Show Contents / Index / Search

ssh Command Line Options

The syntax for ssh is:

ssh [-a] [-c cipher] [-C] [-d debug_level] [-e character] [-F file]
[
-g] [-h] [-i file] [-l username] [-L listening_port:host:hostport]
[-m mac_algorithm] [-n] [-o option] [-p port] [-q]
[
-R listening_port:host:hostport] [-s subsystem] [-t] [-v] [-V] [-X]
[
-x] [-Y] [username@]host][#port]] [remote_command [arguments] ...]

Options are available in both a single-character form (such as -o) and a descriptive equivalent (--option). Single characters are shown here. To view the descriptive equivalents, use the -h command line option.

-a

Disables authentication agent forwarding. Authentication agent forwarding is enabled using the ForwardAgent keyword, which is set to `yes' by default. You can use -a to override the configuration file setting.

-c cipher

Specifies one or more (comma-separated) encryption algorithm supported by the client. The client and server agree on a cipher during the key exchange portion of the connection process. The client presents a list of supported ciphers in order of preference. The cipher used for a given session is the first item in this list that is also supported by the server. Allowed values are `aes128-cbc', `blowfish-cbc', `arcfour', `arcfour128', `arcfour256', `aes192-cbc', `aes256-cbc', `cast128-cbc', and `3des-cbc'.

You can also set this value to `none'. When `none' is the agreed on cipher, data is not encrypted. Note that this method provides no confidentiality protection, and is not recommended.

The following values are provided for convenience: `aes' (which combines `aes128-cbc', `aes192-cbc', and `aes256-cbc'), `blowfish' (equivalent to `blowfish-cbc'), `cast' (equivalent to `cast128-cbc'), `3des' (equivalent to `3des-cbc'), `Any' or `AnyStd' (all available ciphers plus `none'), and `AnyCipher' or `AnyStdCipher' (all available ciphers).

You can also configure encryption algorithms in the configuration file using theCiphers keyword; the default is `anystdcipher'.

-C

Disables compression. Compression is desirable on modem lines and other slow connections, but will slow down response rates on fast networks. Compression also adds extra randomness to the packet, making it harder for a malicious person to decrypt the packet. Compression can be enabled using the Compression keyword in the configuration file. Using -C overrides the configuration file setting.

-d debug_level

Sets the debug level. Increasing the value increases the amount of information displayed. Use 1, 2, 3, or 99. (Values 4-98 are accepted, but are equivalent to 3.)

-e character

Sets the escape character for the terminal session. The default character is a tilde (~). Setting the escape character to `none' means that no escape character is available and the tilde acts like any other character. For details, see ESCAPE SEQUENCES below. You can also set the escape character in the configuration file using the EscapeChar keyword.

-F file

Specifies an additional configuration file. Settings are read from this file in addition to the default user-specific file ($HOME/.ssh2/ssh2_config and/or the system-wide file (/etc/ssh2/ssh2_config). Settings in this file override settings in both the user-specific file and the system-wide file.

-g

Enables gateway ports. Remote hosts are allowed to connect to local forwarded ports. You can also configure this in the configuration file using theGatewayPorts keyword.

-h

Displays a brief summary of command options.

-i file

Specifies an alternate identification file to use for public key authentication. The file location is assumed to be in the current working directory unless you specify a fully-qualified or relative path. The default identity file is $HOME/.ssh2/identification. You can also specify an identity file in the configuration file using the IdentificationFile keyword.

-l username

Specifies a name to use for login on the remote computer. You can also specify a user name in the configuration file using theUsername keyword.

-L listening_port:host:hostport

Redirects data from the specified local port, through the secure tunnel to the specified destination host and port. When a Secure Shell connection is established, the Secure Shell client opens a socket on the Secure Shell client host using the designated local port (listening_port). Configure your application client (the one whose data you want to forward) to send data to the forwarded socket (rather than directly to the destination host and port). When that client establishes a connection, all data sent to the forwarded port is redirected through the secure tunnel to the Secure Shell server, which decrypts it and then directs it to the destination socket (host,hostport). Unless the gateway ports option is enabled, the forwarded local port is available only to clients running on the same computer as the Secure Shell client. Multiple client applications can use the forwarded port, but the forward is active only while ssh is running.

