LearnLinux › LearnLinux › CMDS

Linux ssh Command

Secure Shell - 10 Practical Examples with Detailed Explanations

Example 1

Basic SSH Connection

$ ssh user@remote_host
The authenticity of host 'remote_host (192.168.1.100)' can't be established.
ECDSA key fingerprint is SHA256:xyz123...
Are you sure you want to continue connecting (yes/no)? yes
user@remote_host's password: 
Last login: Sat Oct 18 10:30:15 2025
user@remote_host:~$
Establishes a secure shell connection to a remote server. Replace 'user' with your username and 'remote_host' with the server's hostname or IP address. The first connection prompts you to verify the server's fingerprint for security.
Quick Connect: If your local username matches the remote username, you can omit it: ssh remote_host
Example 2

Connect Using Custom Port

$ ssh -p 2222 user@remote_host
user@remote_host's password: 
Welcome to Ubuntu 22.04.3 LTS
user@remote_host:~
$
Connects to SSH server running on a non-standard port using the '-p' option (lowercase). Default SSH port is 22, but many administrators change it for security. Always verify the correct port before attempting connection.
Remember: ssh uses -p (lowercase), scp uses -P (uppercase) for port specification
Example 3

Execute Remote Command Without Shell

$ ssh user@remote_host 'ls -la /var/log'
total 1234
drwxr-xr-x  8 root root   4096 Oct 18 10:15 .
drwxr-xr-x 14 root root   4096 Sep 10 08:30 ..
-rw-r-----  1 syslog adm  52341 Oct 18 10:45 syslog
-rw-r-----  1 root   root 12456 Oct 18 10:30 auth.log
Executes a single command on the remote server and returns the output without opening an interactive shell. The connection closes automatically after the command completes. Perfect for automation and scripting.
Automation: Use this for remote monitoring scripts and automated tasks
Example 4

SSH with Private Key Authentication

$ ssh -i ~/.ssh/id_rsa user@remote_host
Welcome to Ubuntu 22.04.3 LTS
Last login: Sat Oct 18 09:45:22 2025 from 192.168.1.50
user@remote_host:~$
Uses a specific private key file for authentication with the '-i' option. Key-based authentication is more secure than passwords and essential for automated processes. The corresponding public key must exist in ~/.ssh/authorized_keys on the remote server.
Security Best Practice: Always use key-based authentication for production systems
Example 5

Enable X11 Forwarding for GUI Applications

$ ssh -X user@remote_host
user@remote_host:~$ firefox & # Firefox opens on your local display
Enables X11 forwarding with the '-X' option, allowing you to run graphical applications on the remote server that display on your local machine. Requires X server running locally (Linux/macOS with XQuartz/Windows with Xming).
Trusted X11: Use -Y instead of -X for trusted X11 forwarding (fewer security restrictions)
Example 6

Port Forwarding (SSH Tunnel) - Local

$ ssh -L 8080:localhost:80 user@remote_host
Creates a local port forward (SSH tunnel) that redirects local port 8080 to port 80 on the remote server. Access http://localhost:8080 in your browser to reach the remote web server. Extremely useful for accessing services behind firewalls securely.
Use Case: Access remote databases, web interfaces, or any service securely through encrypted tunnel
Example 7

Dynamic Port Forwarding (SOCKS Proxy)

$ ssh -D 1080 user@remote_host
Creates a SOCKS proxy on local port 1080 using the '-D' option. All traffic sent through this proxy is tunneled through the SSH connection. Configure your browser or applications to use localhost:1080 as a SOCKS5 proxy to route traffic through the remote server.
Privacy: Useful for bypassing restrictions or encrypting all traffic through remote server
Example 8

Keep Connection Alive

$ ssh -o ServerAliveInterval=60 user@remote_host
Sends a keepalive packet every 60 seconds to prevent connection timeout using the '-o' option. Prevents SSH sessions from disconnecting due to inactivity, especially useful for long-running tasks or unstable networks.
Permanent Setting: Add to ~/.ssh/config for all connections: ServerAliveInterval 60
Example 9

Verbose Mode for Troubleshooting

$ ssh -v user@remote_host
OpenSSH_8.2p1, OpenSSL 1.1.1f 31 Mar 2020 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Connecting to remote_host [192.168.1.100] port 22. debug1: Connection established. debug1: identity file /home/user/.ssh/id_rsa type 0 debug1: Authentication succeeded (publickey).
Enables verbose mode with '-v' option, showing detailed debug information about the connection process. Essential for troubleshooting authentication issues, connection problems, or understanding what's happening during SSH negotiation. Use -vv or -vvv for even more detail.
Debug Levels: -v (verbose), -vv (more verbose), -vvv (maximum verbosity)
Example 10

Jump Host (ProxyJump) Connection

$ ssh -J jumphost user@target_host
user@jumphost's password: user@target_host's password: user@target_host:~$
Connects to a target host through an intermediate jump host (bastion) using the '-J' option. This is essential in enterprise environments where servers are not directly accessible and require going through a bastion host. You can chain multiple jump hosts: -J host1,host2,host3
Security Architecture: Jump hosts/bastions are security best practice for protecting internal networks
Bonus

SSH Config File for Easier Connections

$ nano ~/.ssh/config
Host myserver HostName 192.168.1.100 User admin Port 2222 IdentityFile ~/.ssh/myserver_key ServerAliveInterval 60 Host jumpbox HostName bastion.company.com User jumpuser IdentityFile ~/.ssh/jump_key Host internal HostName 10.0.1.50 User sysadmin ProxyJump jumpbox IdentityFile ~/.ssh/internal_key
Create an SSH config file (~/.ssh/config) to define connection shortcuts with all settings. After configuration, simply type 'ssh myserver' instead of the full command with all options. Makes managing multiple servers much easier.
Usage: After saving config, connect with: ssh myserver (no options needed!)
Reference

Common SSH Options Quick Reference

Connection:
  ssh user@host              Connect to remote host
  ssh -p PORT user@host      Connect using custom port
  ssh -i KEY user@host       Use specific private key
  
Execution:
  ssh user@host 'command'    Execute remote command
  ssh user@host < script.sh  Execute local script remotely
  
Forwarding:
  ssh -L local:dest:port     Local port forwarding
  ssh -R remote:dest:port    Remote port forwarding
  ssh -D port                Dynamic port forwarding (SOCKS)
  
Display & Security:
  ssh -X user@host           Enable X11 forwarding
  ssh -Y user@host           Trusted X11 forwarding
  ssh -J jump user@host      Connect through jump host
  
Troubleshooting:
  ssh -v user@host           Verbose mode (debug)
  ssh -vv user@host          More verbose
  ssh -vvv user@host         Maximum verbosity
  
Options:
  -o Option=value            Set configuration option
  -N                         No remote command (port forwarding only)
  -f                         Run in background
  -C                         Enable compression
  -q                         Quiet mode (suppress warnings)
A comprehensive quick reference of the most commonly used SSH command options for daily system administration tasks.