This page designed to help beginners starting out with SSH by providing a usable “SSH cheat sheet” full of common commands.

1.1 SSH general

ssh without input passwordsshpass -p '<your-passwd>' ssh <username>@<ssh_host>, brew install sshpass
Install sshd serverapt-get install openssh, apt-get install openssh-server
Restart sshd serverservice sshd restart, systemctl reload sshd.service
Run ssh commandssh -o StrictHostKeyChecking=no -p 2702 root@ date
SSH with verbose ouptutssh -vvv -p 2702 root@ date 2>&1
Setup ssh tunnel for your web browsingsshuttle -r kubo@ -e ...
SSH passwordless loginssh-copy-id <username>@<ssh_host>, Or manually update ~/.ssh/authorized_keys
Remove an entry from known_hosts filessh-keygen -f ~/.ssh/known_hosts -R github.com
Diff local file with remote onediff local_file.txt <(ssh <username>@<ssh_host> 'cat remote_file.txt')
Diff two remote ssh filesdiff <(ssh user@remote_host 'cat file1.txt') <(ssh user2@remote_host2 'cat file2.txt')
Upload with timestamps/permissions keptscp -rp /tmp/abc/ ec2-user@<ssh-host>:/root/
SSH agent load keyexec ssh-agent bash && ssh-add /tmp/id_rsa, ssh-add
SSH list all loaded keyssh-add -l
SSH agent create and load keyexec ssh-agent bash && ssh-keygen, ssh-add
Emacs read remote file with trampemacs /ssh:<username>@<ssh_host>:/path/to/file

1.2 SSH tunnel & ssh proxy

SSH port forward to a local portssh -N -i <ssh-keyfile> -f root@ -L *:18085:localhost:8085 -n /bin/bash
Reverse port forward to remote serverssh -R *:40099:localhost:22 root@, ssh -p 40099 root@
Setup ssh tunnel for your web browsingsshuttle -r kubo@

1.3 SCP

Download a remote folderscp -r ec2-user@<ssh-host>:/home/letsencrypt-20180825 ./
Upload a filescp -i <ssh-keyfile> /tmp/hosts ec2-user@<ssh-host>:/root/
Upload a folderscp -r /tmp/abc/ ec2-user@<ssh-host>:/root/
Upload with timestamps/permissions keptscp -rp /tmp/abc/ ec2-user@<ssh-host>:/root/
Mount remote directory as local foldersshfs name@server:/path/remote_folder /path/local_folder

1.4 SSH security

Disable ssh by passwordsed -i 's/PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config
Disable root loginsed -i 's/^PermitRootLogin yes/#PermitRootLogin yes/' /etc/ssh/sshd_config
Enable/Disable SSH Host Key CheckingStrictHostKeyChecking yes change ~/.ssh/config
Protect SSH server from brute force attacksfail2ban command line tool

1.5 SSH files

Generate a new key pairssh-keygen, ssh-keygen -C "your_email@example.com" -t rsa
Generate key pair without interactionssh-keygen -t rsa -f /tmp/sshkey -N "" -q
Add passphrase protection to ssh keyfilessh-keygen -p -f id_rsa 
Convert OpenSSL format to SSH-RSA formatssh-keygen -f my_ssh.pub -i
Critical ssh files/folders~/.ssh/authorized_keys, ~/.ssh/config, ~/.ssh/known_hosts
SSH config file/etc/ssh/ssh_config, /etc/ssh/sshd_config
SSH key file permissionchmod 600 ~/.ssh/id_rsa
SSH folder permissionchmod 700 ~/.ssh, chown -R $USER:$USER ~/.ssh
Authorized_keys file permissionchmod 644 ~/.ssh/authorized_keys

1.6 Parse ssh log file

Events of ssh downgrep -R "ssh.*Received signal 15" /var/log/auth.log
Events of ssh upgrep -R "sshd.*Server listening" /var/log/auth.log
Events of ssh failed logingrep -R "sshd.*Failed password for invalid user" /var/log/auth.log
Events of ssh break-in attempgrep -R "sshd.*POSSIBLE BREAK-IN ATTEMPT!" /var/log/auth.log
Events of ssh port scapgrep -R "sshd.*Bad protocol version identification" /var/log/auth.log
Events of ssh login by public keygrep -R "sshd.*Accepted publickey for" /var/log/auth.log
Events of ssh login by passwordgrep -R "sshd.*Accepted password for" /var/log/auth.log
Events of ssh logout eventgrep -R "sshd.*pam_unix(sshd:session): session closed for" /var/log/auth.log

1.7 SSH tools

Export local env to Internetngrok.com
Reverse ssh proxysshuttle
SSH by auto input passwordsshpass sshpass -p “$PASSWORD” ssh -o StrictHostKeyChecking=no $username@$ssh_ip=

1.8 Scripts

  • Inject local key to remote ssh server server
cat ~/.ssh/id_rsa.pub | ssh $username@$ssh_hostk "cat - >> ~/.ssh/authorized_keys"
        ssh $username@$ssh_hostk "cat ~/.ssh/authorized_keys"
  • SSH Config file
Host sandbox
             StrictHostKeyChecking no
             User root
Host 192.168.1.*
           StrictHostKeyChecking no
           Port 32882
           IdentityFile ~/.ssh/id_rsa
  • Use expect to run ssh command with credential auto input
    set timeout 20
    set command "cat /etc/hosts"
    set user "vagrant"
    set password "vagrant"
    set ip ""
    spawn ssh -o stricthostkeychecking=no $user@$ip "$command"
    expect "*password:*"
    send "$password\r"
    expect eof;
  • ssh reverse tunnel
    # https://www.howtoforge.com/reverse-ssh-tunneling
    autossh -M 40000 -p 2702 -i /home/denny/al -fN \
        -o "PubkeyAuthentication=yes" \
        -o "StrictHostKeyChecking=false" -o "PasswordAuthentication=no" \
        -o "ServerAliveInterval 60" -o "ServerAliveCountMax 3" \
        -R root@

Post a Comment Blogger