SSH

Most important commands to remember

• ssh -G HOST — inspect effective client configuration without connecting.
• ssh-keygen -F HOST — look up saved host-key entries.

Commands and flags

Option or argument	Meaning
ssh -G localhost	Evaluate and print SSH client settings for localhost, then exit.
ssh-keygen -F localhost	Search the default known_hosts file for this host.

-G is configuration inspection, not a login. -F here belongs to ssh-keygen and searches a host; command options are tool-specific.

The concepts that matter

1. SSH protects access to a remote system

SSH, Secure Shell, establishes an encrypted, integrity-protected connection for remote access. An interactive shell is one use; file transfer and forwarding can use the same protocol family.

The client first reaches a server and negotiates transport protection. Authentication and session requests follow. A reachable TCP port alone does not establish the server’s identity or your right to open a shell.

2. The server authenticates with its host key

An SSH server has a host key that identifies the server, separate from a user’s login key. A client can remember it in known_hosts and compare it on later connections.

For a first connection, verify the presented fingerprint through an independent trusted channel. A changed key can reflect legitimate replacement or an unexpected endpoint. Removing the old entry without understanding the change discards useful evidence rather than explaining it.

3. The user proves permission to log in

After server authentication, the server evaluates the user’s authentication. Public-key login proves possession of a private key corresponding to an accepted public key; the private key is not sent to the server.

A key passphrase protects the stored private key, while an account password authenticates under a different mechanism. The accepted account and server policy determine the resulting permissions. Encryption does not turn a normal account into an administrator.

4. Configuration changes which endpoint and identity are used

SSH configuration can select hostnames, users, ports, identity files, proxies, and forwarding. A short host alias can therefore represent a more complex connection than its spelling suggests.

Inspect the effective settings when the client appears to use the wrong user or key. Agent forwarding and other channels grant capabilities beyond a shell, so understand them separately. This introductory example inspects settings and saved trust without creating any channel.

One small example

Optional: run the commands with OpenSSH installed. They do not contact localhost or require an SSH daemon.

ssh -G localhost
ssh-keygen -F localhost

In the configuration output, find hostname, user, port, and identityfile. They describe what this client would use, not files proven to exist or credentials proven to work. Defaults and personal configuration affect the results.

The second command reports matching known-host entries if present, including entries whose hostnames are hashed. No match is normal for a host you have never recorded. A missing known_hosts file is also possible. Finding an entry does not verify that a live server currently presents that key.

No login, trust entry, or key is created, and no cleanup is needed.

Keep this idea: Authenticate the server first, then the user; inspect configuration rather than guessing which host or key SSH selects.