SSH 远程连接与安全协议

精选 SSH 远程连接与安全协议 常用指令与核心速查备忘单，涵盖高频用法、配置参数与实用技巧。

Star 项目
关注 X (Twitter)
赞赏饮咖啡

#入门指南

#连接服务器 (Connecting)

连接到服务器（默认端口 22）

$ ssh root@192.168.1.5

指定端口连接

$ ssh root@192.168.1.5 -p 6222

通过 pem 文件连接（权限 0400）

$ ssh -i /path/file.pem root@192.168.1.5

参阅: SSH Permissions

#远程执行命令 (Executing)

执行远程命令

$ ssh root@192.168.1.5 'ls -l'

Invoke a local script

$ ssh root@192.168.1.5 bash < script.sh

Compresses and downloads from a server

$ ssh root@192.168.1.5 "tar cvzf - ~/source" > output.tgz

#SCP 文件传输

Copies from remote to local

$ scp user@server:/dir/file.ext dest/

Copies between two servers

$ scp user@server:/file user@server:/dir

Copies from local to remote

$ scp dest/file.ext user@server:/dir

Copies a whole folder

$ scp -r user@server:/dir dest/

Copies all files from a folder

$ scp user@server:/dir/* dest/

Copies from a server folder to the current folder

$ scp user@server:/dir/* .

#配置文件位置 (Config location)

File Path Description
/etc/ssh/ssh_config System-wide config
~/.ssh/config User-specific config
~/.ssh/id_{type} Private key
~/.ssh/id_{type}.pub Public key
~/.ssh/known_hosts Known Servers
~/.ssh/authorized_keys Authorized login key

#SCP 选项 (SCP Options)

Options Description
scp -r Recursively copy entire directories
scp -C Compresses data
scp -v Prints verbose info
scp -P 8080 Uses a specific Port
scp -B Batch mode (Prevents password)
scp -p Preserves times and modes

#配置示例 (Config sample)

Host server1
    HostName 192.168.1.5
    User root
    Port 22
    IdentityFile ~/.ssh/server1.key

Launch by alias

$ ssh server1

See: Full Config Options

#ProxyJump 跳板

$ ssh -J proxy_host1 remote_host2

$ ssh -J user@proxy_host1 user@remote_host2

Multiple jumps

$ ssh -J user@proxy_host1:port1,user@proxy_host2:port2 user@remote_host3

#ssh-copy-id 拷贝公钥

$ ssh-copy-id user@server

Copy to alias server

$ ssh-copy-id server1

Copy specific key

$ ssh-copy-id -i ~/.ssh/id_rsa.pub user@server

#SSH 密钥生成

#ssh-keygen 命令

$ ssh-keygen -t rsa -b 4096 -C "your@mail.com"
- - -

#入门指南

#连接服务器 (Connecting)

连接到服务器（默认端口 22）

$ ssh root@192.168.1.5

指定端口连接

$ ssh root@192.168.1.5 -p 6222

通过 pem 文件连接（权限 0400）

$ ssh -i /path/file.pem root@192.168.1.5

参阅: SSH Permissions

#远程执行命令 (Executing)

执行远程命令

$ ssh root@192.168.1.5 'ls -l'

Invoke a local script

$ ssh root@192.168.1.5 bash < script.sh

Compresses and downloads from a server

$ ssh root@192.168.1.5 "tar cvzf - ~/source" > output.tgz

#SCP 文件传输

Copies from remote to local

$ scp user@server:/dir/file.ext dest/

Copies between two servers

$ scp user@server:/file user@server:/dir

Copies from local to remote

$ scp dest/file.ext user@server:/dir

Copies a whole folder

$ scp -r user@server:/dir dest/

Copies all files from a folder

$ scp user@server:/dir/* dest/

Copies from a server folder to the current folder

$ scp user@server:/dir/* .

