Amar Vyas

Advanced SSH Client: Config Files, Agents, and Tunneling

2025-01-23 · Commandline · 6 min read

In Part 2, we generated a key and stopped typing passwords. Now we connect to multiple servers. Typing full addresses and key paths is tedious. This part teaches you to write them once in ~/.ssh/config, unlock keys automatically with an agent, debug stubborn connections, and tunnel traffic through remote machines. ssh on a Linux VPS

Summaries

English:
This advanced guide covers the SSH client configuration file on Debian Linux. Learn to create host aliases in ~/.ssh/config, manage multiple keys with ssh-agent, and debug connections using -v, -vv, and -vvv. We explain local, remote, and dynamic port forwarding, ProxyJump for bastion hosts, and modern tools like Mosh for roaming stability. By the end, you will streamline multi-server access and create secure encrypted tunnels without touching remote server settings.

Hindi Summary:
यह उन्नत गाइड Debian Linux पर SSH क्लाइंट कॉन्फ़िगरेशन फ़ाइल को कवर करती है। ~/.ssh/config में होस्ट उपनाम बनाना, ssh-agent से कई कुंजियाँ प्रबंधित करना, और -v/-vv/-vvv से डीबग करना सीखें। लोकल, रिमोट और डायनामिक पोर्ट फ़ॉरवर्डिंग, ProxyJump, और Mosh जैसे आधुनिक टूल्स शामिल हैं।

Advanced SSH Client on Debian: Config Files, Agents, and Tunneling

The Power of ~/.ssh/config

You can turn a ten-word command into two.

A Minimal Alias

Instead of typing:

ssh -p 2222 -i ~/.ssh/id_ed25519 [email protected]

Create ~/.ssh/config on your Debian laptop:

Host myserver
    HostName 192.168.1.50
    User vyas
    Port 2222
    IdentityFile ~/.ssh/id_ed25519
    ServerAliveInterval 60
    IdentitiesOnly yes

Now type:

ssh myserver

What Each Option Does

  • HostName — the real IP or domain.
  • User — your login name on that machine.
  • Port — only needed if not 22.
  • IdentityFile — which private key to use.
  • ServerAliveInterval 60 — pings every 60 seconds to prevent timeout.
  • IdentitiesOnly yes — stops SSH from offering every key in your ~/.ssh folder.

Global Defaults

Add a catch-all at the top of the file:

Host *
    AddKeysToAgent yes
    ServerAliveInterval 60

This applies to every host unless overridden.

Config File Permissions

SSH will ignore a config file that is writable by others:

chmod 600 ~/.ssh/config

Managing Multiple Keys with ssh-agent

[Image: ssh-add -l output]

If your key has a passphrase, you will type it every connection. ssh-agent remembers it for you.

Start and Load the Agent

Debian usually starts the agent automatically in graphical sessions. In a plain terminal, run:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Enter your passphrase once. It is cached until logout or reboot.

Check Loaded Keys

List cached keys:

ssh-add -l

Remove a specific key:

ssh-add -d ~/.ssh/id_ed25519

Clear all keys:

ssh-add -D

Persisting Across Sessions

For convenience, add this to your ~/.bashrc:

if [ -z "$SSH_AUTH_SOCK" ]; then
 eval "$(ssh-agent -s)" > /dev/null
    ssh-add ~/.ssh/id_ed25519 2>/dev/null
fi

Debugging with Verbose Flags

[Image: Terminal with -vvv output]

When a connection is rejected or a key is ignored, SSH does not guess. You ask it to explain.

The Three Levels

  • -v — connection overview and authentication order.
  • -vv — detailed key negotiation and config parsing.
  • -vvv — packet-level noise; useful when configs are silently ignored.

Example:

ssh -vv myserver

Look for lines like debug1: Reading configuration data /home/vyas/.ssh/config to confirm your alias is loaded. If a key is skipped, the output tells you whether permissions, format, or server policy is the cause.

SSH Tunneling Without Root

Tunneling forwards ports through your encrypted SSH connection. You do not need root on either machine.

Local Port Forwarding (-L)

Access a remote web panel or database as if it were local:

ssh -L 8080:localhost:80 [email protected]

Now browse to http://localhost:8080 on your Debian laptop. Traffic is encrypted between you and the server.

Remote Port Forwarding (-R)

Expose a local service to the remote side. Useful for showing a local dev site to a colleague:

ssh -R 8080:localhost:3000 [email protected]

Anyone on the remote server can access localhost:8080 to reach your laptop's port 3000. The server must have GatewayPorts configured to allow external access; we cover that in Part 4.

Dynamic SOCKS Proxy (-D)

Route your browser traffic through the remote server:

ssh -D 1080 [email protected]

Configure your browser to use SOCKS5 proxy localhost:1080. Your browsing is encrypted up to the server, then exits normally.

Jumping Through Bastion Hosts

Some private servers have no public IP. You reach them through a bastion.

One-Time Jump

ssh -J [email protected] [email protected]

Permanent Config Version

Host private
    HostName 10.0.0.5
    User vyas
    ProxyJump [email protected]
    IdentityFile ~/.ssh/id_ed25519

Now ssh private hops automatically.

Modern Client Tools

Mosh for Roaming

If your Wi-Fi drops or your laptop sleeps, SSH disconnects. Mosh uses UDP to stay alive:

sudo apt install mosh
mosh [email protected]

The server must have mosh-server installed. Mosh is ideal for mobile networks but does not replace file transfer or port forwarding.

sshuttle for Quick VPN

Route all traffic through a remote server without configuring a VPN daemon:

sudo apt install sshuttle
sshuttle -r [email protected] 0/0

0/0 means all traffic. You can restrict it to specific subnets like 192.168.0.0/24.

Conclusion

You have reduced your daily typing to short aliases. Your keys unlock automatically. Tunnels give you secure access to remote services without exposing them to the internet, and ProxyJump punches through bastion hosts effortlessly.

In Part 4, we flip the perspective. You will harden sshd on your own Debian server: disable root login, drop passwords, and whitelist users.

Key Takeaways:

  • ~/.ssh/config turns complex connections into one-word aliases.
  • ssh-agent removes passphrase repetition per session.
  • -vv and -vvv reveal exactly why a connection fails.
  • Local forwarding (-L) brings remote ports to your laptop.
  • ProxyJump (-J) handles multi-hop networks cleanly.

Additional Sections

FAQ Section:

1. Why is SSH ignoring my ~/.ssh/config? Check permissions: chmod 600 ~/.ssh/config. Then run ssh -v to confirm the file is being read.
2. What is the difference between -vv and -vvv? More vs mean more detail. -vv shows negotiation. -vvv shows packets. Use -vvv when keys are silently rejected.
3. Can I use config aliases with scp or rsync? Yes. scp file myserver:/tmp/ works if myserver is defined in ~/.ssh/config. The alias applies to any tool that uses libssh.

Internal Links:

External Links: