Code & computing / QUICK REFERENCE

SSH essentials

Connect safely, inspect client configuration, use keys and create tightly scoped local forwards.

24 entries

Connect and diagnose

Connect as a user: ssh alice@example.invalid
Verifies the host key against known_hosts. [1]
Choose a port: ssh -p 2222 alice@example.invalid
SSH uses lowercase -p for the port. [1]
Select a private key: ssh -i ~/.ssh/id_ed25519 alice@example.invalid
The private key must remain confidential. [1]
Offer only configured identities: ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 alice@example.invalid
Helps avoid an agent offering unrelated keys. [1]
Print effective configuration: ssh -G example.invalid
Shows resolved client options without connecting. [1]
Verbose diagnostics: ssh -v alice@example.invalid
Redact hostnames and identifying details before sharing. [1]
Bound connection establishment: ssh -o ConnectTimeout=10 alice@example.invalid
Does not limit the entire session lifetime. [1]
Noninteractive authentication: ssh -o BatchMode=yes alice@example.invalid
Fails instead of prompting for a password/passphrase. [1]

Generate an Ed25519 key: ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_atlas
Creates new files; choose a passphrase and do not overwrite an existing key. [3][1]
Public-key fingerprint: ssh-keygen -lf ~/.ssh/id_ed25519_atlas.pub
Compare fingerprints over a trusted channel. [3][1]
Known-host entry lookup: ssh-keygen -F example.invalid
Reads matching known_hosts entries. [3][1]
Load a key into the agent: ssh-add ~/.ssh/id_ed25519_atlas
Requires a running authorized agent. [4][1]
List loaded fingerprints: ssh-add -l
Lists agent identities without private key contents. [4][1]
Load with a time limit: ssh-add -t 1h ~/.ssh/id_ed25519_atlas
Removes the identity from the agent when its lifetime expires. [4][1]
Load with confirmation: ssh-add -c ~/.ssh/id_ed25519_atlas
Requires confirmation for agent use when the environment supports it. [4][1]
Show OpenSSH version: ssh -V
Version information is written to stderr. [3][1]

Named host config: Host atlas-dev HostName example.invalid User alice Port 2222
Put trusted entries in ~/.ssh/config. [2][1]
Connect using an alias: ssh atlas-dev
Uses the named configuration block. [2][1]
Local loopback forward: ssh -N -L 127.0.0.1:8080:127.0.0.1:80 alice@example.invalid
Exposes remote port 80 only on your local loopback port 8080. [2][1]
Fail when forwarding cannot bind: ssh -N -o ExitOnForwardFailure=yes -L 127.0.0.1:8080:127.0.0.1:80 alice@example.invalid
Detects initial tunnel setup failure, not later remote-service health. [2][1]
Client keepalive interval: ssh -o ServerAliveInterval=30 alice@example.invalid
Sends encrypted keepalive messages after inactivity. [2][1]
Bound missed keepalives: ssh -o ServerAliveInterval=30 -o ServerAliveCountMax=3 alice@example.invalid
Disconnects after repeated unanswered checks. [2][1]
Jump through a bastion: ssh -J alice@bastion.example.invalid alice@host.example.invalid
Requires authorization for both hops. [2][1]
Keep agent forwarding off: ssh -o ForwardAgent=no alice@example.invalid
Avoids exposing your local agent through this connection. [2][1]

Reserved placement, separate from reference controls. No ad network is active.

Updated 2026-10-19OpenSSH client · POSIX shell examples

cheatsheetatlas.com/sheets/ssh/ · Updated 2026-10-19 · OpenSSH client · POSIX shell examples