SSH Deep Dive Cheat Sheet

Advanced SSH usage covering key-based auth, config file shortcuts, port forwarding, and agent forwarding for secure remote access.

2 PagesAdvancedFeb 8, 2026

Key-Based Authentication

Generate and deploy SSH keys.

bash

ssh-keygen -t ed25519 -C "you@example.com"   # Generate a modern keypairssh-copy-id user@host                         # Copy public key to remote authorized_keysssh-add ~/.ssh/id_ed25519                     # Add key to running ssh-agentssh-add -l                                    # List keys loaded in agent

~/.ssh/config

Define per-host shortcuts and connection options.

bash

Host prod    HostName 203.0.113.10    User deploy    Port 2222    IdentityFile ~/.ssh/id_ed25519_prod    ForwardAgent yesHost jump    HostName bastion.example.com    User opsHost internal    HostName 10.0.0.5    ProxyJump jump

Port Forwarding

Tunnel traffic through an SSH connection.

bash

# Local forward: access remote:5432 via localhost:5432ssh -L 5432:localhost:5432 user@dbhost# Remote forward: expose local:3000 on the remote host's port 8080ssh -R 8080:localhost:3000 user@remotehost# Dynamic forward (SOCKS proxy) on localhost:1080ssh -D 1080 user@host

Key Flags & Commands

Frequently used SSH client options.

-i <file>- Use a specific private key instead of the default
-J user@jump- Connect through a jump/bastion host (ProxyJump shorthand)
-N- Do not execute a remote command; useful with -L/-D for tunnel-only sessions
-v / -vv / -vvv- Increasing verbosity for debugging connection/auth failures
scp -r- Recursively copy a directory over SSH (legacy; consider rsync -e ssh)
rsync -avz -e ssh- Efficient incremental file sync over SSH

Pro Tip

Disable ForwardAgent except on hosts you fully trust — a compromised jump host with agent forwarding enabled can hijack your agent to authenticate as you on any downstream server.

Was this cheat sheet helpful?

HAProxy Cheat Sheet

Cron Jobs Cheat Sheet