SSH Cheat Sheet

-----------------------------------------------------------------------------------------------------
#disable public key authentication, connect as user root via ssh 
sshuser@vg-ubuntu-01:~$ ssh root@vg-ubuntu-02 -o PubkeyAuthentication=no
-----------------------------------------------------------------------------------------------------
#connect with one private key

#access ec2-23-22-230-24.compute-1.amazonaws.com with a private key located in ~/.ssh/alice.pem
$ ssh -i ~/.ssh/alice.pem [email protected]
-----------------------------------------------------------------------------------------------------
$ cat ~/.ssh/config
Host server
    Hostname 0.0.0.0
    User batman
    IdentityFile ~/.ssh/id_rsa_server
    
~/.ssh/config #ssh gets its configuration from locally
/etc/ssh/config #ssh gets its configuration from globally 
$ ssh -v server #see if your config file is loaded
$ ls -ld --  .ssh*/ #Directory permissions should be 700
$ ssh -v -F ~/.ssh/config #

#multiple private keys,declare which private key to use for each SSH server,~/.ssh/config
#cannot directly SSH to alternative names (e.g., IP address or hostname alias defined in /etc/hosts) of the SSH server

$ cat ~/.ssh/config
Host ec2-23-22-230-24.compute-1.amazonaws.com
  IdentityFile ~/.ssh/alice.pem

Host ec2-33-01-200-71.compute-1.amazonaws.com
  IdentityFile ~/.ssh/alice_v2.pem

$ ssh [email protected] # SSH without explicitly specifying your private key with -i option
-----------------------------------------------------------------------------------------------------
ssh-keyscan -H 192.168.1.162 >> ~/.ssh/known_hosts # update the known_hosts file located in the path, ~/.ssh/known_hosts, with the scanned fingerprint found in the IP address
ssh-keyscan hostname #Print the rsa1 host key for machine hostname
ssh-keyscan -p 22 10.0.2.15 #shows the different keys that have been scanned at port number 22 
ssh-keyscan -t rsa 10.0.2.15 #read all public keys of the rsa type from the IP address 10.0.2.15

#Find all hosts from the file ssh_hosts which have new or different keys from those in the sorted file ssh_known_hosts
"ssh-keyscan -t rsa,dsa -f ssh_hosts | sort -u - ssh_known_hosts | diff ssh_known_hosts -"
#The -t option has been used to retrieve the rsa keys, and the -f option has been used to retrieve the keys from the known_hosts file
ssh-keyscan -t rsa -f ~/.ssh/known_hosts | sort -u ~/.ssh/known_hosts
-----------------------------------------------------------------------------------------------------
 #troubleshooting
journalctl -u sshd
grep sshd /var/log/auth.log
grep sshd /var/log/secure

ssh -vvvvvv host
ssh -T [email protected] #verify your connection

#make sure you are connecting to the right domain
#check that the key is being used by trying to connect to [email protected]
#The "-1" at the end of the "identity file" lines means SSH couldn't find a file to use
#If a file existed, those lines would be "1" and "Offering public key", respectively
ssh -vT [email protected] 

ssh -G host


#putty debug on windows 11
Go to Logging Settings

In the left-hand tree menu, navigate to:
Session → Logging

Configure Logging

None → No logging (default).

Printable output → Logs only what appears in the terminal window (basic).

All session output → Logs all text sent to and from the session (medium detail).

SSH packets → Logs the contents of each SSH packet (higher detail, useful for debugging).

SSH packets and raw data → Logs packets plus raw hexadecimal dumps of data (maximum detail, very verbose).

For debugging authentication problems, “SSH packets and raw data” is best.

Choose a Log File Location

In “Log file name”, enter a file path, e.g.:
C:\Users\<YourUser>\putty_logs\ssh_debug.log

You can use PuTTY’s variables like &H (host) and &Y&M&D (date) to auto-name logs:
C:\Users\<YourUser>\putty_logs\&H-&Y&M&D-&T.log

Remember: SSH packets and raw data logs may include sensitive info (like passwords if keyboard-interactive is used).

Use only for debugging.

