SSH and OpenSSH Configuration Mastery Cheat Sheet

Updated 2026-05-21

Next Topic: Starship and Oh My Posh Cross-Shell Prompts Cheat Sheet

SSH (Secure Shell) is the universal protocol for encrypted remote access, file transfer, and network tunneling across Linux, macOS, BSD, and Windows systems. It replaced insecure tools like telnet and rsh in the 1990s and remains the backbone of every DevOps, cloud, and system administration workflow in 2026. A key insight practitioners often miss: SSH keys authenticate only during the initial handshake — the actual session traffic is encrypted with ephemeral symmetric keys derived via Diffie-Hellman, meaning compromising a session key does not expose your identity key.

What This Cheat Sheet Covers

This topic spans 16 focused tables and 160 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: SSH Client Basic Usage and Essential FlagsTable 2: ssh-keygen — Key Generation and ManagementTable 3: ~/.ssh/config — Client Configuration FileTable 4: SSH Key Distribution and the ssh-agentTable 5: ProxyJump and Bastion HostsTable 6: SSH Multiplexing (ControlMaster)Table 7: SSH Port Forwarding (Tunnels)Table 8: X11 Forwarding and GUI AppsTable 9: SCP, SFTP, rsync, and sshfs — File TransfersTable 10: sshd_config — Server HardeningTable 11: SSH Match Blocks and Conditional ConfigurationTable 12: SSH Certificates with Certificate Authority (CA)Table 13: Brute-Force Protection — MaxStartups, Fail2Ban, and Rate LimitingTable 14: SSH Escape SequencesTable 15: Mosh — SSH Alternative for Poor ConnectionsTable 16: Common SSH Troubleshooting

Table 1: SSH Client Basic Usage and Essential Flags

The ssh command connects you to remote machines, runs commands, and opens tunnels — all from a single binary. Mastering its flags eliminates the need for GUI SSH clients in almost every scenario.

Command	Example	Description
ssh user@host	`ssh alice@server.example.com`	• Connect to a remote host as the specified user • prompts for password or uses key auth
-p port	`ssh -p 2222 alice@server.example.com`	Connect to a non-default port (default is 22).
-i identity_file	`ssh -i ~/.ssh/id_ed25519 alice@host`	Specify a private key file to use for authentication.
-l login_name	`ssh -l alice server.example.com`	Specify remote username (alternative to `user@host` syntax).
remote command execution	`ssh alice@host 'ls /var/log'`	Execute a command on the remote host without opening an interactive shell.
-v / -vv / -vvv (verbose)	`ssh -vvv alice@host`	• Increase verbosity for debugging connection issues • `-vvv` gives maximum detail
-A (agent forwarding)	`ssh -A alice@bastion`	• Forward the local `ssh-agent` to the remote host • allows hopping further without copying keys. Use sparingly — anyone with root on the remote host can abuse the forwarded agent socket
-N (no command)	`ssh -N -L 8080:localhost:80 alice@host`	• Do not execute a remote command • useful when only tunneling is needed

Table 1: SSH Client Basic Usage and Essential Flags

The ssh command connects you to remote machines, runs commands, and opens tunnels — all from a single binary. Mastering its flags eliminates the need for GUI SSH clients in almost every scenario.

Command	Example	Description
ssh user@host	`ssh alice@server.example.com`	• Connect to a remote host as the specified user • prompts for password or uses key auth
-p port	`ssh -p 2222 alice@server.example.com`	Connect to a non-default port (default is 22).
-i identity_file	`ssh -i ~/.ssh/id_ed25519 alice@host`	Specify a private key file to use for authentication.
-l login_name	`ssh -l alice server.example.com`	Specify remote username (alternative to `user@host` syntax).
remote command execution	`ssh alice@host 'ls /var/log'`	Execute a command on the remote host without opening an interactive shell.
-v / -vv / -vvv (verbose)	`ssh -vvv alice@host`	• Increase verbosity for debugging connection issues • `-vvv` gives maximum detail
-A (agent forwarding)	`ssh -A alice@bastion`	• Forward the local `ssh-agent` to the remote host • allows hopping further without copying keys. Use sparingly — anyone with root on the remote host can abuse the forwarded agent socket
-N (no command)	`ssh -N -L 8080:localhost:80 alice@host`	• Do not execute a remote command • useful when only tunneling is needed