#配置文件位置 (Config location)

File Path Description
/etc/ssh/ssh_config System-wide config
~/.ssh/config User-specific config
~/.ssh/id_{type} Private key
~/.ssh/id_{type}.pub Public key
~/.ssh/known_hosts Known Servers
~/.ssh/authorized_keys Authorized login key

#SCP 选项 (SCP Options)

Options Description
scp -r Recursively copy entire directories
scp -C Compresses data
scp -v Prints verbose info
scp -P 8080 Uses a specific Port
scp -B Batch mode (Prevents password)
scp -p Preserves times and modes

#配置示例 (Config sample)

Host server1
    HostName 192.168.1.5
    User root
    Port 22
    IdentityFile ~/.ssh/server1.key

Launch by alias

$ ssh server1

See: Full Config Options

#ProxyJump 跳板

$ ssh -J proxy_host1 remote_host2

$ ssh -J user@proxy_host1 user@remote_host2

Multiple jumps

$ ssh -J user@proxy_host1:port1,user@proxy_host2:port2 user@remote_host3

#ssh-copy-id 拷贝公钥

$ ssh-copy-id user@server

Copy to alias server

$ ssh-copy-id server1

Copy specific key

$ ssh-copy-id -i ~/.ssh/id_rsa.pub user@server

#SSH 密钥生成

#ssh-keygen 命令

$ ssh-keygen -t rsa -b 4096 -C "your@mail.com"
- - -

#入门指南

#连接服务器 (Connecting)

连接到服务器（默认端口 22）

$ ssh root@192.168.1.5

指定端口连接

$ ssh root@192.168.1.5 -p 6222

通过 pem 文件连接（权限 0400）

$ ssh -i /path/file.pem root@192.168.1.5

参阅: SSH Permissions

#远程执行命令 (Executing)

执行远程命令

$ ssh root@192.168.1.5 'ls -l'

Invoke a local script

$ ssh root@192.168.1.5 bash < script.sh

Compresses and downloads from a server

$ ssh root@192.168.1.5 "tar cvzf - ~/source" > output.tgz

#SCP 文件传输

Copies from remote to local

$ scp user@server:/dir/file.ext dest/

Copies between two servers

$ scp user@server:/file user@server:/dir

Copies from local to remote

$ scp dest/file.ext user@server:/dir

Copies a whole folder

$ scp -r user@server:/dir dest/

Copies all files from a folder

$ scp user@server:/dir/* dest/

Copies from a server folder to the current folder

$ scp user@server:/dir/* .

#配置文件位置 (Config location)

File Path Description
/etc/ssh/ssh_config System-wide config
~/.ssh/config User-specific config
~/.ssh/id_{type} Private key
~/.ssh/id_{type}.pub Public key
~/.ssh/known_hosts Known Servers
~/.ssh/authorized_keys Authorized login key

#SCP 选项 (SCP Options)

Options Description
scp -r Recursively copy entire directories
scp -C Compresses data
scp -v Prints verbose info
scp -P 8080 Uses a specific Port
scp -B Batch mode (Prevents password)
scp -p Preserves times and modes

#配置示例 (Config sample)

Host server1
    HostName 192.168.1.5
    User root
    Port 22
    IdentityFile ~/.ssh/server1.key

Launch by alias

$ ssh server1

See: Full Config Options

#ProxyJump 跳板

$ ssh -J proxy_host1 remote_host2

$ ssh -J user@proxy_host1 user@remote_host2

Multiple jumps

$ ssh -J user@proxy_host1:port1,user@proxy_host2:port2 user@remote_host3

#ssh-copy-id 拷贝公钥

$ ssh-copy-id user@server

Copy to alias server

$ ssh-copy-id server1

Copy specific key

$ ssh-copy-id -i ~/.ssh/id_rsa.pub user@server

#SSH 密钥生成

#ssh-keygen 命令

$ ssh-keygen -t rsa -b 4096 -C "your@mail.com"
- - -

#入门指南

#连接服务器 (Connecting)