Delete or secure logs after you’re done.
-----------------------------------------------------------------------------------------------------
 ~/.ssh/known_hosts ->check host entries
 
ls -al ~/.ssh -> See if existing SSH keys are present
#[-t dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa] 
#RSA – 1024, 2048, or 4096 bit keys
ssh-keygen -t rsa -b 4096 -C "[email protected]" -> Generate a new SSH key (if there is no private/public keys)

#Make sure you have a key that is being used
eval "$(ssh-agent -s)" - > Start the ssh-agent in the background,If you are using Git Bash, turn on ssh-agent
eval $(ssh-agent -s) #start the ssh-agent in the background,If you are using another terminal prompt, such as Git for Windows, turn on ssh-agen

#Verify the public key is attached to your account
ssh-agent -s #Start SSH agent in the background
ssh-add -l -E sha256 #Find and take a note of your public key fingerprint

ssh-add ~/.ssh/id_rsa ->Add your SSH private key to the ssh-agent.
ssh-keygen -p -> change the passphrase for an existing private key without regenerating the keypair
ssh -T [email protected] -> Test your SSH connection  (If SSH is closed, Using SSH over the HTTPS port)

ssh -T -p 443 [email protected] -> To test if SSH over the HTTPS port is possible
~/.ssh/config -> Enabling SSH connections over HTTPS
~/.ssh/config -> Create config file
---config---
Host github.com
  Hostname ssh.github.com
  Port 443
---config---

ssh -T [email protected] -> Test  this configuration

PROBLEM:Bad owner or permissions on /home/userxx/.ssh/config
FIX:chmod 600 ~/.ssh/config


ONE USER HAS MULTIPLE GITHUB ACCOUNTS && SSH OVER HTTPS REQUIRED
one user has two profiles, such as githubPersonal && githubWork
githubPersonal has different account and repos on github
githubWork has different account and repos on github

~/.ssh

$ ssh-keygen -t rsa -b 4096 -C "email@githubPersonal" -> Generate a new SSH key (if there is no private/public keys)
$ ssh-keygen -t rsa -b 4096 -C "email@githubWork" -> Generate a new SSH key (if there is no private/public keys)
$ ssh-keygen -t rsa -b 4096 -f ~/.ssh/vps-cloud.web-server.key -C "My web-server key"

upload public keys on github
~/.ssh/id_rsa_personal.pub
~/.ssh/id_rsa_work.pub

 ~/.ssh/config

---config---
Host github-personal
  Hostname ssh.github.com
  user git
  Port 443
  IdentityFile ~/.ssh/id_rsa_github-personal

Host github-workfirst
  Hostname ssh.github.com
  user git
  Port 443
  IdentityFile ~/.ssh/id_rsa_github-workfirst
---config---

ssh-add -D -> Deletes all identities from the agent.

eval "$(ssh-agent -s)" - > Start the ssh-agent in the background

ssh-add id_rsa_personal -> Add new keys - private keys
ssh-add id_rsa_work -> Add new keys - private keys

ssh-add -l -> Test to make sure new keys are stored
ssh-add -l -E sha256 #Verify that you have a private key generated and loaded into SSH

ssh -T -p 443 [email protected] -> To test if SSH over the HTTPS port is possible
ssh -T git@githubworkfirst -> Test  this configuration

git clone git@github-workfirst:githubaccount1/testrepo1.git testdirectory1
git clone git@github-personal:githubaccount2/testrepo2.git testdirectory1

--------------------------------------------------------------------------------------------------------------------


$ eval "$(ssh-agent -s)" # start ssh-agent
Agent pid 580516
$ ssh-add ~/.ssh/id_rsa #Upload the private key that you generated
Identity added: /home/sshuser/.ssh/id_rsa (sshuser@vg-ubuntu-01)
$ ssh-add -l
4096 SHA256:1R37PbdplAwzHRECwPZGCVB27QSRwk+Z34LYNuUrv9U sshuser@vg-ubuntu-01 (RSA)
$ ssh-add -L
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDwjXzwttGq5qGcyZuStCzHy2Zu6g+2WGXNrUly10olY6nZBQE2pLPbbYwMavuQvyj7NHsyXH+3soVLiekkoLgZNpx1KAmqL7eqnGaio0mqJn5VGrM6hNSGj7D17kd9wc2ijIFZdCLVNmdrwTtf2OHSwVcUGcP1IVx6pQ3Odt8C2twg+BwEX11j37VuZdCP2IMvE/t+dRHH4Xf7naXFsJAZFj5H2S2usErswKC4e1PQY8Y4PwR1NRCpyxNT5ZgDq885KgeYy0ThdJveYV7wdRLzYdHHU3hLTE3X83JkPZdt/CI7fXmWjH58y9CS3EAfBnrzQVd67fCoA8PCW4ruYCNSNQT9nAHWFzBM9wwNhpHa9p5m2fWnJGZbLts/0xOct3eVnTEONqq8DneYPQO4MWDMk5ebYjYlW7f7PLCMawjadhh3gGEP6TfD0QP9wSOtNFpYFjPUoFvwgH1wL2XuoY8xgfZ5bir0mZF+z6bj/hZQK2DQwHJ0JkbFGQaengLT4AljaEnR5FI2FAmBTnsH2GNinASceCM1My4MLtkyc+ZWMj3/r9X7GCol4CGIgcguVJR6RHsBehFc7QraYC8xiSWynSSo+iL0S7/2yzx6BY4urM7HHVVCuVAWo8ZxD4MaJEZZjAF33/L3ZHMhHQRQGqnTGZoV6Sf6rSeghNlt171wrw== sshuser@vg-ubuntu-01
--------------------------------------------------------------------------------------------------------------------
$ eval "$(ssh-agent -k)" # stop ssh-agent
Agent pid 580516 killed

