SSH command usage quick reference manual

Most platforms currently recommend using the ed25519 algorithm to produce keys.

If you prefer the RSA algorithm for compatibility reasons, use the following command:

The -C parameter only adds a comment to the public key, so, like Authorized_Keys described later, you can simply indicate that the public key belongs to a certain email.

Note : When generating SSH keys, use a passphrase string to protect your private key.

In addition to manually specifying the private key with -i , we can simplify things using SSH-Agent .

For any remote host or service, such as GitHub, if you want to log in with your SSH key, the corresponding public key is also required.

On the server, you can write your public key to the ~/.ssh/authorized_keys file.

For some services like GitHub, AWS, etc., we need to upload the public key, through the provided interface, or directly using the command line tool.

If you already have the OpenSSH agent running (standard on most Linux platforms and macOS), just:

To run the OpenSSH agent on Windows, you need to execute these commands :

Note : On Windows/Linux adding a key to your ssh-agent once, even with a password, will make sure that the key gets associated with your ‘login’. Meaning: When you restart your PC and log in again, you’ll have your identity automatically available again.

To get the same behavior on macOS, you’ll need to follow these instructions on StackExchange .

Create a file ~/.ssh/config to manage your SSH hosts. Example:

The Host directive can either

• be a pattern (matching multiple follow-up Hosts )
• refer to a made-up hostname ( dev-facebook )
• be a real hostname.

If it’s a made-up hostname, you’ll need to specify an additional Hostname directive, otherwise, you can leave it out. And to add to the overall confusion, a Host line can actually contain multiple patterns.

With the config file above, you could do a:

Which would effectively do a ssh -i ~/.ssh/johnsnow.pem [email protected] for you.

For a full overview of all available options, look at this article .

To make Git use Window’s OpenSSH (and not the one it bundles), execute the following command:

To kill an unresponsive SSH session, hit, subsequently.

Trying to clone different private GitHub repositories, which have different SSH keypairs associated with them, doesn’t work out of the box.

Add this to your .ssh/config (this example assumes you have two GitHub keypairs, one for your work account and one for your personal account)

Then instead of cloning from github.com .

Clone from either github-work.com or github-personal.com .

Ever wanted to use your local SSH keys on a remote server, without copying your keys to that server? For example to git clone a private repository via SSH on a remote server?

Agent forwarding to the rescue. Edit your local .ssh/config file like so:

Then simply ssh to your server and execute an _ssh-add -L . The server’s SSH agent should have all local SSH identities available and you can start cloning away!

If you want to use the Windows OpenSSH agent with all its identities from WSL, do the following:

1. Install socat , eg on your WSL Distribution: eg apt install socat for Ubuntu/Debian.
2. Download a build of npiperelay and put it somewhere on your (Windows) PATH.
3. Put the following into your WSL ~/.bash_profile or ~/.bashrc .

Check out his WSL Book for more such tricks!

Want to connect to a server that is hidden from the outside world, but accessible from a box you have SSH access to? Like an Amazon RDS database, which is only reachable from inside an AWS network?

The following command establishes an SSH tunnel between my local machine (@port 3307) and an RDS database (@port 3306) , via an EC2 jump host (18.11.11.11) .

You could now, for example, use the mysql client to connect to localhost:3307 , which will be transparently tunneled to RDS for you.

Note : A lot of tools/IDEs like IntelliJ IDEA , support opening up SSH tunnels by just clicking a checkbox in the UI.

Password Managers like 1Password or Keepass can not only store your SSH keys, but they also come with their own ssh-agent , replacing your system’s ssh-agent.

This means, whenever you unlock your password manager on any machine that you have it installed on, you’ll have all your SSH identities instantly available.