SSH cheat sheet

The chapter on one page: what to remember, the commands to have at your fingertips, and flashcards for quick revision.

The chapter in eight sentences

ssh user@host [command] runs a shell or one command on another machine over an encrypted connection.
The server proves who it is with a host key; ~/.ssh/known_hosts remembers it, and a changed key stops the connection until you know why.
A key pair replaces passwords: the private key stays on your machine (mode 600), the public key goes into ~/.ssh/authorized_keys on the server (ssh-copy-id).
sshd ignores keys when ~/.ssh is not 700 or authorized_keys is not 600 and owned by the user; the server's log says so.
ssh-agent and ssh-add hold an unlocked key so a passphrase is typed once.
scp copies once, sftp browses, rsync -av copies only changes (mind the trailing slash, and use -n before --delete).
~/.ssh/config gives a host a short alias with its user and key.
Harden sshd in /etc/ssh/sshd_config.d/10-NAME.conf (first value wins), check with sshd -t and sshd -T, reload, and test a new login with a spare session open.

Command	Does
`ssh user@host [cmd]`	Log in / run a command
`ssh -i KEY user@host`	Use a given private key
`ssh-keygen -lF HOST`	Fingerprint stored in known_hosts
`ssh-keygen -lf FILE.pub`	Fingerprint of a key file
`ssh-keygen -R HOST`	Forget a host key
`-o StrictHostKeyChecking=accept-new`	Accept new hosts, refuse changed ones

Command	Does
`ssh-keygen -t ed25519 -f ~/.ssh/NAME -C TEXT`	New key pair
`ssh-keygen -p -f KEY`	Change the passphrase
`ssh-copy-id -i KEY.pub user@host`	Install the public key
`eval $(ssh-agent -s)`, `ssh-add KEY`, `ssh-add -l`	Agent
`~/.ssh` 700 · `authorized_keys` 600	Required permissions
`journalctl -u sshd`	Why a login failed

Command	Does
`scp F host:` · `scp -r D host:/path/` · `scp host:F .`	Copy once
`sftp host`	Interactive transfer
`rsync -av D/ host:D/`	Synchronise
`rsync -avn --delete D/ host:D/`	Dry run of a mirror
`/etc/ssh/sshd_config.d/10-NAME.conf`	Your sshd settings
`sshd -t` · `sshd -T \| grep opt`	Check syntax · effective values
`systemctl reload sshd`	Apply without dropping sessions

Log in and run a command remotely?: ssh user@host · ssh user@host command
What is in known_hosts, and what does a warning mean?: The host keys you trust. A changed key means a rebuilt server or an attack: find out which.
Create a key pair and install the public key?: ssh-keygen -t ed25519 · ssh-copy-id -i KEY.pub user@host
Which key file is secret?: The private key (no .pub). Mode 600.
Permissions sshd insists on?: ~/.ssh 700, authorized_keys 600, both owned by the user.
Load a key once for many logins?: eval $(ssh-agent -s) · ssh-add KEY
Copy a file, a directory, and synchronise?: scp F host: · scp -r D host: · rsync -av D/ host:D/
A short name for a server?: Host block in ~/.ssh/config: HostName, User, IdentityFile
Where do sshd changes go, and in what order are they read?: /etc/ssh/sshd_config.d/*.conf, alphabetical, first value wins: name yours 10-...
Check and apply sshd configuration?: sshd -t · sshd -T | grep OPTION · systemctl reload sshd
Remove a stale host key?: ssh-keygen -R HOST
Where are SSH logins logged?: journalctl -u sshd and /var/log/secure