SSH & Remote Transfer

Must-know cold

• ssh user@host · ssh -i KEY user@host · ssh -p PORT user@host
• scp file user@host:/path/ · sftp user@host · rsync -avz src/ user@host:dest/
• Keys: ssh-keygen -t ed25519 · ssh-copy-id · chmod 600 key · 700 .ssh
• Jump: ssh -J bastion user@internal (put jump and dest in ~/.ssh/config)
• Auth fail: ssh -vv -o IdentitiesOnly=yes -i KEY user@host
• Hung session: newline then ~.

Toolchain map

Definition: OpenSSH client/server plus tools that speak SSH. Six jobs, not six daemons.

Auth quick facts

Definition: Password vs key auth and common SSH denial causes.

1. Connection & session

ssh — session

Definition: Encrypted remote login and one-shot command execution (OpenSSH client).

Common -o options

Flag combos

2. Identity & keys

ssh-keygen

Definition: Create and inspect key pairs. File modes are enforced by ssh / sshd, not by this tool.

Authorize the server: append the .pub line to ~USER/.ssh/authorized_keys (one line, no wrap). ssh-copy-id does that over an existing login.

Modes (sshd StrictModes, client too):

• chmod 700 ~/.ssh
• chmod 600 ~/.ssh/authorized_keys
• chmod 600 private key
• chmod 600 ~/.ssh/config (ignored if group/other-writable)
• chmod 644 *.pub is fine

ssh-copy-id

Definition: Append a local public key to remote authorized_keys using a login that already works (password or another key).

ssh-add

Definition: Load private keys into ssh-agent so you type the passphrase once per agent lifetime.

Needs a running agent (SSH_AUTH_SOCK). On a desktop session you usually already have one. ssh-add -l → “Could not open a connection to your authentication agent” means there is no agent, not a bad key.

ssh-keyscan

Definition: Fetch a server’s host keys (not user keys) for known_hosts. Does not log in.

Compare fingerprints with an out-of-band source before appending. Blind ssh-keyscan >> known_hosts trusts the network the first time, same as StrictHostKeyChecking=accept-new.

3. File transfer

scp

Definition: Copy files over SSH. OpenSSH ≥ 9.0 uses SFTP under the hood; -O is the legacy scp protocol if you need it.

Directions: scp local user@host:remote · scp user@host:remote local · scp user@h1:a user@h2:b

scp does not use rsync’s trailing-slash rule: scp -r dir/ still copies the directory.

sftp

Definition: Interactive file protocol over SSH (ls/put/get/cd). Same auth as ssh. Port flag is -P (like scp).

Quit with bye / exit / quit. For trees and deltas, prefer rsync.

rsync

Definition: Delta copy, local or over SSH. Default remote shell is ssh when the dest is user@host:path.

Trailing slash

sshfs

Definition: Mount a remote directory on the local filesystem (FUSE + SFTP). Optional package (sshfs / fuse-sshfs), not part of OpenSSH itself.

Needs FUSE, a mountpoint directory, and the same auth as ssh. A dropped SSH session leaves a stuck mount — unmount, then remount. For deploys, rsync is the usual tool; sshfs is for interactive browsing.

4. Tunnels, forwarding, jump hosts

ssh — tunnels

Definition: The SSH client can listen and proxy TCP (and a SOCKS listener) through the encrypted session. HOST in -L/-R is not “your laptop” by default.

-L use: you cannot reach bastion:80 from here, but bastion can. Local http://127.0.0.1:8080 is bastion’s port 80.

-R use: a process on the server connects to server:9000 (loopback by default) and SSH brings that back to your 127.0.0.1:3000. To listen on all remote interfaces you need both ssh -R *:9000:127.0.0.1:3000 (or 0.0.0.0:…) and GatewayPorts enabled on sshd. GatewayPorts alone does not change a loopback -R.

-D use: point a browser/tool at socks5://127.0.0.1:1080 (OpenSSH speaks SOCKS4 and SOCKS5). Traffic egresses from the SSH server. Not a VPN (no UDP, no TUN — that is ssh -w, out of scope here).

-J use: ssh -J alice@bastion bob@10.0.0.8. -i / most -o apply to the destination, not the jump. Put each hop in ~/.ssh/config.

5. Config & server

ssh config

Definition: Client defaults in ~/.ssh/config. For each keyword, the first obtained value is kept. Later Host/Match blocks may still fill keywords that earlier blocks left unset — put specific hosts above Host *.

Host bastion
  HostName bastion.corp
  User alice
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes

Host agent-*
  User jenkins
  ProxyJump bastion
  IdentityFile ~/.ssh/agent_key
  IdentitiesOnly yes

Then: ssh bastion · ssh agent-01.

Host keys, sshd, systemd

Definition: Who you are talking to (known_hosts), who may log in (authorized_keys), how sshd listens (sshd_config).

Debian/Ubuntu unit is often ssh.service (alias sshd). RHEL family is sshd.service.

Reload, do not blindly restart, if you only have this SSH session.

6. Debug & audit

ssh — debug

Definition: Client verbosity, host-key policy, and in-session escape characters.

EscapeChar default is ~. It is only special at the beginning of a line and when a pty was allocated. Mid-line ~. is just characters. Background -f tunnels have no stdin for this — kill the client pid. man ssh “ESCAPE CHARACTERS”.

Server-side audit (this host as the SSH server): journalctl -u ssh / -u sshd, ss -tlnp | grep :22.

Flag combos

Common recipes

Pitfalls

• Port letters: ssh / ssh-copy-id / ssh-keyscan / sshfs use -p. scp / sftp use -P. scp -p is preserve. rsync -P is --partial --progress. Modern ssh -P tag is a config tag, not a port.
• scp -r follows symlinks. rsync -a copies the link itself.
• scp does not use rsync’s trailing-slash rule.
• --delete can wipe remote — dry-run first.
• Private key or ~/.ssh/config group/other-writable → client ignores them. authorized_keys too open → sshd ignores it (StrictModes).
• PasswordAuthentication=no does not block keyboard-interactive prompts.
• Remote sudo often needs ssh -t.
• -i / most -o with -J apply to the destination, not the jump — use ~/.ssh/config per Host.
• -L 127.0.0.1 is the SSH server’s loopback. -R 127.0.0.1 is your loopback.
• Agent forwarding (-A) lets a compromised remote use your keys. Prefer ProxyJump.
• Host key change: verify rebuild vs MITM before editing known_hosts.
• ssh-keyscan >> known_hosts without checking the fingerprint is TOFU, not a second factor.
• sshfs is not OpenSSH; a dead connection needs an unmount. Not a deploy tool.
• Escape ~. only at the start of a line, and only if a pty was allocated. It will not save a ssh -fN tunnel. ~C needs EnableEscapeCommandline yes on current OpenSSH.
• Debian systemctl restart ssh vs RHEL sshd — systemctl status 'ssh*'.