Cheatsheet SSH / SCP
Acesso remoto seguro e transferência de ficheiros
SSH / SCP
24
cards found
Categories:
Versions:
Connection
Connect to a Server
ssh user@server.com
ssh -p 2222 user@server.com
ssh user@192.168.1.100
Basic connection.
Remote Commands
ssh user@host "ls -la"
ssh user@host "df -h && free -m"
ssh user@host "sudo systemctl restart nginx"
Run without an interactive session.
Useful Options
ssh -v user@host # verbose/debug
ssh -o ConnectTimeout=5 user@host
ssh -o StrictHostKeyChecking=no user@host
ssh -t user@host "htop" # force TTY
Connection flags.
Persistent Session
ssh -o ServerAliveInterval=60 \
-o ServerAliveCountMax=3 user@host
# Keep connection alive
Avoid timeouts.
Chaves SSH
Generate a Key
ssh-keygen -t ed25519 -C "email@example.com"
ssh-keygen -t rsa -b 4096
# Generated files:
# ~/.ssh/id_ed25519 (private)
# ~/.ssh/id_ed25519.pub (public)
Create a key pair.
Copy Key to Server
ssh-copy-id user@server.com
ssh-copy-id -p 2222 user@host
# Manual:
cat ~/.ssh/id_ed25519.pub | \
ssh user@host "cat >> ~/.ssh/authorized_keys"
Set up key-based auth.
Manage Keys
ssh-keygen -l -f ~/.ssh/id_ed25519.pub
ssh-keygen -p -f ~/.ssh/id_ed25519
ssh-keygen -R server.com
# View fingerprint / change passphrase
# Remove from known_hosts
Key maintenance.
Use a Specific Key
ssh -i ~/.ssh/my_key user@host
# In ~/.ssh/config:
Host my-server
IdentityFile ~/.ssh/my_key
Specify identity.
Settings
~/.ssh/config
Host prod
HostName 192.168.1.50
User deploy
Port 2222
IdentityFile ~/.ssh/prod_key
Host *
ServerAliveInterval 60
Configure aliases.
Use an Alias
# After configuring:
ssh prod
scp file.txt prod:/var/www/
# Instead of:
# ssh -p 2222 -i ~/.ssh/prod_key deploy@192.168.1.50
Simplify connections.
Multiple Hosts
Host dev staging prod
User deploy
IdentityFile ~/.ssh/work_key
Host dev
HostName dev.company.com
Host prod
HostName prod.company.com
Share configuration.
ProxyJump (bastion)
Host internal
HostName 10.0.0.5
User admin
ProxyJump bastion
Host bastion
HostName bastion.company.com
User ubuntu
Jump through an intermediate server.
SCP / SFTP
Copy to a Server
scp file.txt user@host:/home/user/
scp -r folder/ user@host:/backup/
scp -P 2222 file user@host:/tmp/
Upload files.
Copy from a Server
scp user@host:/var/log/app.log ./
scp -r user@host:/etc/nginx/ ./nginx-backup/
scp user@host:"/path/file*" ./local/
Download files.
Between Servers
scp user1@host1:/file user2@host2:/dest/
# With compression:
scp -C big_file.zip user@host:/tmp/
Remote-to-remote copy.
Interactive SFTP
sftp user@host
ls # list
cd /var/www # change dir
put local.txt /remote/
get /remote/file.txt ./
bye
Interactive transfer.
Tunnels and Port Forward
Local Port Forward
ssh -L 8080:localhost:80 user@host
# Access at localhost:8080
# → forwards to host:80
ssh -L 3307:internal-db:3306 user@host
Access remote services locally.
Remote Port Forward
ssh -R 9090:localhost:3000 user@host
# On the remote server, port 9090
# → forwards to your machine:3000
# Useful to expose a dev server
Expose a local service remotely.
Dynamic (SOCKS proxy)
ssh -D 1080 user@host
# Configure browser the SOCKS5
# at localhost:1080
# All traffic goes through the server
SOCKS proxy via SSH.
Background Tunnel
ssh -fNL 5433:db:5432 user@host
# -f = background
# -N = no remote command
# -L = local forward
Tunnel without an interactive session.
Advanced
SSH Agent
eval $(ssh-agent)
ssh-add ~/.ssh/id_ed25519
ssh-add -l # list keys
ssh-add -D # remove all
# Avoids typing the passphrase every time
Manage keys in memory.
Multiplexing
# ~/.ssh/config:
Host *
ControlMaster auto
ControlPath ~/.ssh/sockets/%r@%h-%p
ControlPersist 600
mkdir -p ~/.ssh/sockets
Reuse connections (faster).
Disable Password Auth
# /etc/ssh/sshd_config:
PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
sudo systemctl restart sshd
Harden server security.
Rsync over SSH
rsync -avz -e "ssh -p 2222" \
./project/ user@host:/var/www/app/
rsync -avz --delete \
user@host:/backup/ ./backup-local/
Efficient synchronization.