if [ $(ps ax | grep [s]sh-agent | wc -l) -gt 0 ] ; then echo "ssh-agent is already running";else echo "ssh-agent is not running"; fi

$ cat $HOME/.ssh-agent
$ cat ~/.ssh-agent
SSH_AUTH_SOCK=/tmp/ssh-KAWKW9dtK6iJ/agent.582546; export SSH_AUTH_SOCK;
SSH_AGENT_PID=582547; export SSH_AGENT_PID;
echo Agent pid 582547;

#list all ssh-agents and kill all
sshuser@vg-ubuntu-01:~$ eval "$(ssh-agent -s)"
Agent pid 580952
sshuser@vg-ubuntu-01:~$ echo $(pidof ssh-agent)
580952
sshuser@vg-ubuntu-01:~$ eval "$(ssh-agent -s)"
Agent pid 580967
sshuser@vg-ubuntu-01:~$ echo $(pidof ssh-agent)
580967 580952
sshuser@vg-ubuntu-01:~$ killall ssh-agent
sshuser@vg-ubuntu-01:~$ echo $(pidof ssh-agent)

$ eval "$(ssh-agent -s)"
Agent pid 581391
$ pgrep -u $USER -n ssh-agent -a
581391 ssh-agent -s
$ export SSH_AGENT_PID=$(pgrep -u $USER -n ssh-agent) && echo $SSH_AGENT_PID
581391

eval "$(ssh-agent -s)" # start ssh-agent
eval `ssh-agent` # start ssh-agent
SSH_AGENT_PID="$(pidof ssh-agent)" ssh-agent -k # stop ssh-agent
kill -9 $(pidof ssh-agent) # stop ssh-agent
eval "$(ssh-agent -k)" # stop ssh-agent

start the ssh-agent
$ exec ssh-agent bash
add the ~/.ssh/id_rsa, ~/.ssh/id_dsa and ~/.ssh/identity files to ssh-agent
$ ssh-add
Display the entries loaded in ssh-agent
$ ssh-add -l #Lists fingerprints of all identities currently represented by the agent.
$ ssh-add -L #the -L option allows you to view the public keys of the identities ssh-agent currently maintains.
Delete all entries from ssh-agent
$ ssh-add -D
Delete specific entries from ssh-agent
$ ssh-add -d /home/ramesh/.ssh/id_rsa
Lock (or) Unlock the SSH Agent
$ ssh-add -x
-----------------------------------------------------------------------------------------------------
# add a passphrase to ssh-agent and you will not be prompted for it when using ssh or scp/sftp/rsync to connect to hosts with your public key
eval $(ssh-agent)
# Type the ssh-add command to prompt the user for a private key passphrase and adds it to the list maintained by ssh-agent command
ssh-add
#add or replace a passphrase for an existing private key
ssh-keygen -p
#backup an existing private/public key
rsync -avr $HOME/.ssh [email protected]:/path/to/encrpted/nas/partition/
cp -avr $HOME/.ssh/ /mnt/usb/backups/

 $HOME/.ssh/id_rsa– contains your private key.
 $HOME/.ssh/id_rsa.pub – contain your public key.
 
 ls -la .ssh
"id_rsa.pub" public keys
"id_rsa" private keys
"authorized_keys2" list of hosts authorized to login remotely using the private key
"known_hosts" list of remote hosts that users connect to from this host
-----------------------------------------------------------------------------------------------------
	Home directory on the server should not be writable by others: chmod go-w /home/$USER
	 home directory should not be writeable by the group or others 755 (drwxr-xr-x)
	 chmod g-w,o-w ~
	
