ssh, scp commands in Linux: connecting and copying over SSH, examples

Q: Connection timed out vs refused

timed out — never arrived (firewall/route/wrong network); refused — arrived, but the port is closed (sshd isn't running / a different port).

Q: The session drops after a timeout

ServerAliveInterval 60 in the client config.

Overview

ssh is a client for a secure connection to a server (port 22 by default). The server side is sshd; authentication is by keys (see ssh-keys).

bash

ssh user@host                     # connect
ssh -p 2222 user@host             # non-default port
ssh user@host 'uptime; df -h'     # run a command and exit
ssh -v user@host                  # verbose connection debugging

Options

7

/

To avoid repeating parameters, use host aliases in ~/.ssh/config:

Host web
    HostName 192.168.1.10
    User deploy
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

Now just ssh web. Useful extras: ServerAliveInterval 60 (keep the session alive), ProxyJump bastion (through a bastion).

Option	What it does	Example
`-p` port	ssh/scp — connect to a non-default port.	`ssh -p 2222 user@host`
`-L` local:host:hostport	ssh — local tunnel, forward a port from the server to your machine.	`ssh -L 8080:localhost:80 user@host`
`-r`	scp — copy a directory recursively.	`scp -r dir user@host:/path/`
`-D` port	ssh — set up a SOCKS proxy through the server.	`ssh -D 1080 user@host`
`-J` host	ssh — connect through an intermediate jump host (bastion).	`ssh -J bastion user@internal-host`
`-v`	ssh — verbose connection debugging; -vvv for maximum detail.	`ssh -v user@host`
`-i` keyfile	ssh/scp — connect using a specific private key.	`ssh -i ~/.ssh/deploy_key user@host`

Nothing found. Try a shorter query.

Recipes

1

Copying and tunnels

bash

# copying files
scp file user@host:/path/         # to the server
scp user@host:/path/file .        # from the server
scp -r dir user@host:/path/       # a directory
rsync -avz dir/ user@host:/path/  # more efficient for large/repeated transfers (see rsync)

# port forwarding
ssh -L 8080:localhost:80 user@host    # local 8080 → remote 80
ssh -D 1080 user@host                 # SOCKS proxy through the server
ssh -J bastion user@internal-host     # jump through a bastion

Troubleshooting

4

Permission denied (publickey)

The key isn't on the server or permissions on the client/server are wrong. Check ssh -v, that the key is loaded (ssh-add -l), ~/.ssh/authorized_keys on the server (see ssh-keys).

Host key verification failed

The host's key changed (a reinstall/IP change). If expected, remove the old entry: ssh-keygen -R host. If not, this could be a MITM — check it.

Connection timed out vs refused

timed out — never arrived (firewall/route/wrong network); refused — arrived, but the port is closed (sshd isn't running / a different port).

The session drops after a timeout

ServerAliveInterval 60 in the client config.

Terms

1

known_hosts: A client list of trusted SSH server keys and host identities. Also appears in: ssh-keyscan, Ansible: inventory, modules and one-off commands

ssh, scp — connecting and copying over SSH

Cheat sheet