连接到服务器（默认端口 22）

$ ssh root@192.168.1.5

指定端口连接

$ ssh root@192.168.1.5 -p 6222

通过 pem 文件连接（权限 0400）

$ ssh -i /path/file.pem root@192.168.1.5

参阅: SSH Permissions

#远程执行命令 (Executing)

执行远程命令

$ ssh root@192.168.1.5 'ls -l'

Invoke a local script

$ ssh root@192.168.1.5 bash < script.sh

Compresses and downloads from a server

$ ssh root@192.168.1.5 "tar cvzf - ~/source" > output.tgz

#SCP 文件传输

Copies from remote to local

$ scp user@server:/dir/file.ext dest/

Copies between two servers

$ scp user@server:/file user@server:/dir

Copies from local to remote

$ scp dest/file.ext user@server:/dir

Copies a whole folder

$ scp -r user@server:/dir dest/

Copies all files from a folder

$ scp user@server:/dir/* dest/

Copies from a server folder to the current folder

$ scp user@server:/dir/* .

#配置文件位置 (Config location)

File Path Description
/etc/ssh/ssh_config System-wide config
~/.ssh/config User-specific config
~/.ssh/id_{type} Private key
~/.ssh/id_{type}.pub Public key
~/.ssh/known_hosts Known Servers
~/.ssh/authorized_keys Authorized login key

#SCP 选项 (SCP Options)

Options Description
scp -r Recursively copy entire directories
scp -C Compresses data
scp -v Prints verbose info
scp -P 8080 Uses a specific Port
scp -B Batch mode (Prevents password)
scp -p Preserves times and modes

#配置示例 (Config sample)

Host server1
    HostName 192.168.1.5
    User root
    Port 22
    IdentityFile ~/.ssh/server1.key

Launch by alias

$ ssh server1

See: Full Config Options

#ProxyJump 跳板

$ ssh -J proxy_host1 remote_host2

$ ssh -J user@proxy_host1 user@remote_host2

Multiple jumps

$ ssh -J user@proxy_host1:port1,user@proxy_host2:port2 user@remote_host3

#ssh-copy-id 拷贝公钥

$ ssh-copy-id user@server

Copy to alias server

$ ssh-copy-id server1

Copy specific key

$ ssh-copy-id -i ~/.ssh/id_rsa.pub user@server

#SSH 密钥生成

#ssh-keygen 命令

$ ssh-keygen -t rsa -b 4096 -C "your@mail.com"
- - -

#入门指南

#连接服务器 (Connecting)

连接到服务器（默认端口 22）

$ ssh root@192.168.1.5

指定端口连接

$ ssh root@192.168.1.5 -p 6222

通过 pem 文件连接（权限 0400）

$ ssh -i /path/file.pem root@192.168.1.5

参阅: SSH Permissions

#远程执行命令 (Executing)

执行远程命令

$ ssh root@192.168.1.5 'ls -l'

Invoke a local script

$ ssh root@192.168.1.5 bash < script.sh

Compresses and downloads from a server

$ ssh root@192.168.1.5 "tar cvzf - ~/source" > output.tgz

#SCP 文件传输

Copies from remote to local

$ scp user@server:/dir/file.ext dest/

Copies between two servers

$ scp user@server:/file user@server:/dir

Copies from local to remote

$ scp dest/file.ext user@server:/dir

Copies a whole folder

$ scp -r user@server:/dir dest/

Copies all files from a folder

$ scp user@server:/dir/* dest/

Copies from a server folder to the current folder

$ scp user@server:/dir/* .

