SSH

Host bastion
  HostName bastion.example.com
  User alice
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes

Host db-*
  ProxyJump bastion
  User postgres
  ForwardAgent no

Host *
  AddKeysToAgent yes
  ServerAliveInterval 30
  ServerAliveCountMax 3
  ControlMaster auto
  ControlPath ~/.ssh/cm-%C
  ControlPersist 10m
  HashKnownHosts yes
  StrictHostKeyChecking accept-new

ssh -G host                       # every option that will apply, after Host/Match evaluation
ssh -o ProxyJump=none host        # override config for one command
ssh -F /dev/null host             # ignore all config files, useful to rule config out

Include ~/.ssh/config.d/*.conf          # per-project files; must sit above any Host * block that would win first

Match host *.internal.example !exec "nc -zw1 192.0.2.1 22"   # not on the office network: go via the bastion
  ProxyJump bastion

Match localnetwork 192.0.2.0/24          # OpenSSH 9.4+: match when a local interface has an address in this range
  ProxyJump none

Match user root
  IdentityFile ~/.ssh/id_root
  IdentitiesOnly yes

Match tagged prod                        # selected with ssh -P prod host (OpenSSH 9.4+)
  RequestTTY yes
  RemoteCommand tmux new -A -s main

Match canonical host db-*
  User postgres

Match final all                          # runs once more after canonicalisation, useful for defaults
  ServerAliveInterval 30

Host i-*                                                       # AWS instance IDs through SSM (plugin installed separately)
  ProxyCommand aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters portNumber=%p
Host *.corp.example
  ProxyCommand nc -X 5 -x 127.0.0.1:1080 %h %p                 # through a SOCKS5 proxy

ssh-keygen -t ed25519 -C 'alice@laptop'                 # prompts for a passphrase
ssh-keygen -t ed25519 -f ~/.ssh/id_deploy -N ''         # no passphrase: automation only
ssh-copy-id -i ~/.ssh/id_ed25519.pub host               # appends to remote authorized_keys
ssh-keygen -lf ~/.ssh/id_ed25519.pub                    # SHA256 fingerprint
ssh-keygen -y -f ~/.ssh/id_ed25519 > id_ed25519.pub     # regenerate a lost public key
ssh-keygen -p -f ~/.ssh/id_ed25519                      # change the passphrase

eval "$(ssh-agent -s)"                 # start an agent and export SSH_AUTH_SOCK
ssh-add ~/.ssh/id_ed25519
ssh-add -l                             # fingerprints of loaded keys
ssh-add -t 3600 ~/.ssh/id_ed25519      # key expires from the agent after an hour
ssh-add -D                             # remove every key from the agent

restrict,pty,command="/usr/local/bin/backup" ssh-ed25519 AAAA...placeholder backup@ci
from="198.51.100.0/24",restrict ssh-ed25519 AAAA...placeholder deploy@ci

ssh-keygen -t ed25519 -a 100 -f ~/.ssh/id_ed25519      # -a: KDF rounds protecting the passphrase (default 16)
ssh-keygen -c -C 'alice@laptop-2026' -f ~/.ssh/id_ed25519   # change the comment
ssh-add -L                                              # public keys in the agent, in authorized_keys format
ssh-add -d ~/.ssh/id_ed25519                            # remove one key
ssh-add -x                                              # lock the agent with a password; -X unlocks

ssh-keygen -t ed25519 -f ~/ca/user_ca -C 'user CA'      # keep this offline or in a signing service

# Sign a user key: identity (logged by sshd), principals (login names it may use), 12-hour validity
ssh-keygen -s ~/ca/user_ca -I alice@laptop -n alice,deploy -V +12h ~/.ssh/id_ed25519.pub
# writes ~/.ssh/id_ed25519-cert.pub; ssh sends it automatically next to the private key

# Restrict what the certificate allows, regardless of sshd settings
ssh-keygen -s ~/ca/user_ca -I ci-runner -n deploy -V +1h -O clear -O force-command=/usr/local/bin/deploy -O source-address=198.51.100.0/24 id_ci.pub

# Host certificate: principals are the names clients will type
ssh-keygen -s ~/ca/host_ca -I host-01 -h -n host-01.example.com,192.0.2.10 -V -1d:+52w /etc/ssh/ssh_host_ed25519_key.pub

ssh-keygen -L -f ~/.ssh/id_ed25519-cert.pub             # print identity, principals, validity, options

