SSH(1) General Commands Manual SSH(1) (NAME) ssh - OpenSSH ( ) (SYNOPSIS) ssh [-46AaCfGgKkMNnqsTtVvXxYyZ] [-B bind_interface] [-b bind_address] [-c cipher_spec] [-D [bind_address:]port] [-E log_file] [-e escape_char] [-F configfile] [-I pkcs11] [-i identity_file] [-J destination] [-L address] [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-P tag] [-p port] [-R address] [-S ctl_path] [-W host:port] [-w local_tun[:remote_tun]] destination [command [argument ...]] ssh [-Q query_option] (DESCRIPTION) ssh ( SSH) . . X11 TCP UNIX (UNIX-domain) . ssh destination () [user@]hostname (URI) ssh://[user@]hostname[:port]. . ( ). command () (login shell) . command . . : -4 ssh IPv4. -6 ssh IPv6. -A ssh-agent(1). . . ( UNIX ) . . (jump host) ( -J ). -a . -B bind_interface bind_interface . . -b bind_address bind_address . . -C ( X11 TCP UNIX). gzip(1) . . Compression ssh_config(5) . -c cipher_spec . cipher_spec . Ciphers ssh_config(5) . -D [bind_address:]port ("dynamic") . port bind_address . . SOCKS4 SOCKS5 ssh SOCKS . (root) . . IPv6 . (superuser) . GatewayPorts . bind_address . bind_address "localhost" `*' . -E log_file log_file . -e escape_char pty (: `~' ). . (`.') -Z . "none" . -F configfile . (/etc/ssh/ssh_config) . ~/.ssh/config . "none" . -f ssh . ssh . -n . X11 ssh -f host xterm . ExitOnForwardFailure "yes" -f . ForkAfterAuthentication ssh_config(5) . -G ssh Host Match . -g . () (master) . -I pkcs11 PKCS#11 ssh PKCS#11 . -i identity_file ( ) . ssh-agent(1) . ~/.ssh/id_rsa ~/.ssh/id_ecdsa ~/.ssh/id_ecdsa_sk ~/.ssh/id_ed25519 ~/.ssh/id_ed25519_sk ~/.ssh/id_mldsa44_ed25519 . . -i ( ) . CertificateFile ssh -cert.pub . -J destination ssh (jump host) destination TCP . . IPv6 . ProxyJump . . ~/.ssh/config . -K GSSAPI () GSSAPI . -k () GSSAPI . -L [bind_address:]port:host:hostport -L [bind_address:]port:remote_socket -L local_socket:host:hostport -L local_socket:remote_socket TCP () . port ( TCP) ( bind_address ) . hostport host remote_socket . . (superuser) . IPv6 . GatewayPorts . bind_address . "localhost" bind_address `*' . -l login_name . . -M ssh "master" () . -M ssh "master" ssh-askpass(1) ( ). ControlMaster ssh_config(5) . -m mac_spec MAC ( ) . MACs ssh_config(5) . -N . . SessionType ssh_config(5) . -n /dev/null ( stdin). ssh . X11 . ssh -n shadows.cs.hut.fi emacs & emacs shadows.cs.hut.fi X11 . ssh . ( ssh -f ). StdinNull ssh_config(5) . -O ctl_cmd (master) . -O ctl_cmd . : "check" ( ) "conninfo" ( ) "channels" ( ) "forward" ( ) "cancel" ( ) "proxy" ( ) "exit" ( ) "stop" ( ). -o option . . ssh_config(5) . -P tag ssh_config(5) . Tag Match ssh_config(5) . -p port . . -Q query_option : cipher ( ) cipher-auth ( ) help ( -Q) mac ( ) kex ( ) key ( ) key-ca-sign ( ) key-cert ( ) key-plain ( ) key-sig ( ) protocol-version ( SSH) sig ( ). ssh_config(5) sshd_config(5) query_option . -q (Quiet mode). . -R [bind_address:]port:host:hostport -R [bind_address:]port:local_socket -R remote_socket:host:hostport -R remote_socket:local_socket -R [bind_address:]port TCP () . port ( TCP) . hostport host local_socket ssh SOCKS 4/5 SOCKS . . (root) . IPv6 . TCP loopback . bind_address . bind_address `*' . bind_address GatewayPorts ( sshd_config(5) ). port `0' . -O forward . -S ctl_path "none" . ControlPath ControlMaster ssh_config(5) . -s (subsystem) . SSH ( sftp(1)) . . SessionType ssh_config(5) . -T (pseudo-terminal). -t (pseudo-terminal). . -t tty ssh tty . -V . -v (Verbose mode). ssh . . -v . . -W host:port host port . -N - -T - ExitOnForwardFailure ClearAllForwardings -o . -w local_tun[:remote_tun] tun(4) (local_tun) (remote_tun). "any" . remote_tun "any" . Tunnel TunnelDevice ssh_config(5) . Tunnel "point-to-point" . Tunnel -w . -X X11. . X11 . ( X ) X11 . (keystroke monitoring) . X11 X11 SECURITY . -Y ssh ForwardX11Trusted ssh_config(5) . -x X11. -Y X11 (trusted X11 forwarding). X11 X11 SECURITY . -y syslog(3). stderr . -Z . ssh . ssh_config(5) . (AUTHENTICATION) OpenSSH SSH SSH . : GSSAPI (host-based) (keyboard-interactive) (password). PreferredAuthentications . : /etc/hosts.equiv /etc/ssh/shosts.equiv ~/.rhosts ~/.shosts . ( /etc/ssh/ssh_known_hosts ~/.ssh/known_hosts ) . IP DNS . [ : /etc/hosts.equiv ~/.rhosts rlogin/rsh .] : . / . . ssh ECDSA Ed25519 RSA . ~/.ssh/authorized_keys . ssh . . . LogLevel DEBUG ( -v). ssh-keygen(1) . ~/.ssh/id_ecdsa ( ECDSA) ~/.ssh/id_ecdsa_sk ( ECDSA ) ~/.ssh/id_ed25519 ( Ed25519) ~/.ssh/id_ed25519_sk ( Ed25519 ) ~/.ssh/id_mldsa44_ed25519 ( MLDSA44-ED25519) ~/.ssh/id_rsa ( RSA) ~/.ssh/id_ecdsa.pub ( ECDSA) ~/.ssh/id_ecdsa_sk.pub ( ECDSA ) ~/.ssh/id_ed25519.pub ( Ed25519) ~/.ssh/id_ed25519_sk.pub ( Ed25519 ) ~/.ssh/id_mldsa44_ed25519.pub ( MLDSA44-ED25519) ~/.ssh/id_rsa.pub ( RSA) . ~/.ssh/authorized_keys . authorized_keys ~/.rhosts . . : / . (CA) / . CERTIFICATES ssh-keygen(1) . . ssh-agent(1) () AddKeysToAgent ssh_config(5) . (Keyboard-interactive) : ("challenge") . BSD ( login.conf(5) ) PAM ( OpenBSD) . ssh . . ssh . ~/.ssh/known_hosts . /etc/ssh/ssh_known_hosts . . ssh (man-in-the-middle) . StrictHostKeyChecking . . . ssh (pty) . -T -t . . . "none" tty . X11 TCP . (ESCAPE CHARACTERS) ssh . (tilde) ~~ . . EscapeChar -e . ( `~') : ~. . ~^Z ssh . ~# . ~& ssh X11. ~? . ~B BREAK ( ). ~C . -L - -R -D ( ). -KL[bind_address:]port -KR[bind_address:]port -KD[bind_address:]port . !command PermitLocalCommand ssh_config(5) . -h . ~I SSH. ~R (rekeying) ( ). ~V (LogLevel) stderr . ~v (LogLevel) stderr . TCP (TCP FORWARDING) TCP . TCP (firewall) . IRC IRC . : ssh . ssh . IRC IRC "server.example.com" "pinky" "#users" IRC : $ ssh -f -L 6667:localhost:6667 server.example.com sleep 10 $ irc -c '#users' pinky IRC/127.0.0.1 -f ssh "sleep 10" ( ) . ssh . X11 (X11 FORWARDING) ForwardX11 "yes" ( -X - -x -Y ) X11 ( DISPLAY ) X11 X11 ( ) X . DISPLAY . X11 . DISPLAY ssh . ssh X ("proxy") . ssh Xauthority . Xauthority . ( ). ForwardAgent "yes" ( -A -a ) . (VERIFYING HOST KEYS) ( StrictHostKeyChecking ). ssh-keygen(1) : $ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key . (MD5) -E ssh-keygen(1) . (random art) . VisualHostKey "yes " (ASCII) . . . : $ ssh-keygen -lv -f ~/.ssh/known_hosts : SSH DNS. (RR) SSHFP (zonefile) . "host.example.com" . SSHFP host.example.com : $ ssh-keygen -r host.example.com. . : $ dig -t SSHFP host.example.com : $ ssh -o "VerifyHostKeyDNS ask" host.example.com [...] Matching host key fingerprint found in DNS. Are you sure you want to continue connecting (yes/no)? VerifyHostKeyDNS ssh_config(5) . SSH (SSH-BASED VIRTUAL PRIVATE NETWORKS) ssh (VPN) tun(4) . PermitTunnel sshd_config(5) ( ). 