#配置文件位置 (Config location)

File Path Description
/etc/ssh/ssh_config System-wide config
~/.ssh/config User-specific config
~/.ssh/id_{type} Private key
~/.ssh/id_{type}.pub Public key
~/.ssh/known_hosts Known Servers
~/.ssh/authorized_keys Authorized login key

#SCP 选项 (SCP Options)

Options Description
scp -r Recursively copy entire directories
scp -C Compresses data
scp -v Prints verbose info
scp -P 8080 Uses a specific Port
scp -B Batch mode (Prevents password)
scp -p Preserves times and modes

#配置示例 (Config sample)

Host server1
    HostName 192.168.1.5
    User root
    Port 22
    IdentityFile ~/.ssh/server1.key

Launch by alias

$ ssh server1

See: Full Config Options

#ProxyJump 跳板

$ ssh -J proxy_host1 remote_host2

$ ssh -J user@proxy_host1 user@remote_host2

Multiple jumps

$ ssh -J user@proxy_host1:port1,user@proxy_host2:port2 user@remote_host3

#ssh-copy-id 拷贝公钥

$ ssh-copy-id user@server

Copy to alias server

$ ssh-copy-id server1

Copy specific key

$ ssh-copy-id -i ~/.ssh/id_rsa.pub user@server

#SSH 密钥生成

#ssh-keygen 命令

$ ssh-keygen -t rsa -b 4096 -C "your@mail.com"
- - -

#入门指南

#连接服务器 (Connecting)

连接到服务器（默认端口 22）

$ ssh root@192.168.1.5

指定端口连接

$ ssh root@192.168.1.5 -p 6222

通过 pem 文件连接（权限 0400）

$ ssh -i /path/file.pem root@192.168.1.5

参阅: SSH Permissions

#远程执行命令 (Executing)

执行远程命令

$ ssh root@192.168.1.5 'ls -l'

Invoke a local script

$ ssh root@192.168.1.5 bash < script.sh

Compresses and downloads from a server

$ ssh root@192.168.1.5 "tar cvzf - ~/source" > output.tgz

#SCP 文件传输

Copies from remote to local

$ scp user@server:/dir/file.ext dest/

Copies between two servers

$ scp user@server:/file user@server:/dir

Copies from local to remote

$ scp dest/file.ext user@server:/dir

Copies a whole folder

$ scp -r user@server:/dir dest/

Copies all files from a folder

$ scp user@server:/dir/* dest/

Copies from a server folder to the current folder

$ scp user@server:/dir/* .

#配置文件位置 (Config location)

File Path Description
/etc/ssh/ssh_config System-wide config
~/.ssh/config User-specific config
~/.ssh/id_{type} Private key
~/.ssh/id_{type}.pub Public key
~/.ssh/known_hosts Known Servers
~/.ssh/authorized_keys Authorized login key

#SCP 选项 (SCP Options)

Options Description
scp -r Recursively copy entire directories
scp -C Compresses data
scp -v Prints verbose info
scp -P 8080 Uses a specific Port
scp -B Batch mode (Prevents password)
scp -p Preserves times and modes

#配置示例 (Config sample)

Host server1
    HostName 192.168.1.5
    User root
    Port 22
    IdentityFile ~/.ssh/server1.key

Launch by alias

$ ssh server1

See: Full Config Options

#ProxyJump 跳板

$ ssh -J proxy_host1 remote_host2

$ ssh -J user@proxy_host1 user@remote_host2

Multiple jumps

$ ssh -J user@proxy_host1:port1,user@proxy_host2:port2 user@remote_host3

#ssh-copy-id 拷贝公钥

$ ssh-copy-id user@server

Copy to alias server

$ ssh-copy-id server1

Copy specific key

$ ssh-copy-id -i ~/.ssh/id_rsa.pub user@server

#SSH 密钥生成

#ssh-keygen 命令

$ ssh-keygen -t rsa -b 4096 -C "your@mail.com"
- - -

#入门指南

#连接服务器 (Connecting)

连接到服务器（默认端口 22）

$ ssh root@192.168.1.5

指定端口连接

$ ssh root@192.168.1.5 -p 6222

通过 pem 文件连接（权限 0400）

$ ssh -i /path/file.pem root@192.168.1.5

参阅: SSH Permissions

#远程执行命令 (Executing)

