ssh command: log in to another machine

Syntax

ssh [options] [user@]host [command]

It logs you in to the host. Add a command at the end and it runs just that, then comes back.

Try it first

$ ssh deploy@server.example.com
deploy@server.example.com: Permission denied (publickey).

Refused. That message means the server does not know your key yet, so start by getting your public key onto it.

Making a key and handing it over

Create the pair on your own machine.

$ ssh-keygen -t ed25519

You get ~/.ssh/id_ed25519, the private key, and ~/.ssh/id_ed25519.pub, the public one. The private key never leaves your machine. Only the .pub half is meant to be handed out.

$ ssh-copy-id deploy@server.example.com
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/user/.ssh/id_ed25519.pub"

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'deploy@server.example.com'"
and check to make sure that only the key(s) you wanted were added.

Your public key is now in the server's ~/.ssh/authorized_keys.

Running one command

Put a command after the host and ssh runs only that.

$ ssh deploy@server.example.com df -h /
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        20G  5.0G   14G  27% /

For "just check the disk" or "just show me the end of the log", this is much faster than logging in.

Logging in and back out

With no command, you get a session.

$ ssh deploy@server.example.com

A Welcome to Ubuntu ... banner and a last login line mean you are in. Everything you type from here runs on the remote machine.

$ pwd
/home/deploy

That is the server's home directory, not yours. exit brings you back.

$ exit
Connection to server.example.com closed.
$ pwd
/home/user/project

Sending a file

The same key works for copying files.

$ scp app.tar.gz deploy@server.example.com:/home/deploy/
app.tar.gz                     100%     8     0.0KB/s   00:00

One remote ls confirms it arrived.

$ ssh deploy@server.example.com ls
app.tar.gz

When you actually reach for it

ssh is what you type to work on a machine that is not in front of you.

Things that trip people up

Permission denied (publickey) is about the key, not a password. Nothing was mistyped. Check that ssh-copy-id really ran, and that it added the key for the user you are logging in as.

The host key question appears once.

The authenticity of host 'server.example.com' can't be established.
ED25519 key fingerprint is SHA256:3f8ad0d23f8a....
Are you sure you want to continue connecting (yes/no)?

Answering yes records it in ~/.ssh/known_hosts, and you are never asked again. The terminal on this page starts with that already accepted. Do not wave away the same warning later on, though: it means the host key changed, and the machine you are reaching may not be the one you think.

Never send the private key. Only the .pub half goes to the server. If a private key does get sent somewhere, replace the pair.

When it will not connect, check that you are reaching the host at all.

$ ssh nosuchuser@unreachable.host
ssh: connect to host unreachable.host port 22: Connection timed out

An error in this shape has nothing to do with keys. Check the host name, the port, and the network path in that order.