glunty

SSH Command Cheat Sheet

A searchable reference of common SSH commands and what each one does.

Command What it does
ssh user@host Open an interactive shell on the remote host, logging in as the given user.
ssh host Connect using your local username as the remote username.
ssh -p 2222 user@host Connect to a host that listens on a non-default port, here 2222.
ssh -i ~/.ssh/key user@host Authenticate with a specific private key file instead of the default keys.
ssh -v user@host Show verbose debug output to diagnose connection or authentication problems.
ssh user@host "command" Run a single command on the remote host and then return to your local shell.
ssh -t user@host Force a pseudo-terminal, needed for remote programs that expect one such as top or sudo.
ssh -C user@host Enable compression, which can speed up transfers over slow links.
ssh -o ConnectTimeout=10 user@host Give up if the connection is not established within the given number of seconds.
ssh-keygen -t ed25519 Generate a modern Ed25519 key pair, the recommended default today.
ssh-keygen -t rsa -b 4096 Generate a 4096-bit RSA key pair for systems that do not support Ed25519.
ssh-keygen -C "you@example.com" Add a label comment to the key so you can identify it later.
ssh-keygen -f ~/.ssh/mykey Write the new key pair to a specific file name instead of the default.
ssh-keygen -p Change or add a passphrase on an existing private key.
ssh-copy-id user@host Install your public key into the remote authorized_keys so you can log in without a password.
ssh-add ~/.ssh/key Load a private key into the running SSH agent so you type the passphrase once.
ssh-add -l List the keys currently loaded in the SSH agent.
ssh-add -D Remove all identities from the SSH agent.
cat ~/.ssh/id_ed25519.pub Print your public key so you can copy it to a server or a hosting provider.
~/.ssh/config Per-user client configuration file where you define host aliases and default options.
Host myserver Begin a host block; myserver is the alias you type as ssh myserver.
HostName example.com The real hostname or IP address that the alias connects to.
User deploy Default username to log in as for this host block.
Port 2222 Default port to connect to for this host block.
IdentityFile ~/.ssh/id_ed25519 Private key file to use for this host block.
ServerAliveInterval 60 Send a keepalive packet every 60 seconds so idle sessions do not time out.
ForwardAgent yes Forward your local SSH agent so you can authenticate onward to further hosts.
ProxyJump bastion Route this connection through the named jump or bastion host.
Host * A catch-all block whose options apply to every host you connect to.
ssh -L 8080:localhost:80 user@host Local forward: send traffic from local port 8080 to port 80 on the remote side.
ssh -R 9090:localhost:3000 user@host Remote forward: expose your local port 3000 as port 9090 on the remote host.
ssh -D 1080 user@host Dynamic forward: run a local SOCKS proxy on port 1080 tunneled through the host.
ssh -N user@host Do not run a remote command, useful when you only want port forwarding.
ssh -f user@host Send SSH to the background just before it would run the command.
ssh -N -f -L 8080:localhost:80 user@host Open a background local tunnel with no remote shell.
ssh -J jump user@host Reach the target host by first jumping through the named intermediate host.
scp file.txt user@host:/path Copy a local file to a directory on the remote host over SSH.
scp -r dir user@host:/path Copy a directory and everything inside it recursively.
scp -P 2222 file.txt user@host:/path Copy over a non-default port; note that scp uses capital -P.
scp user@host:/file . Copy a file from the remote host down to your current directory.
rsync -avz src/ user@host:/dst Sync a directory to the remote host, preserving attributes and compressing in transit.
rsync -avz -e ssh src/ user@host:/dst Run the same sync while explicitly forcing SSH as the transport.
rsync -avz --dry-run src/ user@host:/dst Preview what would transfer without copying anything.
sftp user@host Open an interactive SFTP session to browse and move files.
~/.ssh/known_hosts File that records the host key fingerprints you have already accepted.
ssh-keyscan host Fetch a host public key so you can add it to known_hosts.
ssh-keygen -R host Remove a stored host key, for example after a server was rebuilt.
ssh -o StrictHostKeyChecking=no user@host Skip the unknown-host prompt; convenient in scripts but less safe on real servers.
eval "$(ssh-agent)" Start the SSH agent and load its environment variables into the current shell.
chmod 600 ~/.ssh/id_ed25519 Restrict a private key to owner read and write; SSH rejects keys that are too open.
chmod 700 ~/.ssh Restrict the .ssh directory so that only you can access it.
chmod 644 ~/.ssh/id_ed25519.pub Allow the public key to be world-readable, which is fine.
ssh -o BatchMode=yes user@host Fail instead of prompting for input, useful in scripts and cron jobs.
ssh -V Print the installed OpenSSH client version.

