Ssh Remote

SSH, SCP, and Rsync

Quick Reference

| Task | Command | |------|---------| | Connect | ssh user@host | | Connect on port | ssh -p 2222 user@host | | Run remote command | ssh user@host 'command' | | Generate key | ssh-keygen -t ed25519 | | Copy key to server | ssh-copy-id user@host | | Copy file to remote | scp file.txt user@host:/path/ | | Copy file from remote | scp user@host:/path/file.txt . | | Sync directory | rsync -avz dir/ user@host:/path/ | | Local tunnel | ssh -L 8080:localhost:80 user@host |

SSH Key Management

Generate Keys

# Ed25519 (recommended — fast, secure, short keys)
ssh-keygen -t ed25519 -C "user@hostname"

# Ed25519 with custom filename
ssh-keygen -t ed25519 -f ~/.ssh/id_project -C "user@hostname"

# RSA 4096-bit (for legacy systems that don't support Ed25519)
ssh-keygen -t rsa -b 4096 -C "user@hostname"

# Generate without passphrase (for automation only)
ssh-keygen -t ed25519 -f ~/.ssh/id_automation -N ""

# Change passphrase on existing key
ssh-keygen -p -f ~/.ssh/id_ed25519

# View key fingerprint
ssh-keygen -lf ~/.ssh/id_ed25519.pub

# View key in different format
ssh-keygen -lf ~/.ssh/id_ed25519.pub -E md5

Deploy Public Key

# Copy public key to remote server (recommended)
ssh-copy-id user@host

# Copy specific key
ssh-copy-id -i ~/.ssh/id_project.pub user@host

# Copy to non-standard port
ssh-copy-id -p 2222 user@host

# Manual method (when ssh-copy-id is unavailable)
cat ~/.ssh/id_ed25519.pub | ssh user@host 'mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys'

SSH Agent

# Start agent (if not running)
eval "$(ssh-agent -s)"

# Add key to agent
ssh-add ~/.ssh/id_ed25519

# Add key with timeout (auto-remove after 1 hour)
ssh-add -t 3600 ~/.ssh/id_ed25519

# List keys in agent
ssh-add -l

# Remove specific key
ssh-add -d ~/.ssh/id_ed25519

# Remove all keys
ssh-add -D

# macOS: add key to Keychain
ssh-add --apple-use-keychain ~/.ssh/id_ed25519

SSH Connection

Basic Connection

# Connect as specific user
ssh user@host

# Connect on non-standard port
ssh -p 2222 user@host

# Connect with specific key
ssh -i ~/.ssh/id_project user@host

# Verbose output (debugging)
ssh -v user@host      # level 1
ssh -vv user@host     # level 2
ssh -vvv user@host    # level 3 (most verbose)

# Force password authentication
ssh -o PreferredAuthentications=password user@host

# Force key authentication
ssh -o PreferredAuthentications=publickey user@host

# Disable host key checking (lab/ephemeral hosts only)
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null user@host

# Connect with X11 forwarding
ssh -X user@host

# Allocate pseudo-terminal (for interactive commands via script)
ssh -t user@host 'sudo systemctl restart nginx'

Remote Command Execution

# Run single command
ssh user@host 'uptime'

# Run command with arguments
ssh user@host 'df -h /home'

# Run multiple commands
ssh user@host 'cd /app && git pull && systemctl restart app'

# Run command with sudo
ssh -t user@host 'sudo systemctl status nginx'

# Run command with environment variable
ssh user@host 'LANG=C df -h'

# Pipe local data to remote command
cat data.csv | ssh user@host 'cat > /tmp/data.csv'

# Run local script on remote host
ssh user@host 'bash -s' > ~/.ssh/known_hosts
ssh-keyscan -p 2222 hostname >> ~/.ssh/known_hosts

Permissions Reference

SSH is strict about file permissions. Incorrect permissions cause silent authentication failures.

# Directory permissions
chmod 700 ~/.ssh

# Private key
chmod 600 ~/.ssh/id_ed25519

# Public key
chmod 644 ~/.ssh/id_ed25519.pub

# authorized_keys
chmod 600 ~/.ssh/authorized_keys

# config
chmod 600 ~/.ssh/config

# known_hosts
chmod 644 ~/.ssh/known_hosts

Important Notes

• Always prefer Ed25519 keys over RSA for new setups (shorter, faster, more secure)
• Use ssh-copy-id instead of manually editing authorized_keys
• Set IdentitiesOnly yes in SSH config to avoid sending all keys to every server
• Use ServerAliveInterval to prevent idle connections from being dropped by firewalls
• For tunnels, use -fN flags to run in background without a shell
• The trailing / in rsync source path matters: dir/ syncs contents, dir syncs the directory itself
• Use rsync --dry-run before --delete to verify what will be removed
• Never disable StrictHostKeyChecking on production or public networks
• Use ProxyJump (SSH 7.3+) instead of the older ProxyCommand for jump hosts
• SSH agent forwarding (-A) is convenient but carries security risks; prefer ProxyJump
• Keep ~/.ssh/config permissions at 600; SSH may silently ignore it otherwise

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: bug-ops
• Source: bug-ops/zeph
• License: MIT
• Homepage: https://bug-ops.github.io/zeph/

Install and usage instructions live in the source repository linked above.