ssh¶

Enables forwarding of connections from an authentication agent such as ssh-agent(1).

Bind to the address of bind_interface before attempting to connect to the destination host. Added in 7.7p1.

Requests compression of all data (including stdin, stdout, stderr, and data for forwarded X11, TCP and UNIX-domain connections).

Specifies a local "dynamic" application-level port forwarding. May be repeated: a list emits the flag once per item. Added in 3.0p1.

Append debug logs to log_file instead of standard error. Added in 6.3p1.

Specifies an alternative per-user configuration file. Added in 3.0p1.

Causes ssh to print its configuration after evaluating Host and Match blocks and exit. Added in 6.8p1.

Specify the PKCS#11 shared library ssh should use to communicate with a PKCS#11 token providing keys for user authentication. Added in 3.0p1.

Connect to the target host by first making an ssh connection to the jump host described by destination and then establishing a TCP forwarding to the ultimate destination from there. May be repeated: a list emits the flag once per item. Added in 7.3p1.

Enables GSSAPI-based authentication and forwarding (delegation) of GSSAPI credentials to the server. Added in 4.7p1.

Specifies that connections to the given TCP port or Unix socket on the local (client) host are to be forwarded to the given host and port, or Unix socket, on the remote side.

Places the ssh client into "master" mode for connection sharing. Added in 3.9p1.

Do not execute a remote command.

Control an active connection multiplexing master process. Added in 4.0p1.

Specify a tag name that may be used to select configuration in ssh_config(5). May be repeated: a list emits the flag once per item.

Queries for the algorithms supported by one of the following features: cipher (supported symmetric ciphers), cipher-auth (supported symmetric ciphers that support authenticated encryption), help (supported query terms for use with the -Q flag), mac (supported message integrity codes), kex (key exchange algorithms), key (key types), key-ca-sign (valid CA signature algorithms for certificates), key-cert (certificate key types), key-plain (non-certificate key types), key-sig (all key types and signature algorithms), protocol-version (supported SSH protocol versions), and sig (supported signature algorithms). May be repeated: a list emits the flag once per item. Added in 6.3p1.

Specifies that connections to the given TCP port or Unix socket on the remote (server) host are to be forwarded to the local side.

Specifies the location of a control socket for connection sharing, or the string "none" to disable connection sharing. Added in 3.9p1.

Disable pseudo-terminal allocation.

Display the version number and exit. Added in 3.7p1.

Requests that standard input and output on the client be forwarded to host on port over the secure channel. Added in 5.4p1.

Enables X11 forwarding.

Enables trusted X11 forwarding. Added in 3.8p1.

List the public keys that would be attempted for authentication to the specified destination in preferred order and exit. Added in 10.5p1.

Disables forwarding of the authentication agent connection.

Use bind_address on the local machine as the source address of the connection. Added in 3.0p1.

Selects the cipher specification for encrypting the session.

Sets the escape character for sessions with a pty . Defaults to ~.

Requests ssh to go to background just before command execution.

Allows remote hosts to connect to local forwarded ports.

Selects a file from which the identity (private key) for public key authentication is read.

Disables forwarding (delegation) of GSSAPI credentials to the server.

Specifies the user to log in as on the remote machine. May be repeated: a list emits the flag once per item.

A comma-separated list of MAC (message authentication code) algorithms, specified in order of preference.

Redirects stdin from /dev/null (actually, prevents reading from stdin).

Can be used to give options in the format used in the configuration file. May be repeated: a list emits the flag once per item.

Port to connect to on the remote host. May be repeated: a list emits the flag once per item.

Quiet mode.

May be used to request invocation of a subsystem on the remote system.

Force pseudo-terminal allocation.

Verbose mode.

Requests tunnel device forwarding with the specified tun(4) devices between the client (local_tun) and the server (remote_tun). May be repeated: a list emits the flag once per item. Added in 4.3p1.

Disables X11 forwarding.

Send log information using the syslog(3) system module. Added in 5.2p1.