TrustedUserCAKeys /etc/ssh/user_ca.pub
HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
AuthorizedPrincipalsFile /etc/ssh/principals/%u    # optional: accept principals listed here, not only the login name
RevokedKeys /etc/ssh/revoked_keys                  # KRL from ssh-keygen -k, checked on every login

@cert-authority *.example.com,192.0.2.* ssh-ed25519 AAAA...placeholder host CA
@revoked host-old.example.com ssh-ed25519 AAAA...placeholder

ssh-keygen -k -f /etc/ssh/revoked_keys -s ~/ca/user_ca.pub -z 1 compromised-cert.pub   # -s CA: revoke by serial/ID; -z KRL version
ssh-keygen -k -u -f /etc/ssh/revoked_keys another.pub                                  # -u: add to the existing KRL
ssh-keygen -Q -f /etc/ssh/revoked_keys ~/.ssh/id_ed25519-cert.pub                       # is this key or cert revoked

ssh -L 5432:db.internal.example:5432 bastion      # local 5432 -> db.internal.example:5432, via bastion
ssh -R 8080:localhost:3000 host                   # host's port 8080 -> my local port 3000
ssh -D 1080 bastion                               # SOCKS5 proxy on local 1080
ssh -fN -o ExitOnForwardFailure=yes -L 5432:db.internal.example:5432 bastion   # background, no shell
ssh -J bastion db-01                              # jump host, nothing stored or forwarded on bastion

pkill -f 'ssh -fN.*-L 5432'      # stop a backgrounded forward
ssh -O check bastion             # is a control master running for this host
ssh -O exit bastion              # close the master and every session using it

ssh -O forward -L 8443:web.internal.example:443 bastion     # add to the running master
ssh -O cancel -L 8443:web.internal.example:443 bastion      # remove it
ssh -L /tmp/pg.sock:/var/run/postgresql/.s.PGSQL.5432 host  # Unix socket on both ends; psql -h /tmp
ssh -R 0:localhost:3000 host                                # port 0: server picks a free port and prints it
ssh -W db.internal.example:5432 bastion                     # stdin/stdout to a TCP port; what ProxyJump uses underneath

Match Group bastion-users
  AllowTcpForwarding local
  PermitOpen db.internal.example:5432 web.internal.example:443   # host:port entries; * wildcards a host or port, no CIDR
  PermitListen none
  PermitTTY no
  ForceCommand /usr/bin/false

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
AuthenticationMethods publickey
AllowGroups ssh-users
MaxAuthTries 3
LoginGraceTime 20
X11Forwarding no
AllowAgentForwarding no
ClientAliveInterval 300
ClientAliveCountMax 2

sudo sshd -t                                        # syntax and key check, silent on success
sudo sshd -T | grep -i passwordauthentication       # effective value after drop-ins
sudo sshd -T -C user=alice,host=host.example.com,addr=198.51.100.7   # effective values for one connection, with Match applied
sudo systemctl reload sshd                          # unit is "ssh" on Debian and Ubuntu

Match Group sftp-only
  ChrootDirectory /srv/sftp/%u
  ForceCommand internal-sftp
  AllowTcpForwarding no

ssh -vvv host 2>&1 | tail -40                          # client view: kex, key offers, auth methods
sudo journalctl -u sshd -f                             # server view: the actual rejection reason
ssh -o IdentitiesOnly=yes -o PreferredAuthentications=publickey -i ~/.ssh/id_ed25519 host   # test one key only
ssh-keyscan -t ed25519 host | ssh-keygen -lf -         # compare against the fingerprint you expect

scp file host:/tmp/                          # one file; see the scp page for syntax
rsync -avzP --delete ./dir/ host:/srv/dir/   # incremental and resumable; --delete removes extra files on the target
sftp host                                    # interactive, or scripted with -b batchfile
ssh host 'tar czf - /var/log' > logs.tgz     # stream without staging a file
tar czf - ./dir | ssh host 'tar xzf - -C /srv'

sftp -P 2222 alice@host.example.com          # -P: port (capital, unlike ssh)
sftp sftp://alice@host.example.com:2222/srv/  # URI form, starting in /srv
sftp -r host:/srv/logs ./logs                 # recursive download in one go; symlinks are not followed
sftp -a host:/srv/big.iso .                   # resume a partial download
sftp -l 20000 host:/srv/big.iso .             # limit to 20000 Kbit/s