10.0.50.0/24 10.1.1.1 10.1.1.2 10.0.99.0/24 SSH (gateway) 192.168.1.15 . : # ssh -f -w 0:1 192.168.1.15 true # ifconfig tun0 10.1.1.1 10.1.1.2 netmask 255.255.255.252 # route add 10.0.99.0/24 10.1.1.2 : # ifconfig tun1 10.1.1.2 10.1.1.1 netmask 255.255.255.252 # route add 10.0.50.0/24 10.1.1.1 /root/.ssh/authorized_keys ( ) PermitRootLogin . tun(4) "jane" "john" PermitRootLogin "forced-commands-only" : tunnel="1",command="sh /etc/netstart tun1" ssh-rsa ... jane tunnel="2",command="sh /etc/netstart tun2" ssh-rsa ... john SSH (overhead) VPN . ipsecctl(8) isakmpd(8) . (ENVIRONMENT) ssh : DISPLAY DISPLAY X11 . ssh "hostname:n" "hostname" `n' >= 1 . ssh X11 . DISPLAY X11 ( ). HOME . LOGNAME USER . MAIL . PATH PATH ssh . SSH_ASKPASS ssh . ssh DISPLAY SSH_ASKPASS SSH_ASKPASS X11 . ssh .xsession . ( /dev/null ). SSH_ASKPASS_REQUIRE askpass . "never" ssh . "prefer" ssh askpass TTY . "force" askpass DISPLAY . SSH_AUTH_SOCK UNIX (UNIX-domain) . SSH_CONNECTION . : IP IP . SSH_ORIGINAL_COMMAND . . SSH_TTY tty ( ) . tty . SSH_TUNNEL sshd(8) . SSH_USER_AUTH sshd(8) . TZ ( ). USER . ssh ~/.ssh/environment "VARNAME=value" . PermitUserEnvironment sshd_config(5) . (FILES) ~/.rhosts ( ). NFS (world-readable) sshd(8) (root) . . / . ~/.shosts .rhosts rlogin/rsh . ~/.ssh/ . // . ~/.ssh/authorized_keys (ECDSA Ed25519 RSA) . sshd(8) . / . ~/.ssh/config . ssh_config(5) . : / . ~/.ssh/environment (ENVIRONMENT) . ~/.ssh/id_ecdsa ~/.ssh/id_ecdsa_sk ~/.ssh/id_ed25519 ~/.ssh/id_ed25519_sk ~/.ssh/id_mldsa44_ed25519 ~/.ssh/id_rsa . (//). ssh . AES-128 . ~/.ssh/id_ecdsa.pub ~/.ssh/id_ecdsa_sk.pub ~/.ssh/id_ed25519.pub ~/.ssh/id_ed25519_sk.pub ~/.ssh/id_mldsa44_ed25519.pub ~/.ssh/id_rsa.pub . ( ) . ~/.ssh/known_hosts . sshd(8) . ~/.ssh/rc ( ) ssh . sshd(8) . /etc/hosts.equiv ( ). (root) . /etc/ssh/shosts.equiv hosts.equiv rlogin/rsh . /etc/ssh/ssh_config . ssh_config(5) . /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_mldsa44_ed25519_key /etc/ssh/ssh_host_rsa_key . /etc/ssh/ssh_known_hosts . . . sshd(8) . /etc/ssh/sshrc ( ) ssh . sshd(8) . (EXIT STATUS) ssh 255 . (SEE ALSO) scp(1), sftp(1), ssh-add(1), ssh-agent(1), ssh-keygen(1), ssh-keyscan(1), tun(4), ssh_config(5), ssh-keysign(8), sshd(8) (STANDARDS) S. Lehtinen and C. Lonvick, The Secure Shell (SSH) Protocol Assigned Numbers, RFC 4250, January 2006. T. Ylonen and C. Lonvick, The Secure Shell (SSH) Protocol Architecture, RFC 4251, January 2006. T. Ylonen and C. Lonvick, The Secure Shell (SSH) Authentication Protocol, RFC 4252, January 2006. T. Ylonen and C. Lonvick, The Secure Shell (SSH) Transport Layer Protocol, RFC 4253, January 2006. T. Ylonen and C. Lonvick, The Secure Shell (SSH) Connection Protocol, RFC 4254, January 2006. J. Schlyter and W. Griffin, Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints, RFC 4255, January 2006. F. Cusack and M. Forssen, Generic Message Exchange Authentication for the Secure Shell Protocol (SSH), RFC 4256, January 2006. J. Galbraith and P. Remaker, The Secure Shell (SSH) Session Channel Break Extension, RFC 4335, January 2006. M. Bellare, T. Kohno, and C. Namprempre, The Secure Shell (SSH) Transport Layer Encryption Modes, RFC 4344, January 2006. B. Harris, Improved Arcfour Modes for the Secure Shell (SSH) Transport Layer Protocol, RFC 4345, January 2006. M. Friedl, N. Provos, and W. Simpson, Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol, RFC 4419, March 2006. J. Galbraith and R. Thayer, The Secure Shell (SSH) Public Key File Format, RFC 4716, November 2006. D. Stebila and J. Green, Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer, RFC 5656, December 2009. A. Perrig and D. Song, Hash Visualization: a New Technique to improve Real-World Security, 1999, International Workshop on Cryptographic Techniques and E-Commerce (CrypTEC '99). (AUTHORS) OpenSSH ssh 1.2.12 Tatu Ylonen . Aaron Campbell Bob Beck Markus Friedl Niels Provos Theo de Raadt Dug Song OpenSSH . Markus Friedl SSH . . . Linux 6.12.107+deb13-amd64 August 4, 2026 Linux 6.12.107+deb13-amd64