Linux ssh Command

last modified October 18, 2026

The ssh command opens a secure, encrypted connection to a remote machine. It is the standard tool for logging in to Linux servers, running commands remotely, and tunneling network traffic. This tutorial covers basic and advanced usage of ssh with practical examples.

ssh is commonly used for server administration, remote development, secure file transfer, and port forwarding. It replaces insecure protocols such as telnet and rlogin.

The examples use the OpenSSH client. Replace the example hosts and addresses with those of a server you can access.

Connect to a Remote Host

The basic syntax is ssh user@host. If the user name is omitted, ssh uses your local user name.

$ ssh jano@example.com
The authenticity of host 'example.com (203.0.113.10)' can't be established.
ED25519 key fingerprint is SHA256:...
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
jano@example.com's password:

The first connection asks you to confirm the server's host key fingerprint. Verify the fingerprint through a trusted channel before entering yes. The host key is stored in ~/.ssh/known_hosts and checked on later connections. A changed host key produces a warning and should be investigated before you continue.

Use a Non-Standard Port

The default port is 22. Use -p when the SSH server listens on a different port.

$ ssh -p 2222 jano@example.com

The port option is -p for ssh, while scp uses an uppercase -P. Mixing them up is a common source of confusion.

Run a Remote Command

Anything after the host name is executed on the remote machine. The connection closes when the command finishes.

$ ssh jano@example.com 'df -h /'
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        50G   18G   30G  38% /

Quote the remote command so that the local shell does not expand variables, wildcards, or pipes before they reach the remote host. Use single quotes when the command contains characters that should be interpreted remotely.

Create an SSH Key Pair

Key-based authentication is safer and more convenient than typing a password. The ed25519 algorithm is a good default for modern systems.

$ ssh-keygen -t ed25519 -C "jano@example.com"
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/jano/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Your identification has been saved in /home/jano/.ssh/id_ed25519
Your public key has been saved in /home/jano/.ssh/id_ed25519.pub

The private key stays on your machine and must never be shared. The public key with the .pub suffix is copied to servers. Use a passphrase so that a stolen private key is still protected.

Copy the Public Key to a Server

The ssh-copy-id command appends your public key to the remote ~/.ssh/authorized_keys file and sets the required permissions.

$ ssh-copy-id -i ~/.ssh/id_ed25519.pub jano@example.com

After this step, ssh jano@example.com uses the key instead of asking for the account password, provided the server permits key-based authentication. Your local SSH client may prompt for the private-key passphrase unless the key is already loaded in an SSH agent.

Select a Specific Identity File

If you have several keys, use -i to choose the private key explicitly.

$ ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 jano@example.com

The corresponding public key must already be present in the remote authorized_keys file. The private key must be readable only by your user; ssh refuses keys with overly open permissions.

-i selects an identity file but does not, by itself, prevent other identities from being offered. IdentitiesOnly=yes restricts authentication to configured identities instead of also offering extra keys from an agent.

Use an SSH Config File

The ~/.ssh/config file stores per-host settings, so you do not have to repeat the same options on every connection.

Host webserver
    HostName 203.0.113.10
    User jano
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

With this entry, ssh webserver is equivalent to the full command with the host, user, port, and key. The config file also works for scp, sftp, and rsync when they use SSH.

Inspect the Effective Configuration

The -G option prints the configuration that ssh would use for a host, without opening a connection.

$ ssh -G example.com | grep -E '^(user|hostname|port) '
user jano
hostname example.com
port 22

This is useful for checking which values come from the config file, the command line, or the defaults. Add -v to a real connection for a detailed protocol trace when authentication fails.

Debug a Connection

The -v option prints debugging messages about configuration parsing, key exchange, and authentication.

$ ssh -v jano@example.com
OpenSSH_9.6p1, OpenSSL 3.0.13
debug1: Reading configuration data /home/jano/.ssh/config
debug1: Connecting to example.com [203.0.113.10] port 22.
debug1: Authenticating to example.com:22 as 'jano'

Use -vv or -vvv for even more detail. The output can contain sensitive information, so review it before sharing it publicly.

Local Port Forwarding

The -L option forwards a local port to an address reachable from the remote machine.

$ ssh -N -o ExitOnForwardFailure=yes -L 127.0.0.1:8080:localhost:80 jano@example.com

While the connection is open, connections to 127.0.0.1:8080 on your machine are tunneled to port 80 on the remote host. This is useful for reaching a service that is bound to the remote loopback interface.

-N omits a remote command and keeps the connection open for forwarding. ExitOnForwardFailure=yes exits if forwarding cannot be set up; it does not detect later failures to reach the destination service.

Remote Port Forwarding

The -R option forwards a port on the remote machine to a service on your local machine.

$ ssh -N -o ExitOnForwardFailure=yes -R 9000:localhost:3000 jano@example.com

After connecting, a process on the remote host can connect to localhost:9000 and reach port 3000 on your local machine. This is handy for making a local development server reachable from the remote host. The listening port normally binds only to the remote loopback interface. Access from other machines depends on the requested bind address, the server's GatewayPorts setting, and firewall rules.

Create a SOCKS Proxy

The -D option starts a dynamic SOCKS proxy on a local port.

$ ssh -N -o ExitOnForwardFailure=yes -D 127.0.0.1:1080 jano@example.com

Applications configured to use a SOCKS5 proxy at 127.0.0.1:1080 send their traffic through the SSH connection. This is useful on untrusted networks, but it does not encrypt traffic after it leaves the remote host.

Keep Long Sessions Alive

Use ServerAliveInterval to send keepalive messages and avoid disconnects caused by idle timeouts on NAT devices or firewalls.

$ ssh -o ServerAliveInterval=60 jano@example.com

The value is in seconds. You can put the same setting in ~/.ssh/config under a Host block so it applies automatically.

Best Practices for ssh

• Prefer Keys: Use key-based authentication and protect private keys with a passphrase.
• Check Permissions: Keep ~/.ssh at mode 700 and private keys at mode 600.
• Use Config Aliases: Store host, user, port, and key settings in ~/.ssh/config.
• Verify Host Keys: Confirm fingerprints through a trusted channel before accepting a new host key.
• Disable Password Login: On servers, prefer key authentication and disable password logins when possible.
• Debug with -v: Use verbose output to diagnose authentication and connection problems.

Source

Linux ssh Manual

In this article, we have explored various examples of using the ssh command for remote logins, key authentication, configuration aliases, remote commands, and port forwarding.

Author

My name is Jan Bodnar, and I am a passionate programmer with extensive programming experience. I have been writing programming articles since 2007. To date, I have authored over 1,400 articles and 8 e-books. I possess more than ten years of experience in teaching programming.

List all Linux tutorials.