sftp> ls -l                        # remote listing; lls is local
sftp> cd /srv/app; lcd ~/out        # remote and local working directories; pwd and lpwd show them
sftp> get -p config.yaml            # -p keeps mtime and mode; -a resumes; -R recursive
sftp> put -R ./release/ /srv/app/   # upload a tree
sftp> reget big.iso                 # same as get -a
sftp> rename app.yaml app.yaml.bak  # rename is atomic on the server
sftp> rm /srv/app/old.log           # deletes on the server
sftp> df -h                         # free space on the remote filesystem
sftp> !ls -l                        # run a local shell command
sftp> bye

cat > upload.sftp <<'EOF'
-mkdir /srv/app/releases
put -p ./release.tgz /srv/app/releases/release-2026-09-24.tgz
rename /srv/app/releases/release-2026-09-24.tgz /srv/app/releases/current.tgz
EOF
sftp -b upload.sftp -o ConnectTimeout=10 deploy@host.example.com
sftp -b - host <<< 'ls -l /srv/app'          # commands from stdin

# Run a command on many hosts, 8 at a time
printf '%s\n' host{1..20}.example.com | xargs -P8 -I{} ssh -o ConnectTimeout=5 -o BatchMode=yes {} 'uptime'

# Copy a public key without ssh-copy-id
ssh host 'umask 077; mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys' < ~/.ssh/id_ed25519.pub

# Persistent tunnel that reconnects (autossh is a separate package)
autossh -M 0 -o ServerAliveInterval=30 -o ExitOnForwardFailure=yes -N -L 5432:db.internal.example:5432 bastion

# Reachability test from inside the network, through a bastion
ssh -J bastion host 'nc -zv db.internal.example 5432'

# Fingerprints of every key in authorized_keys
ssh-keygen -lf ~/.ssh/authorized_keys

# Show, then remove, a host's known_hosts entry after a rebuild
ssh-keygen -F host; ssh-keygen -R host

# Compare a local and remote file without copying
diff <(ssh host 'sha256sum < /etc/app.conf') <(sha256sum < /etc/app.conf)

# Mount a remote directory (sshfs is a separate package)
sshfs host:/srv/data /mnt/data -o reconnect,ServerAliveInterval=15

# Measure login time with and without connection reuse
time ssh -o ControlPath=none host true; time ssh host true

# Which host key algorithms, kex and ciphers this client supports
ssh -Q key; ssh -Q kex; ssh -Q cipher

# Host key fingerprints of every key type a server presents, for comparing out of band
ssh-keyscan -t ed25519,rsa,ecdsa host.example.com 2>/dev/null | ssh-keygen -lf -

# Pre-seed known_hosts for a batch of new hosts (only when the network path is trusted)
ssh-keyscan -t ed25519 host{1..5}.example.com 2>/dev/null >> ~/.ssh/known_hosts

# Hash an existing known_hosts in place; the .old backup is left beside it
ssh-keygen -H -f ~/.ssh/known_hosts

# Accept a rotated host key without dropping the rest of the file
ssh-keygen -R host.example.com && ssh -o StrictHostKeyChecking=accept-new host.example.com true

# One key, one host, no agent: rule out config and agent noise
ssh -F /dev/null -o IdentitiesOnly=yes -o IdentityAgent=none -i ~/.ssh/id_ed25519 alice@host

# Debug output with timestamps to a file, terminal stays clean
ssh -vvv -E /tmp/ssh-debug.log host true; grep -n 'Authenticat' /tmp/ssh-debug.log

# Print a certificate's identity, principals and validity
ssh-keygen -L -f ~/.ssh/id_ed25519-cert.pub

# Days until a certificate expires
ssh-keygen -L -f ~/.ssh/id_ed25519-cert.pub | awk '/Valid:/ {print $NF}'

# Run a local script on a remote host without copying it first
ssh host 'bash -s -- -v' < ./check.sh

# Run a command as root via sudo with a TTY for the password prompt
ssh -t host 'sudo systemctl restart my-app'

# Stream a remote log with a heartbeat that survives idle NAT timers
ssh -o ServerAliveInterval=15 host 'journalctl -fu my-app'

# Open a tmux session, reattaching if it exists
ssh -t host 'tmux new -A -s main'

# Interactive port forward added to a live session: type ~C then -L 8443:web.internal.example:443

# Background SOCKS proxy that dies when the terminal does not
ssh -fN -D 1080 -o ExitOnForwardFailure=yes bastion && curl --proxy socks5h://127.0.0.1:1080 https://intranet.example.com/

