SSH and OpenSSH Configuration Mastery Cheat Sheet

Updated 2026-05-21

Next Topic: Starship and Oh My Posh Cross-Shell Prompts Cheat Sheet

🧠Study flashcards on this topic127 cards · spaced repetition→

SSH (Secure Shell) is the universal protocol for encrypted remote access, file transfer, and network tunneling across Linux, macOS, BSD, and Windows systems. It replaced insecure tools like telnet and rsh in the 1990s and remains the backbone of every DevOps, cloud, and system administration workflow in 2026. A key insight practitioners often miss: SSH keys authenticate only during the initial handshake — the actual session traffic is encrypted with ephemeral symmetric keys derived via Diffie-Hellman, meaning compromising a session key does not expose your identity key.

What This Cheat Sheet Covers

This topic spans 16 focused tables and 160 indexed concepts, 127 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: SSH Client Basic Usage and Essential FlagsTable 2: ssh-keygen — Key Generation and ManagementTable 3: ~/.ssh/config — Client Configuration FileTable 4: SSH Key Distribution and the ssh-agentTable 5: ProxyJump and Bastion HostsTable 6: SSH Multiplexing (ControlMaster)Table 7: SSH Port Forwarding (Tunnels)Table 8: X11 Forwarding and GUI AppsTable 9: SCP, SFTP, rsync, and sshfs — File TransfersTable 10: sshd_config — Server HardeningTable 11: SSH Match Blocks and Conditional ConfigurationTable 12: SSH Certificates with Certificate Authority (CA)Table 13: Brute-Force Protection — MaxStartups, Fail2Ban, and Rate LimitingTable 14: SSH Escape SequencesTable 15: Mosh — SSH Alternative for Poor ConnectionsTable 16: Common SSH Troubleshooting

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: SSH Client Basic Usage and Essential Flags

The ssh command connects you to remote machines, runs commands, and opens tunnels — all from a single binary. Mastering its flags eliminates the need for GUI SSH clients in almost every scenario.

Command	Example	Description
ssh user@host	`ssh alice@server.example.com`	• Connect to a remote host as the specified user • prompts for password or uses key auth
-p port	`ssh -p 2222 alice@server.example.com`	Connect to a non-default port (default is 22).
-i identity_file	`ssh -i ~/.ssh/id_ed25519 alice@host`	Specify a private key file to use for authentication.
-l login_name	`ssh -l alice server.example.com`	Specify remote username (alternative to `user@host` syntax).
remote command execution	`ssh alice@host 'ls /var/log'`	Execute a command on the remote host without opening an interactive shell.
-v / -vv / -vvv (verbose)	`ssh -vvv alice@host`	• Increase verbosity for debugging connection issues • `-vvv` gives maximum detail
-A (agent forwarding)	`ssh -A alice@bastion`	• Forward the local `ssh-agent` to the remote host • allows hopping further without copying keys. Use sparingly — anyone with root on the remote host can abuse the forwarded agent socket
-N (no command)	`ssh -N -L 8080:localhost:80 alice@host`	• Do not execute a remote command • useful when only tunneling is needed
-f (background)	`ssh -f -N -L 5432:db:5432 alice@host`	• Fork into the background after authentication • typically paired with `-N`.
-C (compression)	`ssh -C alice@slow-link.example.com`	• Enable gzip compression • helps on slow or high-latency links
-q (quiet)	`ssh -q alice@host 'df -h'`	• Suppress warnings and diagnostic messages • useful in scripts
-o option	`ssh -o StrictHostKeyChecking=no alice@host`	Pass any `ssh_config` keyword inline without editing the config file.
-G (print config)	`ssh -G myalias`	• Print the effective configuration for a host after merging all config files • invaluable for debugging
-4 / -6 (address family)	`ssh -4 alice@host`	Force IPv4 (`-4`) or IPv6 (`-6`) connections.
-W host:port (stdio forward)	`ssh -W internal:22 alice@bastion`	• Forward stdin/stdout to `host:port` on the server • used internally by ProxyJump

Table 2: ssh-keygen — Key Generation and Management

Key generation is the foundation of passwordless SSH. Choosing the right algorithm, size, and passphrase policy here determines security for the lifetime of the key. Ed25519 is the recommended algorithm for new keys in 2025/2026.