Runs entirely in your browser. Nothing you type is sent anywhere; open DevTools and watch the Network tab to verify zero requests.

What this tool does

This is a searchable quick reference for the SSH commands you reach for every day, from opening a session and running remote commands to generating keys, writing a client config, forwarding ports, and copying files. Each row pairs the exact command with a plain-English note on what it does. Type in the filter box to search across both columns, or tap a category button to focus on one task. The whole list is built into the page, so it works offline and sends nothing anywhere.

How to use it

Start typing in the Filter box. Entering keygen jumps to the key-generation commands; entering tunnel or -L surfaces the port-forwarding options; entering scp shows every way to copy files. The category buttons (Connect, Keys, Config, Tunnels, Transfer, Misc) narrow the table to one family and combine with the text filter, so you can pick Keys and type add to see just the agent commands. Clear the box to see the full sheet again.

Common use cases

  • Recalling the exact flags for a command you use rarely, like ssh -L 8080:localhost:80 user@host or rsync -avz.
  • Copying a safe command into your terminal instead of guessing at option letters like scp uppercase -P versus ssh lowercase -p.
  • Setting up passwordless login with ssh-keygen and ssh-copy-id.
  • Building a ~/.ssh/config host block so you can connect with a short alias.
  • Fixing key permissions with chmod 600 when SSH refuses to use a key.

Common pitfalls

  • Key file permissions too open. SSH ignores a private key that others can read. Run chmod 600 ~/.ssh/id_ed25519 and chmod 700 ~/.ssh so only you can access them.
  • Confusing the port flags. ssh uses a lowercase -p for the port, but scp uses an uppercase -P. Mixing them up is a frequent connection error.
  • Disabling host key checking blindly. Passing -o StrictHostKeyChecking=no skips the warning that protects you from connecting to an impostor server. Use it only for throwaway hosts, never for production.
  • Local versus remote forwarding. -L forwards a port from your machine to the remote side, while -R does the opposite. Reversing them means the tunnel points the wrong way and nothing connects.

Frequently asked questions

How do I generate an SSH key?
Run ssh-keygen -t ed25519 to create a modern key pair, or ssh-keygen -t rsa -b 4096 on older systems that do not support Ed25519. The command writes a private key (kept secret) and a matching .pub public key into your ~/.ssh directory. You can add -C "you@example.com" to label the key and set a passphrase when prompted so the private key is useless if it is stolen.
What does ssh-copy-id do?
ssh-copy-id user@host appends your public key to the remote authorized_keys file so the server recognizes your key on the next login. After it runs you can connect without typing the account password, because the server verifies your private key instead. It is the easy way to set up key-based login; behind the scenes it just copies your .pub file and fixes the file permissions.
How does the SSH config file help?
The ~/.ssh/config file lets you save per-host settings under a short alias so you do not repeat long commands. A Host block can set HostName, User, Port, IdentityFile, and options like ProxyJump or ServerAliveInterval. Once defined, ssh myalias applies all of those automatically, and tools like scp and rsync read the same file.
What is SSH port forwarding or a tunnel?
Port forwarding routes a network port through the encrypted SSH connection. A local forward (-L) sends a port on your machine to a service reachable from the remote host, a remote forward (-R) exposes one of your local ports on the server, and a dynamic forward (-D) runs a SOCKS proxy. Tunnels let you reach databases, internal web apps, or proxies securely without opening those ports to the internet.
What is the difference between scp and rsync?
scp does a straightforward copy of files or directories over SSH and is fine for one-off transfers. rsync also runs over SSH but compares source and destination first, so it only sends the parts that changed, which makes repeat syncs much faster. rsync also supports resuming, delete-on-sync, and a --dry-run preview, so it is the better choice for backups and deployments.
Does this cheat sheet send my searches or keys anywhere?
No. The entire command list is baked into the page and every search and category filter runs in your browser with JavaScript, so nothing you type leaves your device. The page never asks for your keys or connects to any server. Open your browser DevTools and watch the Network tab while you use it to confirm there are zero requests.

Embed this tool

Free for any use; attribution appreciated. Paste this on your site:

The embed runs the same tool that lives at this URL. No tracking; no ads inside the embed. Resize height as needed for your layout.

Cite this tool

For academic, journalistic, or technical references. Pick a format:

Citations use 2026 as the publication year. Access date is left as a fillable placeholder where the citation style expects one.

Embedded tool from glunty.com