s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

ssh

Log in to another system over an encrypted connection, run remote commands, and make secure tunnels.

Level
RHCSA exam
Group
SSH and remote work
Needs root
No
Package
openssh-clients

What it does

ssh (Secure Shell client) connects to the SSH server (sshd) of another system. Everything is encrypted: passwords, commands, output and files. You log in with a password or — better — with a key.

The first time you connect, ssh shows the server's host key fingerprint. When you accept it, it is stored in ~/.ssh/known_hosts; next time ssh checks that the server still has the same key, to stop man-in-the-middle attacks.

Your own settings per host (user, port, key, jump host) go in ~/.ssh/config; system-wide client settings in /etc/ssh/ssh_config and /etc/ssh/ssh_config.d/.

How to write it

ssh [OPTIONS] [USER@]HOST [COMMAND [ARGUMENTS]]
ssh [OPTIONS] ssh://[USER@]HOST[:PORT]

Options 43

Most used

Connection

-p port
Connect to this port (default 22).
-l user
The user to log in as (same as user@host).
-i file
Use this private key file.
-J destination
Jump through this host first (bastion / jump host).
-F file
Use this client configuration file.
-o option
Set any ssh_config option, like -o StrictHostKeyChecking=accept-new.
-4 / -6
Use only IPv4 / only IPv6.
-b address
Use this local address for the connection.
-B interface
Bind to the address of this interface.
-C
Compress all data (helps on slow links).
-c ciphers
Choose the encryption ciphers.
-m macs
Choose the MAC (integrity) algorithms.
-E file
Write debug logs to a file instead of stderr.
-v, -vv, -vvv
Verbose debug output (more v = more detail).
-q
Quiet: hide most warnings.
-V
Show the version.
-G
Print the final configuration for this host and exit.
-Q query
List supported algorithms, like -Q cipher or -Q key.
-P tag
A tag to select Match blocks in the config.

Commands and terminal

-t
Force a terminal (needed to run interactive programs like top or sudo remotely).
-T
Do not allocate a terminal.
-n
Read stdin from /dev/null (for use in background jobs).
-N
Do not run a command (only for port forwarding).
-f
Go to the background after login (with -N for tunnels).
-s
Ask for a subsystem (like sftp) instead of a command.
-e char
The escape character (default ~). ~. ends a hanging session.

Forwarding and tunnels

-L [<addr>:]port:host:hostport
Local forward: a local port goes to host:hostport through the server.
-R [<addr>:]port:host:hostport
Remote forward: a port on the server goes back to host:hostport on your side.
-D [<addr>:]port
Dynamic forward: a local SOCKS proxy through the server.
-W host:port
Forward stdin/stdout to host:port (used in ProxyCommand).
-w local_tun[:<remote_tun>]
Make a tunnel device (layer 3 VPN).
-g
Let other hosts connect to your local forwarded ports.
-A
Forward your ssh-agent to the server (only to servers you trust).
-a
Do not forward the agent.
-X
Forward X11 (show remote graphical programs on your screen).
-Y
Trusted X11 forwarding (fewer security checks).
-x
Do not forward X11.

Connection sharing and others

-M
Master mode for connection sharing (ControlMaster).
-S path
The control socket for connection sharing.
-O cmd
Control a master connection: check, forward, cancel, exit, stop.
-K / -k
Enable / disable GSSAPI (Kerberos) authentication and delegation.
-I pkcs11
Use a PKCS#11 library (smart card) for keys.
-y
Send log messages to syslog.

Examples 14

$ run as a normal user# run as root (or with sudo)

  1. 1Log in to a server

    ssh student@server2

    Type exit (or Ctrl+D) to leave.

  2. 2Run one command on a remote server

    ssh server2 'df -h / && uptime'

    SSH runs it and ends. Quote the command so your local shell does not change it.

  3. 3Use another port

    ssh -p 2222 admin@bastion.example.com

    Many teams move SSH away from port 22 to reduce noise in the logs.

  4. 4Use a specific key

    ssh -i ~/.ssh/deploy_ed25519 deploy@app01

    Good when you have one key per project or environment.

  5. 5Jump through a bastion host

    ssh -J admin@bastion.example.com admin@10.10.0.15

    Reach a server in a private network in one step. The bastion only forwards the connection.

  6. 6Debug a login problem

    ssh -v student@server2

    Shows which keys are tried and why the server refuses them.

  7. 7Open a local tunnel to a database

    ssh -N -L 5433:db.internal:5432 admin@bastion.example.com

    Then connect your tool to localhost:5433. The database port is never open to the internet.

  8. 8Make a SOCKS proxy for your browser

    ssh -N -D 1080 admin@bastion.example.com

    Set the browser to SOCKS5 localhost:1080 to reach internal web tools.

  9. 9Run an interactive command remotely

    ssh -t server2 'sudo journalctl -f'

    -t gives a terminal, so sudo can ask for a password and you can stop with Ctrl+C.

  10. 10Accept a new host key automatically, but never a changed one

    ssh -o StrictHostKeyChecking=accept-new ansible@web03 true

    Good for first contact in automation. A changed key still stops the connection.

  11. 11Start a graphical program from the server

    ssh -X student@server1 gnome-system-monitor

    The window opens on your desktop.

  12. 12Copy a file through a pipe

    cat id_ed25519.pub | ssh server2 'cat >> ~/.ssh/authorized_keys'

    What ssh-copy-id does for you (ssh-copy-id also fixes permissions).

  13. 13Check the final settings for a host

    ssh -G server2 | grep -Ei '^(user|port|identityfile|proxyjump) '

    Shows what ssh will really use after reading all config files.

  14. 14Close a frozen session

    ssh student@server2
(press Enter, then type ~.)

    The escape sequence ends the session when the network is gone.

Watch out

  • A "host key changed" warning can be an attack. Verify with the server owner before ssh-keygen -R host.
  • Agent forwarding (-A) lets the remote root use your keys while you are logged in. Use -J instead where you can.
  • Keep private keys private: permissions 600, a passphrase on keys for people.

Files

~/.ssh/config
Your settings per host (Host, HostName, User, Port, IdentityFile, ProxyJump).
~/.ssh/known_hosts
The host keys of servers you trust.
~/.ssh/id_ed25519, ~/.ssh/id_rsa
Your private keys (default names).
/etc/ssh/ssh_config, /etc/ssh/ssh_config.d/
Client settings for all users.

Tips to remember

  • ssh user@host 'command' = remote command. -p port, -i key, -J jump, -L tunnel, -v debug.
  • Put repeated options in ~/.ssh/config and type only ssh name.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man ssh

Open the man page (linux.die.net)man.openbsd.org