Field Reference

SSH Cheatsheet

July 27, 2026

SSH command cheatsheet

Every SSH incantation from the Toolbox post, in one place — connect, authenticate with keys, copy files, tunnel, and lock the server down. Client commands run on your machine; the hardening block is server-side.

Connect

Command	What it does
`ssh user@host`	open a shell on a remote machine
`ssh -p 2222 user@host`	connect on a non-standard port
`ssh web01`	connect using a `~/.ssh/config` alias
`ssh -v user@host`	verbose — show why a connection is failing
`exit` / `Ctrl-D`	close the session

Keys

Command	What it does
`ssh-keygen -t ed25519 -C "you@laptop"`	make a new key pair
`ssh-copy-id user@host`	install your public key on a server
`ssh-add ~/.ssh/id_ed25519`	load the key into the agent (passphrase once)
`cat ~/.ssh/id_ed25519.pub`	show your public key
`chmod 600 ~/.ssh/id_ed25519`	fix “permissions too open” errors

Copy files

Command	What it does
`scp file user@host:/path/`	copy a local file up
`scp user@host:/path/file .`	copy a remote file down
`scp -r dir user@host:/path/`	copy a directory (recursive)
`sftp user@host`	interactive file transfer

Tunnels & jumps

Command	What it does
`ssh -L 8080:localhost:80 host`	forward remote `:80` to your local `:8080`
`ssh -D 1080 host`	a quick SOCKS proxy through the host
`ssh -J bastion host`	hop through a jump host to a private box

Your `~/.ssh/config`

Host web01
    HostName 203.0.113.10
    User mitch
    Port 22
    IdentityFile ~/.ssh/id_ed25519

Host db01
    HostName 10.0.0.5
    User mitch
    ProxyJump web01      # reach db01 by hopping through web01

Define it once, then just ssh web01 (tab-completion works on the names).

Server hardening (`/etc/ssh/sshd_config`)

Directive	Effect
`PasswordAuthentication no`	keys only — no password guessing
`PermitRootLogin no`	no direct root login (sudo up instead)
`AllowUsers mitch`	only listed users may connect
`Port 2222`	move off the default (a speed bump, not a lock)
`sudo systemctl restart ssh`	apply changes (keep a session open to test!)

Warning

Before disabling password auth, confirm your key logs you in and keep your current session open while you test a second one. Lock yourself out of a remote box and the only way back may be a data-centre console ticket.

When it won’t behave

Command	What it does
`ssh -v user@host`	verbose output — the first debugging step
`ssh-keygen -R host`	forget a changed host key (after a genuine rebuild)
`ssh-add -l`	list keys currently loaded in the agent

Pairs with the Toolbox post SSH and the Endless Connectivity.