ssh
SSHPackage: openssh-client
Opens a session or runs a command on a remote machine, in an encrypted, authenticated channel. The first connection asks you to check the server's fingerprint; it is the only moment when that check means anything.
What its options do in the lessons
From the same glossary the lessons render under their commands, so the two cannot disagree.
ssh -v- Verbose: prints each step of the negotiation. The first thing to run when a connection fails with no clear message.
ssh -T- Allocates no terminal. Used to test an access that must not open an interactive session, such as Git’s.
ssh -i- Names the private key to offer, instead of letting the client try whichever ones it finds in
~/.ssh. Useful for proving which key was used. ssh -L- Local forwarding: opens a port on your machine whose traffic comes back out of the server towards
host:port.-L 5432:127.0.0.1:5432reaches a database listening only on the server's loopback, with no need to expose it. ssh -A- Forwards the authentication agent to the remote machine. No key is copied there: a socket is placed on it, and anyone able to open that socket — root included — has your agent sign on their behalf, for as long as the session lasts.
ssh -J- Reaches the destination through an intermediate machine: the final connection is built from your own workstation, through a tunnel, and the jump host only carries bytes it cannot read. The command-line form of
ProxyJump, and the answer to prefer over-A. ssh -N- Runs no remote command: the connection exists only to carry the forwardings asked for by
-Lor-R. It is the shape of a pure tunnel, and it is also what a restricted key should be refused.
Lessons that teach it
- Connecting for the first timeYour first server
- Moving SSH to key authenticationUsers, sudo and SSH access
- The agent, the passphrase, and what ssh -A really lendsUsers, sudo and SSH access
- A key is a line, and the line takes optionsUsers, sudo and SSH access
- Git on the server: a read-only key, and .git out of the web rootDeploying: releases, the switch and rolling back
- Reachable from elsewhere: four gates, four different refusalsAdministering PostgreSQL: access, connections and growth