How to Use SSH

Posted on Edited on In Views:

Sources:

  1. SSH Essentials: Working with SSH Servers, Clients, and Keys

How to Use SSH

Mental model

SSH provides:

  • an encrypted transport (confidentiality + integrity) over an untrusted network
  • server authentication (host keys; prevents talking to the wrong machine)
  • user authentication (most commonly public-key auth)
  • optional tunneling (port forwarding)

You can assume the cryptography; the only practical bit to remember is the key material:

  • private key stays on the client (or in an agent)
  • public key is installed on the server (typically in ~/.ssh/authorized_keys)

In public-key auth, the server challenges the client; the client proves possession of the private key by signing, and the server verifies using the public key.

How the client picks a key (public-key auth)

When connecting, the client may have multiple candidate private keys. OpenSSH (a common SSH client implementation) will try candidates until the server accepts one.

Typical search order:

  1. Keys offered by ssh-agent (ssh-agent is a software helding ssh keys to be queried by OpenSSH; forwarded agent counts as an agent too)
  2. Default private key files in ~/.ssh/ (id_ed25519, id_rsa, id_ecdsa, …)
  3. Keys specified by IdentityFile in ~/.ssh/config
  4. Keys from /etc/ssh/ssh_config
  5. (Platform-specific) keychains

The first accepted key determines which public key on the server matched, i.e. “which account/keypair you authenticated with”.

Why you care:

  • deterministic auth on machines with many keys
  • avoid accidentally using the “wrong” key on shared servers

IdentitiesOnly

If you want to stop the “try everything” behavior and only offer explicitly configured keys, edit

Host github.com
    User git
    IdentitiesOnly yes # Add this

in ~/.ssh/config.

Agent forwarding

When developing on a remote server, you often need to access other SSH services (e.g. [email protected]). You generally do not want private keys sitting on that remote machine.

Agent forwarding lets the remote host use your local ssh-agent to sign challenges, while your private key remains local.

Enable per-connection:

ssh -A -p port_number username@hostname

Or persist on the local machine via ~/.ssh/config:

Host my_server
    HostName 192.160.96.180
    User anon
    Port 22
    ForwardAgent yes

Verify on the remote:

ssh-add -l

Usage

Connect

ssh username@remote_host

Non-default port:

ssh -p 2222 username@remote_host

Specify a key explicitly:

ssh -i ~/.ssh/id_ed25519 -p 2222 username@remote_host

Run commands remotely

ssh username@remote_host "command command_arguments"

Notes:

  • Quote the command string. On some systems (e.g. Manjaro), improper quoting can lead to only the first token running remotely and the rest running locally.

Pipelines: local vs remote grep

Because | is interpreted by the local shell unless quoted:

  • Local grep (remote produces output; local filters):

    ssh foobar@server ls | grep PATTERN

  • Remote grep (local produces output; remote filters):

    ls | ssh foobar@server grep PATTERN

Interactive commands: -t for TTY

If the remote command needs interaction:

ssh -t username@remote_host "command"

Configuration

~/.ssh/config

Plain-text config read by the OpenSSH client.

Host vm
    User foobar
    HostName 172.16.174.141
    Port 2222
    IdentityFile ~/.ssh/id_ed25519
    LocalForward 9999 localhost:8888

Host *.mit.edu
    User foobaz

Then:

ssh vm

Shell alias (quick but less maintainable)

alias my_server="ssh -i ~/.id_ed25519 --port 2222 -L 9999:localhost:8888 foobar@remote_server"

Keys

Generate a key

ssh-keygen -t rsa -b 1024 -f yourkeyname -C "备注"
参数 解释
-b 采用长度 1024 bit 的密钥对（b=bits），最长 4096
-t rsa 采用 RSA 加密方式（t=type）
-f 生成文件名（f=output_keyfiles）
-C 备注（C=comment）
-a rounds：迭代次数；数值越高越安全也越慢；默认为 16

Notes:

  • 公钥和私钥默认位于 ~/.ssh。
  • 使用 ssh-agent 或 gpg-agent 避免每次都输入密码。

Derive public key from a private key:

ssh-keygen -y -f ~/.ssh/id_rsa

Key-based login (authorized_keys)

On the server, SSH consults ~/.ssh/authorized_keys.

Append your local public key to the remote authorized_keys:

cat .ssh/id_ed25519.pub | ssh foobar@remote 'cat >> ~/.ssh/authorized_keys'

Or:

ssh-copy-id -i .ssh/id_ed25519.pub foobar@remote

Tunneling

Local port forwarding (-L)

Scenario:

  • Remote server x.x.x.x is reachable only via SSH (22) due to VPN/firewall constraints.
  • A service (e.g. moodist) runs on the server at port 8080.
  • You cannot reach http://x.x.x.x:8080 directly.

Forward a local port to the remote service:

ssh -f -N -q -L localPort:localhost:remotePort username@remoteHost
  • -L: local forwarding
  • -f: background the SSH process
  • -N: no remote command (tunnel only)
  • -q: quiet

Example:

ssh -f -N -q -L 8080:localhost:8080 [email protected]

Then visit:

  • http://localhost:8080

File transfer

ssh + tee (stream local → remote)

cat localfile | ssh remote_server "tee serverfile"

scp

Local → remote:

scp <local_file> <username>@<remote_host>:<remote_directory>

Remote → local:

scp <username>@<remote_host>:<remote_file> <local_directory>
  • -r: directories
  • scp can leave an incomplete destination file if interrupted.

rsync

rsync improves upon scp:

  • skips identical files
  • better metadata control (symlinks, permissions)
  • resumable transfers via --partial

Syntax is similar to scp.

Process management

List SSH processes:

ps aux | grep ssh

Kill all SSH processes (local machine):

killall ssh

Warning: this kills all your SSH sessions/forwardings on the local machine.