	Make sure that user owns the files/folders and not root: chown user:user authorized_keys and chown user:user /home/$USER/.ssh
	SSH folder on the server needs 700 permissions: chmod 700 /home/$USER/.ssh
	
	#If you are still prompted for a password 
	ssh [remote_username]@[server_ip_address] "chmod 700 .ssh; chmod 640 .ssh/authorized_keys"
	Set permissions 700 for the .ssh directory.
	Set permissions 640 for the .ssh/authorized_keys directory.
	
	the directory containing your .ssh directory must not be writeable by group or other. Thus chmod go-w ~
	public key (.pub file): 644 (-rw-r--r--)
	private key (id_rsa): 600 (-rw-------)
	Authorized_keys file needs 644 permissions: chmod 644 /home/$USER/.ssh/authorized_key
	Put the generated public key (from ssh-keygen) in the user's authorized_keys file on the server
	restart ssh: service ssh restart
	make sure client has the public key and private key files in the local user's .ssh folder and login: ssh [email protected]
	------------------------------------------------------------------------------------------
	.ssh directory itself must be writable only by you: 
	chmod 700 ~/.ssh 
	or 
	chmod u=rwx,go= ~/.ssh.
	chmod 600 ~/.ssh/id_rsa;  or chmod 400 ~/.ssh/id_rsa; (private key protection)
	chmod 600 ~/.ssh/id_rsa.pub (i.e. chmod u=rw,go= ~/.ssh/id_rsa ~/.ssh/id_rsa.pub)
	or 
	chmod 644 ~/.ssh/id_rsa.pub (i.e. chmod a=r,u+w ~/.ssh/id_rsa.pub) 
------------------------------------------------------------------------------------------
	chmod 700 ~/.ssh
	chmod 644 ~/.ssh/authorized_keys
	chmod 644 ~/.ssh/known_hosts
	chmod 644 ~/.ssh/config
	chmod 600 ~/.ssh/id_rsa
	chmod 644 ~/.ssh/id_rsa.pub
	chmod 600 ~/.ssh/github_rsa
	chmod 644 ~/.ssh/github_rsa.pub
	chmod 600 ~/.ssh/mozilla_rsa
	chmod 644 ~/.ssh/mozilla_rsa.pub
    

------------------------------------------------------------------------------------------
 # copy public key method 
 ssh [email protected] "chmod 700 .ssh; chmod 600 .ssh/authorized_keys
 # copy public key method 
 cat ~/.ssh/id_rsa.pub | ssh username@remote_host "mkdir -p ~/.ssh && touch ~/.ssh/authorized_keys && chmod -R go= ~/.ssh && cat >> ~/.ssh/authorized_keys"
 # copy public key method 
 ssh-copy-id -i ~/.ssh/id_rsa.pub user@remote-server
 # copy public key method 
 scp -pr  ~/.ssh/id_rsa.pub [email protected]:/tmp
 # copy public key method 
 cat ~/.ssh/id_rsa.pub | ssh username@remote_host "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"
# copy public key method 
# cat ~/.ssh/id_rsa.pub | ssh user@remote-host "cat >> ~/.ssh/authorized_keys"
 
 #copy mykey.rsa.pub to the target server (not id_rsa.pub)
 #the target server has the host server key (hostkey.rsa.pub) in .ssh/authorized_keys
 ssh-copy-id -i mykey.rsa.pub -o "IdentityFile hostkey.rsa" user@target 
 ssh-copy-id -f -i hostkey.rsa.pub user@target
 
 # change is the listening port number
 # vi /etc/ssh/sshd_config
 Port 22
 Port 2022
 
 echo public_key_string >> ~/.ssh/authorized_keys
 
 # if StrictModes is set to yes in /etc/ssh/sshd_config (the default)
 #machine, keys created
$ chmod 700 ~/.ssh
$ chmod 600 ~/.ssh/id_rsa 
 #destination machine
 chmod 700 ~/.ssh
 chmod 600 ~/.ssh/authorized_keys
 
------------------------------------------------------------------------------------------
servera - server
serverb - server

***servera
$ systemctl status ssh # verify ssh running
$ systemctl status ssh # verify sshd running
● ssh.service - OpenBSD Secure Shell server
   Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
   Active: active (running) since Paz 2019-06-23 16:07:02 +03; 27min ago
 Main PID: 5373 (sshd)
   CGroup: /system.slice/ssh.service
           └─5373 /usr/sbin/sshd -D
 $ cat /etc/passwd | grep vagrant # verify user
vagrant:x:1003:1004::/home/vagrant:
 $ cat .ssh/authorized_keys # verify copied public key