执行远程命令

$ ssh root@192.168.1.5 'ls -l'

Invoke a local script

$ ssh root@192.168.1.5 bash < script.sh

Compresses and downloads from a server

$ ssh root@192.168.1.5 "tar cvzf - ~/source" > output.tgz

#SCP 文件传输

Copies from remote to local

$ scp user@server:/dir/file.ext dest/

Copies between two servers

$ scp user@server:/file user@server:/dir

Copies from local to remote

$ scp dest/file.ext user@server:/dir

Copies a whole folder

$ scp -r user@server:/dir dest/

Copies all files from a folder

$ scp user@server:/dir/* dest/

Copies from a server folder to the current folder

$ scp user@server:/dir/* .

#配置文件位置 (Config location)

File Path Description
/etc/ssh/ssh_config System-wide config
~/.ssh/config User-specific config
~/.ssh/id_{type} Private key
~/.ssh/id_{type}.pub Public key
~/.ssh/known_hosts Known Servers
~/.ssh/authorized_keys Authorized login key

#SCP 选项 (SCP Options)

Options Description
scp -r Recursively copy entire directories
scp -C Compresses data
scp -v Prints verbose info
scp -P 8080 Uses a specific Port
scp -B Batch mode (Prevents password)
scp -p Preserves times and modes

#配置示例 (Config sample)

Host server1
    HostName 192.168.1.5
    User root
    Port 22
    IdentityFile ~/.ssh/server1.key

Launch by alias

$ ssh server1

See: Full Config Options

#ProxyJump 跳板

$ ssh -J proxy_host1 remote_host2

$ ssh -J user@proxy_host1 user@remote_host2

Multiple jumps

$ ssh -J user@proxy_host1:port1,user@proxy_host2:port2 user@remote_host3

#ssh-copy-id 拷贝公钥

$ ssh-copy-id user@server

Copy to alias server

$ ssh-copy-id server1

Copy specific key

$ ssh-copy-id -i ~/.ssh/id_rsa.pub user@server

#SSH 密钥生成

#ssh-keygen 命令

$ ssh-keygen -t rsa -b 4096 -C "your@mail.com"
- - -

#入门指南

#连接服务器 (Connecting)

连接到服务器（默认端口 22）

$ ssh root@192.168.1.5

指定端口连接

$ ssh root@192.168.1.5 -p 6222

通过 pem 文件连接（权限 0400）

$ ssh -i /path/file.pem root@192.168.1.5

参阅: SSH Permissions

#远程执行命令 (Executing)

执行远程命令

$ ssh root@192.168.1.5 'ls -l'

Invoke a local script

$ ssh root@192.168.1.5 bash < script.sh

Compresses and downloads from a server

$ ssh root@192.168.1.5 "tar cvzf - ~/source" > output.tgz

#SCP 文件传输

Copies from remote to local

$ scp user@server:/dir/file.ext dest/

Copies between two servers

$ scp user@server:/file user@server:/dir

Copies from local to remote

$ scp dest/file.ext user@server:/dir

Copies a whole folder

$ scp -r user@server:/dir dest/

Copies all files from a folder

$ scp user@server:/dir/* dest/

Copies from a server folder to the current folder

$ scp user@server:/dir/* .

#配置文件位置 (Config location)

File Path Description
/etc/ssh/ssh_config System-wide config
~/.ssh/config User-specific config
~/.ssh/id_{type} Private key
~/.ssh/id_{type}.pub Public key
~/.ssh/known_hosts Known Servers
~/.ssh/authorized_keys Authorized login key

#SCP 选项 (SCP Options)

Options Description
scp -r Recursively copy entire directories
scp -C Compresses data
scp -v Prints verbose info
scp -P 8080 Uses a specific Port
scp -B Batch mode (Prevents password)
scp -p Preserves times and modes

#配置示例 (Config sample)

