ssh
Connect to a server, run commands and create encrypted tunnels.
Before you run
Confirm the host-key fingerprint through a trusted channel on first use. -N keeps only forwarding active; Ctrl+C stops these foreground tunnels. -L resolves its target from the SSH server; -R reaches its target from this computer. The remote listener still depends on server forwarding policy; loopback binding also depends on GatewayPorts. ExitOnForwardFailure checks initial forwarding setup, not every future destination. -D provides SOCKS, not a VPN: configure the client separately (including remote DNS when supported). Verbose logs can reveal addresses, usernames and key paths; redact before sharing.
Examples
Log in; expect a host-key check and authentication prompt.
ssh alice@server.example.comChoose port 2222 and one identity file; IdentitiesOnly limits identities offered.
ssh -p 2222 -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes alice@server.example.comReach the destination through a bastion with ProxyJump (-J).
ssh -J alice@bastion.example.com alice@internal.example.comLocal forward: local port 15432 reaches the database through the server.
ssh -N -L 127.0.0.1:15432:db.internal.example.com:5432 -o ExitOnForwardFailure=yes alice@server.example.comRemote forward: server loopback port 18080 reaches this computer’s port 8080.
ssh -N -R 127.0.0.1:18080:127.0.0.1:8080 -o ExitOnForwardFailure=yes alice@server.example.comCreate a local SOCKS listener on 127.0.0.1:1080.
ssh -N -D 127.0.0.1:1080 -o ExitOnForwardFailure=yes alice@server.example.comDiagnose a connection with verbose output and a 10-second connection timeout.
ssh -vvv -o ConnectTimeout=10 alice@server.example.comConnect through two jump hosts in order. The client authenticates to each hop; verify every host key.
ssh -J alice@jump1.example.com,alice@jump2.example.com alice@target.example.comPrint effective client settings after Host and Include matching. Output may contain private connection details.
ssh -G alice@server.example.comRun one remote command and return to the local shell. Quote the command for the intended remote shell.
ssh alice@server.example.com 'uptime'Create and reuse a connection, inspect it, then stop the master. Keep ~/.ssh private; stopping the master also closes its dependent sessions.
ssh -M -S ~/.ssh/securepipes-%C -o ControlPersist=10m -fN alice@server.example.com
ssh -S ~/.ssh/securepipes-%C alice@server.example.com
ssh -S ~/.ssh/securepipes-%C -O check alice@server.example.com
ssh -S ~/.ssh/securepipes-%C -O exit alice@server.example.comList supported query categories, key algorithms and ciphers. Client support does not guarantee server acceptance.
ssh -Q help
ssh -Q key
ssh -Q cipherInspect a known_hosts entry and its fingerprint. Remove it only after independently verifying an expected key change; use the exact host and port form.
ssh-keygen -F server.example.com -l
ssh-keygen -R server.example.comUse noninteractive mode and a connection timeout for scripts. Configure authentication and host-key trust beforehand; prompts cause failure.
ssh -o BatchMode=yes -o ConnectTimeout=10 alice@server.example.comUse ProxyCommand with -W to reach a target through a bastion. ProxyJump is usually simpler; verify both host keys.
ssh -o 'ProxyCommand=ssh -W %h:%p alice@bastion.example.com' alice@target.example.comCreate a SOCKS listener on the server loopback interface. Other local users and processes on that server may access it; server policy must permit forwarding.
ssh -N -R 127.0.0.1:1080 -o ExitOnForwardFailure=yes alice@server.example.comConfigure encrypted SSH keepalive probes and a connection timeout. These detect an unresponsive peer; they do not guarantee reconnection.
ssh -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o ConnectTimeout=10 alice@server.example.comOptions and examples
-p portCommonConnect to the specified server port.
ssh -p 2222 alice@server.example.com-i identity_fileCommonUse the specified private key file; protect it and never share it.
ssh -i ~/.ssh/id_ed25519 alice@server.example.com-l login_nameSpecify the remote login name.
ssh -l alice server.example.com-J destinationCommonConnect through an SSH jump host.
ssh -J alice@bastion.example.com alice@internal.example.com-L address:port:host:hostportCommonForward a local listening port to a destination reached from the SSH server.
ssh -N -L 127.0.0.1:15432:db.internal.example.com:5432 alice@server.example.com-R address:port:host:hostportCommonForward a remote listening port to a destination reached from the local computer. Server policy can restrict binding.
ssh -N -R 127.0.0.1:18080:127.0.0.1:8080 alice@server.example.com-D address:portCommonCreate a local SOCKS listener. Configure each client to use it; this is not a VPN.
ssh -N -D 127.0.0.1:1080 alice@server.example.com-NCommonDo not run a remote command; useful for forwarding only.
ssh -N -D 127.0.0.1:1080 alice@server.example.com-o option=valueCommonSet an ssh_config option for this invocation. Forwarding setup success does not guarantee that a destination is reachable later.
ssh -o ExitOnForwardFailure=yes alice@server.example.com-F configfileUse an alternative client configuration file.
ssh -F ~/.ssh/lab_config alice@server.example.com-v / -vvvCommonPrint diagnostic output; more v characters increase detail. Logs may contain sensitive connection information.
ssh -vvv alice@server.example.com-4 / -6Use IPv4 only or IPv6 only, respectively.
ssh -4 alice@server.example.com-CRequest compression. It may not improve already compressed traffic.
ssh -C alice@server.example.com-T / -tDisable or request a pseudo-terminal, respectively.
ssh -t alice@server.example.com-AEnable agent forwarding. A compromised remote host can request signatures from the forwarded agent; use only with trusted hosts.
ssh -A alice@server.example.com-GPrint the effective client configuration after evaluating Host and Match rules.
ssh -G lab-VPrint the installed SSH client version.
ssh -VAuthoritative references
Reviewed October 27, 2026