SSH Mastery: config, keys, agents & tunnels

A ~/.ssh/config that saves your fingers, key hygiene, agent forwarding and port tunnels.

If you type ssh -i ~/keys/whatever.pem -p 2222 [email protected] more than once, you are working too hard. SSH's config file and tunnels are where it becomes a power tool.

~/.ssh/config — name your servers

Define a Host alias once and then just ssh web1. It sets the user, port, key, and even a jump host. It also feeds scp, rsync and git, so everything gets shorter.

Keys and the agent

Prefer ssh-keygen -t ed25519 — shorter, faster, and stronger than old RSA keys.
ssh-copy-id host installs your public key; never copy the private key to a server.
Run ssh-agent so a passphrase-protected key is unlocked once per session; ssh-add loads it.
Use a jump host (ProxyJump) to reach private boxes through a bastion, instead of agent-forwarding into untrusted hosts.

Tunnels

Local forward -L 5432:localhost:5432 db — reach a remote database on your own localhost:5432, through the encrypted link.
Remote forward -R — expose a local service to the remote side.
Dynamic -D 1080 — a quick SOCKS proxy for browsing through the server.

Example

# ~/.ssh/config
# Host web1
#     HostName 203.0.113.10
#     User ubuntu
#     Port 2222
#     IdentityFile ~/.ssh/ed25519_prod
#
# Host db
#     HostName 10.0.5.20
#     User admin
#     ProxyJump web1          # reach the private db via the bastion

# Now everything is short and also works for scp/rsync/git
ssh web1
scp report.pdf web1:/srv/

# Modern key, then install the PUBLIC half on the server
ssh-keygen -t ed25519 -C "laptop-2026"
ssh-copy-id web1

# Tunnel a remote-only Postgres to your local machine
ssh -L 5432:localhost:5432 db
# elsewhere:  psql -h localhost -p 5432

# Quick SOCKS proxy for browsing through the server
ssh -D 1080 web1

When to use it

A developer adds a Host block in ~/.ssh/config to connect to a bastion-gated server with 'ssh prod' instead of typing the full IP, port, and key path.
A sysadmin uses SSH agent forwarding ('ssh -A jumphost') to authenticate to internal servers from a bastion without copying private keys there.
A DevOps engineer sets up a dynamic SOCKS proxy with 'ssh -D 1080' to securely route browser traffic through an SSH server in a private network.

More examples

Powerful ~/.ssh/config blocks

Defines a Host alias in ~/.ssh/config that bundles hostname, user, port, and key so a single word connects.

# ~/.ssh/config
Host prod
  HostName server.example.com
  User deploy
  Port 2222
  IdentityFile ~/.ssh/deploy_key
  ServerAliveInterval 60

# Now connect simply with:
ssh prod

SSH agent and forwarding

Shows ssh-agent loading a key and -A forwarding it through the bastion so internal servers never hold the private key.

# Start the agent and load your key
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

# Connect to bastion with agent forwarding
ssh -A [email protected]

# From the bastion, connect to internal servers
# using your local key (never copied to bastion)
ssh internal-server

Port forwarding and SOCKS proxy

Shows -L for forwarding a specific port and -D for a dynamic SOCKS proxy that routes all traffic through SSH.

# Local forward: access remote Postgres via localhost
ssh -L 5432:db.internal:5432 [email protected]

# Dynamic SOCKS proxy on port 1080
ssh -D 1080 -N [email protected]
# Configure browser to use SOCKS5 proxy at 127.0.0.1:1080

Discussion

Be the first to comment on this lesson.