Host server1
    HostName 192.168.1.5
    User root
    Port 22
    IdentityFile ~/.ssh/server1.key

Launch by alias

$ ssh server1

See: Full Config Options

#ProxyJump 跳板

$ ssh -J proxy_host1 remote_host2

$ ssh -J user@proxy_host1 user@remote_host2

Multiple jumps

$ ssh -J user@proxy_host1:port1,user@proxy_host2:port2 user@remote_host3

#ssh-copy-id 拷贝公钥

$ ssh-copy-id user@server

Copy to alias server

$ ssh-copy-id server1

Copy specific key

$ ssh-copy-id -i ~/.ssh/id_rsa.pub user@server

#SSH 密钥生成

#ssh-keygen 命令

$ ssh-keygen -t rsa -b 4096 -C "your@mail.com"
- - -
标志位 参数作用与描述
-t 生成密钥的算法类型
-b 密钥长度位数 (Bits)
-C 添加注释信息 (如邮箱或描述)

生成一个长度为 4096 位的 RSA 密钥，或使用在线 SSH 密钥生成器

#秘钥生成与维护操作

交互式生成密钥对

$ ssh-keygen

指定密钥保存的文件路径

$ ssh-keygen -f ~/.ssh/filename

根据私钥导出对应的公钥

$ ssh-keygen -y -f private.key > public.pub

修改密钥的注释内容

$ ssh-keygen -c -f ~/.ssh/id_rsa

修改私钥的保护密码 (Passphrase)

$ ssh-keygen -p -f ~/.ssh/id_rsa

#密钥算法类型 (Key type)

  • rsa (经典 RSA 算法)
  • ed25519 (现代高性能 Ed25519 算法)
  • dsa (遗留 DSA)
  • ecdsa (椭圆曲线)

#识别与删除已知主机 (known_hosts)

在 known_hosts 中查找主机指纹信息

$ ssh-keygen -F <ip/hostname>

从 known_hosts 中删除指定主机的指纹记录

$ ssh-keygen -R <ip/hostname>

#密钥保存格式 (Key format)

  • PEM
  • PKCS8

#SSH 隧道与端口转发 (SSH Tunneling)

#隧道选项参数 (SSH Tunnel Options)

选项参数 含义与功能说明
-L 本地端口转发 (Local port forwarding)
-R 远程端口转发 (Remote port forwarding)
-D 动态 SOCKS 代理转发 (Dynamic port forwarding)
-f 在后台运行隧道连接 (Run in background)
-N 不执行远程命令，仅建立隧道 (No remote command)
-g 允许局域网/外部主机连接到本地转发端口

使用 man ssh 查看选项参数的更多细节

#本地端口转发 (Local Port Forwarding)

# 将本地端口转发到远程内网服务
ssh -L local_port:remote_host:remote_port user@ssh_server

# 示例：将本地 8080 端口转发到远程 example.com 的 80 端口
ssh -L 8080:example.com:80 user@ssh_server

#动态 SOCKS 代理 (Dynamic Port Forwarding)

# 在本地指定端口上建立 SOCKS 代理
ssh -D local_port user@ssh_server

# 在后台静默模式下建立 1080 端口的 SOCKS 代理
ssh -f -N -D 1080 user@ssh_server

#后台静默建立隧道 (Background Tunnel)

# 在后台建立本地端口转发隧道
ssh -f -N -L local_port:remote_host:remote_port user@ssh_server

#同时建立多条隧道 (Multiple Tunnels)

# 在单个 SSH 连接中同时建立多条端口转发隧道
ssh -L 8080:example.com:80 -L 3306:db.example.com:3306 user@ssh_server

#组合高级选项 (Combining Options)

# 后台静默、不执行指令、允许外部访问、指定本地端口转发与私钥
ssh -f -N -g -L 8080:example.com:80 -i ~/.ssh/custom_key user@ssh_server

#🔗 参考资源