SSH Cheatsheet

Connecting

Use this SSH reference while you build software engineering projects, review code for technical interview prep, or polish examples for a software engineer resume.

Basic Syntax

ssh [options] [user@]host [command]

user defaults to your local $USER. host can be an IP, hostname, or a name defined in ~/.ssh/config.

Common Flags

Flag	What it does	Example
`-p PORT`	Connect to non-default port	`ssh -p 2222 user@host`
`-i FILE`	Use this private key	`ssh -i ~/.ssh/deploy user@host`
`-l USER`	Remote username (alt to user@)	`ssh -l pablo host`
`-v / -vv / -vvv`	Verbose debug output	`ssh -v user@host`
`-q`	Quiet; suppress banners/warnings	`ssh -q user@host`
`-T`	Disable pseudo-terminal	`ssh -T git@github.com`
`-t`	Force pseudo-terminal (even for commands)	`ssh -t user@host sudo bash`
`-A`	Enable agent forwarding	`ssh -A user@bastion`
`-X`	Enable X11 forwarding	`ssh -X user@host xclock`
`-N`	No remote command (tunnel-only)	`ssh -N -L 8080:localhost:80 user@host`
`-f`	Background after auth	`ssh -fN -L ...`
`-4` / `-6`	Force IPv4 / IPv6	`ssh -4 user@host`
`-o OPT=VAL`	Pass any ssh_config option inline	`ssh -o StrictHostKeyChecking=no user@host`

Jump Hosts (ProxyJump)

# Single jump host
ssh -J user@bastion user@private-host

# Chained jumps
ssh -J user@bastion1,user@bastion2 user@target

# Via config (see config-file.md for the full block)
ssh target-via-bastion

Old syntax (-o ProxyCommand='ssh -W %h:%p bastion') still works but -J is cleaner.

Multiplexing (Reuse Connections)

After the first connection, subsequent ssh/scp/rsync commands reuse the existing socket — no re-auth.

# Start master connection in background
ssh -fNM -S /tmp/ssh-ctl-%h user@host

# Use the control socket
ssh -S /tmp/ssh-ctl-host user@host

# Check socket status
ssh -S /tmp/ssh-ctl-host -O check user@host

# Stop the master
ssh -S /tmp/ssh-ctl-host -O exit user@host

Or put it in ~/.ssh/config (recommended — see config-file.md).

First-Time Connection and Host Keys

# Accept the fingerprint interactively
ssh user@host
# The authenticity of host 'host' can't be established.
# SHA256:xxxx fingerprint. Are you sure you want to continue (yes/no)?

# Pre-scan and add host key non-interactively
ssh-keyscan -H host >> ~/.ssh/known_hosts

# Skip host key checking (DANGEROUS — only for throwaway hosts)
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null user@host

Removing a Stale Host Key

# Remove a specific host
ssh-keygen -R hostname
ssh-keygen -R 192.168.1.10

# Remove from a specific file
ssh-keygen -R hostname -f ~/.ssh/known_hosts

Testing Connectivity

# Just auth, no shell (Git style)
ssh -T git@github.com

# Print remote hostname and exit
ssh user@host hostname

# Time the connection
time ssh user@host exit

Keeping Connections Alive

# Client-side: send keepalive every 60 s, drop after 3 missed
ssh -o ServerAliveInterval=60 -o ServerAliveCountMax=3 user@host

Or in ~/.ssh/config:

Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3