Agent ==

<syntaxhighlight lang="bash" copy>
eval "$(ssh-agent -s)" # start an agent in this shell
ssh-add ~/.ssh/id_ed25519 # load a key; asks for the passphrase once
ssh-add -t 8h ~/.ssh/id_ed25519 # ... dropping it again after 8 hours
ssh-add -l # fingerprints of the loaded keys
ssh-add -L # full public keys
ssh-add -d ~/.ssh/id_ed25519 # remove one key
ssh-add -D # remove every key
ssh-agent -k # kill this agent
</syntaxhighlight>

<syntaxhighlight lang="bash" copy>
ssh -A user@host # forward the agent to the server
ssh -c user@host # hmm
ssh-add -c ~/.ssh/id_ed25519 # ...or make every use of a key prompt for confirmation
</syntaxhighlight>

<blockquote>
'''Avoid <syntaxhighlight lang="bash" inline>ssh -A</syntaxhighlight> on hosts you do not fully trust:''' anyone able to read the agent socket there (root, mostly) can authenticate as you for as long as the session lasts, without ever seeing the key. Prefer <syntaxhighlight lang="bash" inline>-J</syntaxhighlight> (ProxyJump), where authentication stays end-to-end. <syntaxhighlight lang="text" inline>AddKeysToAgent yes</syntaxhighlight> in <syntaxhighlight lang="text" inline>~/.ssh/config</syntaxhighlight> loads keys into the agent on first use.
</blockquote>

== Troubleshooting ==

{| class="wikitable"
! Symptom !! Fix
|-
| <syntaxhighlight lang="text" inline>Permission denied (publickey)</syntaxhighlight> || the key is not installed: <syntaxhighlight lang="bash" inline>ssh-copy-id user@host</syntaxhighlight>; check <syntaxhighlight lang="bash" inline>chmod 600 ~/.ssh/id_ed25519</syntaxhighlight>; <syntaxhighlight lang="bash" inline>ssh -v</syntaxhighlight> lists the keys the client offers
|-
| <syntaxhighlight lang="text" inline>Too many authentication failures</syntaxhighlight> || the agent offers more keys than the server allows attempts: add <syntaxhighlight lang="text" inline>IdentitiesOnly yes</syntaxhighlight> to that host's block
|-
| <syntaxhighlight lang="text" inline>REMOTE HOST IDENTIFICATION HAS CHANGED!</syntaxhighlight> || the server's key really did change — confirm with its admin before running <syntaxhighlight lang="bash" inline>ssh-keygen -R host</syntaxhighlight>
|-
| <syntaxhighlight lang="text" inline>Connection refused</syntaxhighlight> || wrong port, <syntaxhighlight lang="bash" inline>sshd</syntaxhighlight> down, or a firewall: test with <syntaxhighlight lang="bash" inline>nc -vz host 22</syntaxhighlight>
|-
| <syntaxhighlight lang="text" inline>Connection timed out</syntaxhighlight> || nothing answers at all: a firewall is dropping the packets, or the host is unreachable
|-
| the session freezes after an idle spell || <syntaxhighlight lang="text" inline>ServerAliveInterval 30</syntaxhighlight> in the config file
|-
| which key, which options, which file? || <syntaxhighlight lang="bash" inline>ssh -G host</syntaxhighlight> prints the effective configuration, <syntaxhighlight lang="bash" inline>ssh -vvv host</syntaxhighlight> everything the client tries
|}

== For more ==

* <syntaxhighlight lang="bash" inline>man ssh</syntaxhighlight>, <syntaxhighlight lang="bash" inline>man ssh_config</syntaxhighlight>, <syntaxhighlight lang="bash" inline>man ssh-keygen</syntaxhighlight>, <syntaxhighlight lang="bash" inline>man sshd_config</syntaxhighlight> — the built-in manuals, always installed
* [https://www.man7.org/linux/man-pages/man1/ssh.1.html ssh(1)] — every client flag, escape sequence and environment variable
* [https://www.man7.org/linux/man-pages/man5/ssh_config.5.html ssh_config(5)] — every client option, including the forwarding and multiplexing ones
* [https://www.man7.org/linux/man-pages/man1/ssh-keygen.1.html ssh-keygen(1)] — certificates, FIDO keys, key format conversion
* [https://www.man7.org/linux/man-pages/man5/sshd_config.5.html sshd_config(5)] — the server side: <syntaxhighlight lang="text" inline>authorized_keys</syntaxhighlight>, <syntaxhighlight lang="text" inline>PermitRootLogin</syntaxhighlight>, <syntaxhighlight lang="text" inline>PasswordAuthentication</syntaxhighlight>
* [https://www.openssh.com/ OpenSSH] — release notes and security advisories
* [https://tldr.sh tldr] — community-maintained short examples
* [https://explainshell.com explainshell.com] — annotate any command line

Wiki: wikibase.ronzz.org

Cheatsheets:LinuxCLI/ssh - Revision history

Rongzhou at 08:02, 30 September 2026

SeedBot: Remove stray MCP-footer line (Wiki: wikibase.ronzz.org)

SeedBot: Add Category:LinuxCLI (LinuxCLI backfill) (via update-page on MediaWiki MCP Server)

RonzzWikiCowriterAI: Remove stray placeholder line in the Agent section. AI-assisted (RonzzWikiCowriter) (via update-page on MediaWiki MCP Server)

RonzzWikiCowriterAI: Create ssh cheatsheet: connecting, keys, ~/.ssh/config, file copying, port forwarding, agent, troubleshooting. AI-assisted (RonzzWikiCowriter) (via create-page on MediaWiki MCP Server)