Note: If the final destination host and port are not on the Secure Shell server host, data is sent in the clear between the Secure Shell host and the application server host.

You can also configure local forwarding in the configuration file using the LocalForward keyword.

-m mac_algorithm

Specifies which MACs (message authentication algorithms) are supported by the client. Allowed values are `hmac-sha1', `hmac-sha1-96', `hmac-md5', `hmac-md5-96'; and `hmac-ripemd160'. Use `AnyMac' to support all of these. Use `AnyStdMac' to support `hmac-sha1', `hmac-sha1-96', `hmac-md5', and `hmac-md5-96'. Additional options are `none', `any' (equivalent to AnyMac plus `none'), and `AnyStd' (equivalent to `AnyStdMac' plus `none'). Multiple MACs can also be specified as a comma-separated list. When `none' is the agreed on MAC, no message authentication code is used. Because this provides no data integrity protection, options that include `none' are not recommended.

You can also configure MACs in the configuration file using the MACs keyword; the default is `anyStdMac'.

-n

Redirects stdin from /dev/null, which prevents reading from stdin. You can also configure this in the configuration file using theDontReadStdin keyword.

-o option

Sets any option that can be configured using a configuration file keyword. For a list of keywords and their meanings, see ssh2_config(5). Syntax alternatives are shown below. Use quotation marks to contain expressions that include spaces.

-o key1=value

-o key1="sample value"

-o "key1 value"

To configure multiple options, use multiple -o switches.

-o key1=value -o key2=value

-p port

Specifies the port to connect to on the server. The default is 22, which is the standard port for Secure Shell connections. You can also configure the port in the configuration file using the Port keyword.

-q

Enables quiet mode, which causes all warning and diagnostic messages, including banners, to be suppressed. You can also configure this in the configuration file using the QuietMode keyword.

-R listening_port:host:hostport

Redirects data from the specified remote port (on the computer running the Secure Shell server), through the secure tunnel to the specified destination host and port. When the Secure Shell connection is established, the Secure Shell server opens a socket on its host (the computer running the Secure Shell server) using the designated remote port (listening_port). Configure your client application (the one whose data you want to forward) to send data to the forwarded socket (rather than directly to the destination host and port). When that client establishes a connection, all data sent to the forwarded port is redirected through the secure tunnel to the Secure Shell client, which decrypts it and then directs it to the destination socket (host,hostport).

Note: If the final destination host and port are not on the same computer as the Secure Shell client, data is sent in the clear between the Secure Shell client and the final destination.

You can also configure remote forwarding in the configuration file using the RemoteForward keyword.

-s subsystem

Invokes the specified subsystem on the remote system. Subsystems are a feature of the Secure Shell protocol which facilitates the use of Secure Shell as a secure transport for other applications (such as sftp). Subsystems must be defined by the Secure Shell server.

-t

Forces a tty allocation even if a command is specified. You can also configure this in the configuration file using the ForcePTTYAllocation keyword.

-v

Sets the debug level to verbose mode, which is equivalent to using `-d 2'. You can also configure this in the configuration file using the VerboseMode keyword.

-V

Displays product name and version information and exits. If other options are specified on the command line, they are ignored.

-X

Enables X11 connection forwarding and treats X11 clients as untrusted. Untrusted remote X11 clients are prevented from tampering with data belonging to trusted X11 clients. You can also configure this in the configuration file using the ForwardX11 keyword.

-x

Disables X11 connection forwarding. You can also configure this in the configuration file using the ForwardX11 keyword.

-Y

Enables X11 connection forwarding and treats X11 clients as trusted.