Command	Example	Description
-t ed25519 (Ed25519 key)	`ssh-keygen -t ed25519 -C "alice@work"`	• Generate an Ed25519 key • fastest, most secure, shortest keys — recommended for all new keys in 2025+.

The rest of this section is part of the full cheat sheet

Table 3: ~/.ssh/config — Client Configuration File

The ~/.ssh/config file lets you define persistent per-host settings, aliases, and defaults so you can connect with a short name instead of long command-line flags. It's read by all OpenSSH client tools including scp, sftp, and rsync.

Setting	Example	Description
Host alias	`Host prod` `HostName 203.0.113.10` `User deploy`	Define a named alias so `ssh prod` connects without specifying the full hostname or user.

The rest of this section is part of the full cheat sheet

Table 4: SSH Key Distribution and the ssh-agent

Getting keys onto servers and into the agent correctly is where most setup problems occur. Proper file permissions and passphrase handling are essential — sshd refuses to read authorized_keys if the file or parent directory is world-writable.

Tool/Concept	Example	Description
ssh-copy-id	`ssh-copy-id -i ~/.ssh/id_ed25519.pub alice@host`	• Appends the public key to `~/.ssh/authorized_keys` on the remote host • creates `.ssh/` and sets correct permissions automatically

The rest of this section is part of the full cheat sheet

Table 1: SSH Client Basic Usage and Essential Flags

The ssh command connects you to remote machines, runs commands, and opens tunnels — all from a single binary. Mastering its flags eliminates the need for GUI SSH clients in almost every scenario.

Command	Example	Description
ssh user@host	`ssh alice@server.example.com`	• Connect to a remote host as the specified user • prompts for password or uses key auth
-p port	`ssh -p 2222 alice@server.example.com`	Connect to a non-default port (default is 22).
-i identity_file	`ssh -i ~/.ssh/id_ed25519 alice@host`	Specify a private key file to use for authentication.
-l login_name	`ssh -l alice server.example.com`	Specify remote username (alternative to `user@host` syntax).
remote command execution	`ssh alice@host 'ls /var/log'`	Execute a command on the remote host without opening an interactive shell.
-v / -vv / -vvv (verbose)	`ssh -vvv alice@host`	• Increase verbosity for debugging connection issues • `-vvv` gives maximum detail
-A (agent forwarding)	`ssh -A alice@bastion`	• Forward the local `ssh-agent` to the remote host • allows hopping further without copying keys. Use sparingly — anyone with root on the remote host can abuse the forwarded agent socket
-N (no command)	`ssh -N -L 8080:localhost:80 alice@host`	• Do not execute a remote command • useful when only tunneling is needed
-f (background)	`ssh -f -N -L 5432:db:5432 alice@host`	• Fork into the background after authentication • typically paired with `-N`.
-C (compression)	`ssh -C alice@slow-link.example.com`	• Enable gzip compression • helps on slow or high-latency links
-q (quiet)	`ssh -q alice@host 'df -h'`	• Suppress warnings and diagnostic messages • useful in scripts
-o option	`ssh -o StrictHostKeyChecking=no alice@host`	Pass any `ssh_config` keyword inline without editing the config file.
-G (print config)	`ssh -G myalias`	• Print the effective configuration for a host after merging all config files • invaluable for debugging
-4 / -6 (address family)	`ssh -4 alice@host`	Force IPv4 (`-4`) or IPv6 (`-6`) connections.
-W host:port (stdio forward)	`ssh -W internal:22 alice@bastion`	• Forward stdin/stdout to `host:port` on the server • used internally by ProxyJump

Table 2: ssh-keygen — Key Generation and Management

Command	Example	Description
-t ed25519 (Ed25519 key)	`ssh-keygen -t ed25519 -C "alice@work"`	• Generate an Ed25519 key • fastest, most secure, shortest keys — recommended for all new keys in 2025+.

Table 3: ~/.ssh/config — Client Configuration File

Setting	Example	Description
Host alias	`Host prod` `HostName 203.0.113.10` `User deploy`	Define a named alias so `ssh prod` connects without specifying the full hostname or user.

Table 4: SSH Key Distribution and the ssh-agent

Tool/Concept	Example	Description
ssh-copy-id	`ssh-copy-id -i ~/.ssh/id_ed25519.pub alice@host`	• Appends the public key to `~/.ssh/authorized_keys` on the remote host • creates `.ssh/` and sets correct permissions automatically