Cheat sheet: SSH

Keys

ssh-keygen -t ed25519 -C "me@laptop"       # create (on your computer)
ssh-copy-id user@server                    # add to the server
ssh-copy-id -i ~/.ssh/id_ed25519.pub -p 2222 user@server
cat ~/.ssh/id_ed25519.pub                  # the public part — safe to share
ssh-keygen -lf ~/.ssh/id_ed25519.pub       # fingerprint
ssh-keygen -p -f ~/.ssh/id_ed25519         # change the key passphrase
eval "$(ssh-agent)" && ssh-add             # stop typing the passphrase every time

Without ssh-copy-id (on the server):

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo "ssh-ed25519 AAAA… me@laptop" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

~/.ssh/config

Host web
    HostName 203.0.113.10
    User deploy
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

Host db
    HostName 10.0.0.5
    User deploy
    ProxyJump web                          # via web

Host *
    ServerAliveInterval 30

Then just ssh web, scp file web:, ssh db.

Connecting and running commands

ssh -p 2222 user@server
ssh -J user@bastion user@10.0.0.5          # via a jump host
ssh web 'df -h; uptime'                    # a command without logging in
ssh -v web                                 # why it refuses
ssh-keygen -R 203.0.113.10                 # forget an old host key (after a reinstall)

Files

scp file.tar.gz web:/tmp/
scp web:/var/log/app.log .
scp -r ./dist web:/var/www/app
rsync -avz --progress ./dist/ web:/var/www/app/
rsync -avz --delete ./dist/ web:/var/www/app/   # exact copy (removes extra files)
rsync -avz -e "ssh -p 2222" ./data/ user@server:/data/

Tunnels

ssh -L 5432:127.0.0.1:5432 web             # the server's database on your localhost:5432
ssh -L 8080:10.0.0.5:80 web                # a site from the internal network
ssh -R 9000:127.0.0.1:3000 web             # your localhost:3000 on the server's :9000
ssh -D 1080 web                            # a SOCKS proxy through the server
ssh -fN -L 5432:127.0.0.1:5432 web         # in the background, no terminal

Server side

sshd -t                                    # test the config
sshd -T | grep -E 'port|passwordauth|permitroot'   # what is in effect
systemctl reload ssh
journalctl -u ssh --since today | grep -E 'Failed|Accepted'
lastb | head                               # failed logins

/etc/ssh/sshd_config.d/10-local.conf:

PasswordAuthentication no
PermitRootLogin prohibit-password
MaxAuthTries 3

Before PasswordAuthentication no, test the key login from a second window. rs harden does all this with automatic rollback.