# List the forwards an existing master holds, then close it
ssh -O check bastion; ssh -O exit bastion

# Copy a directory tree preserving ownership when rsync is missing on the target
tar cf - -C /srv app | ssh host 'tar xpf - -C /srv'

# Remote disk usage across a fleet as CSV, with a timeout so a dead host does not block
for h in host{1..5}.example.com; do printf '%s,' "$h"; ssh -o BatchMode=yes -o ConnectTimeout=5 "$h" "df --output=pcent / | tail -1" || echo unreachable; done

# Effective sshd value for one user from one address, with Match blocks applied
sudo sshd -T -C user=deploy,addr=198.51.100.7 | grep -Ei 'forcecommand|permitopen|allowtcpforwarding'

# Failed logins by source address today
sudo journalctl -u sshd --since today | grep -oE 'Failed .* from [0-9a-f.:]+' | awk '{print $NF}' | sort | uniq -c | sort -rn | head

# Who is logged in over SSH right now, and from where
who --ips

# Sign a file with an SSH key and verify it with an allowed-signers list
ssh-keygen -Y sign -f ~/.ssh/id_ed25519 -n file release.tgz
ssh-keygen -Y verify -f allowed_signers -I alice@laptop -n file -s release.tgz.sig < release.tgz

#!/usr/bin/env bash
# usage: ssh-fleet-check hosts.txt
set -euo pipefail
hosts=${1:?hosts file required}
opts=(-o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new -o LogLevel=ERROR)
printf 'host\tstatus\tsshd\n'
while IFS= read -r host || [[ -n $host ]]; do
  [[ -z $host || $host == \#* ]] && continue
  if ver=$(ssh "${opts[@]}" "$host" 'ssh -V 2>&1' 2>/dev/null); then   # client and server ship in one package
    printf '%s\tok\t%s\n' "$host" "$ver"
  elif nc -zw3 "$host" 22 2>/dev/null; then
    printf '%s\tauth-failed\t-\n' "$host"
  else
    printf '%s\tunreachable\t-\n' "$host"
  fi
done < "$hosts"

#!/usr/bin/env bash
# usage: sign-user-key <pubkey> <identity> <principals> [validity]
set -euo pipefail
ca=${SSH_CA:-$HOME/ca/user_ca}
pub=${1:?public key}; ident=${2:?identity}; princ=${3:?principals}; valid=${4:-+8h}
serial_file=${ca}.serial
serial=$(( $(cat "$serial_file" 2>/dev/null || echo 0) + 1 ))
ssh-keygen -s "$ca" -I "$ident" -n "$princ" -V "$valid" -z "$serial" \
  -O clear -O permit-pty -O permit-port-forwarding "$pub"
printf '%s\n' "$serial" > "$serial_file"
printf '%s\t%s\t%s\t%s\t%s\n' "$(date -u +%FT%TZ)" "$serial" "$ident" "$princ" "$valid" >> "${ca}.log"
ssh-keygen -L -f "${pub%.pub}-cert.pub" | grep -E 'Serial|Valid|Principals'

#!/usr/bin/env bash
# usage: push-authorized-keys keys.txt host [host...]
set -euo pipefail
keys=${1:?keys file}; shift
[[ -s $keys ]] || { echo "refusing to push an empty key file" >&2; exit 1; }
ssh-keygen -lf "$keys" >/dev/null                      # fails when the file holds no parseable public key
for host in "$@"; do
  ssh -o BatchMode=yes -o ConnectTimeout=5 "$host" 'umask 077; mkdir -p ~/.ssh
    [ -f ~/.ssh/authorized_keys ] && cp ~/.ssh/authorized_keys ~/.ssh/authorized_keys.bak
    cat > ~/.ssh/authorized_keys.new && mv ~/.ssh/authorized_keys.new ~/.ssh/authorized_keys' < "$keys"
  ssh -o BatchMode=yes -o ConnectTimeout=5 "$host" true \
    && printf '%s: ok (%s keys)\n' "$host" "$(grep -c '^ssh-\|^sk-' "$keys")" \
    || { printf '%s: login failed after push; backup is ~/.ssh/authorized_keys.bak on the host\n' "$host" >&2; exit 1; }
done