 ***serverb
 $ systemctl status ssh # verify ssh running
  $ systemctl status sshd # verify ssh running
 $ cat /etc/passwd | grep vagrant # verify user
 vagrant:x:1003:1004::/home/vagrant:
 $ ssh-keygen -t rsa
 $ ssh-copy-id -i $HOME/.ssh/id_rsa.pub vagrant@servera # copy public key method 1
 $ scp $HOME/.ssh/id_rsa.pub vagrant@servera:~/.ssh/authorized_keys # copy public key method 2
 $ cat $HOME/.ssh/id_rsa.pub | ssh vagrant@servera "cat >> .ssh/authorized_keys" # copy public key method 3
 $ ssh vagrant@servera # test passwordless public key-based authentication
 $ scp foo.txt vagrant@servera:/tmp/ # test passwordless public key-based authentication
$ cat .ssh/id_rsa.pub # view public key

#ssh-copy-id is a script that uses ssh(1) to log into a remote machine 
#(presumably using a login password, so password authentication should be enabled
#Upload Public Key Using the ssh-copy-id,The public key is then automatically copied into the .ssh/authorized_keys file
ssh-copy-id [remote_username]@[server_ip_address] 

#Upload Public Key Using the cat Command
ssh [remote_username]@[server_ip_address] mkdir -p .ssh #connecting to the server and creating a .ssh directory on it
#upload the public key from the local machine to the remote server,the key will be stored under the name authorized_keys in the newly created .ssh directory
cat .ssh/id_rsa.pub | ssh [remote_username]@[server_ip_address] 'cat >> .ssh/authorized_keys'
ssh [remote_username]@[server_ip_address] #og in to Server Without Password

debug mode, verbose
scp -r -vvvv /tmp/${HOST1}/* ${HOST1}:/tmp
----------------------------------------------------------------------------------------------------
#The guest user will be authenticated by a dedicated SSH key, generated on the client 
#(the machine from which guest is supposed to log in) with
#which also generates the public key guest.key.pub that needs to be copied to the server.

ssh-keygen -t rsa -b 4096 -f guest.key
ssh-add guest.key

#After logging in to the server as ubuntu (or any other superuser) over SSH, create a new user with
sudo adduser --disabled-password guest

sudo mkdir /home/guest/.ssh
sudo nano /home/guest/.ssh/authenticated_keys #the entire content of the file guest.pub

sudo chmod 0755 /home/guest/.ssh
sudo chmod 0644 /home/guest/.ssh/authenticated_keys

ssh -i guest.key guest@<ip-address> #login as guest

-----------------------------------------------------------------------------------------
#when you type ssh user@private1 SSH will establish a connection to the bastion host 
#and then through the bastion host connect to “private1”, using the specified keys
#run "who" on the remote node,see the connections are coming from the bastion host, not the original SSH client

Host private1
  IdentityFile ~/.ssh/rsa_private_key
  ProxyCommand ssh user@bastion -W %h:%p

Host bastion
  IdentityFile ~/.ssh/bastion_rsa_key
------------------------------------------------------------------------------------------
Problem:
ssh debug powershell

$ ssh -i privatekey.ppk ubuntu@SERVERIP

$ ssh -i privatekey.ppk -v ubuntu@SERVERIP

-v → basic debugging (auth methods, key tries, success/fail)
-vv → more detail (key fingerprint matches, negotiation)
-vvv → very verbose (packet-level info)

Permissions 0644 for 'privatekey.ppk' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "privatekey.ppk": bad permissions
Permission denied (publickey).

fix:
chmod 600 privatekey.ppk
------------------------------------------------------------------------------------------
private key and public key generated by puttygen on Windows

Problem:
“couldn't load private key - Putty key format too new.” This issue happens when you use PuTTygen to generate or convert to a ppk key”
PuTTY doesn't support the SSH private key format
convert the private key to the PuTTY required format

fix:
puttygen
private key should have a ppk format
Change the PuTTygen PPK File Version to version 2
-----------------------------------------------------------------------------------------
private key and public key generated by puttygen on Windows

#convert .ppk under to openssh keys on Windows
Putty Key Generator - Load private key 
Putty Key Generator - Conversions - Export OpenSSH key

-----------------------------------------------------------------------------------------