$clihub

ssh

CLI

Run commands on a remote host and forward ports over an encrypted tunnel.

Encrypted remote shell; also the standard way to tunnel a port

5 curated recipes · not yet executed by the harness#remote#tunnel#port-forward#network#shell

Recipes

Curated from documentation and usage. Percentages are estimates, not measurements.

Run one command on a remote host and exit

~95% est.
ssh -o BatchMode=yes user@host 'uptime'
Common failures (2)
  • Permission denied (publickey)no usable key; run ssh-copy-id user@host once, or pass -i /path/to/key
  • hangs waiting for a passwordBatchMode=yes makes it fail fast instead of prompting — keep it in scripts

Forward a remote port to localhost (reach a remote database)

~93% est.
ssh -f -N -o ExitOnForwardFailure=yes -o BatchMode=yes -L 5432:localhost:5432 user@host
Common failures (2)
  • exit 255 with Could not request local forwardingsomething already holds the local port; pick another left-hand port, e.g. -L 55432:localhost:5432
  • the tunnel is still running after you are done-f leaves it in the background; stop it with pkill -f '5432:localhost:5432'

Expose a local port on the remote host (reverse tunnel)

~88% est.
ssh -f -N -o ExitOnForwardFailure=yes -o BatchMode=yes -R 8080:localhost:3000 user@host
Common failures (2)
  • the remote port only answers on the remote's localhostset GatewayPorts yes in the remote sshd_config; by default reverse tunnels do not listen on all interfaces
  • the tunnel is still running after you are done-f leaves it in the background; stop it with pkill -f '8080:localhost:3000'

Install your public key on a host so later logins need no password

~96% est.
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host
Common failures (1)
  • Permission denied (exit 255) with no password promptit needs the remote password typed on a terminal; with no terminal it fails instead of prompting, so copy the key out of band or use a key the host already trusts

Fail instead of prompting on an unknown host key (scripts)

~92% est.
ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new user@host 'echo ok'
Common failures (1)
  • Host key verification failedaccept-new trusts a first-time host but still refuses a CHANGED key, which is the behaviour you want. Never use StrictHostKeyChecking=no

Install

aptsudo apt install openssh-client
Homebrewbrew install openssh

Agent notes

When to use
Running a command on another machine, or reaching a database or service that is only bound to a remote host's localhost
Avoid when
The task is interactive. ssh without -N opens a session an agent cannot drive; pass the command as an argument instead.
Quick examples
  • ssh user@host 'uptime'
  • ssh -N -L 5432:localhost:5432 user@host

Use from an agent

curl -s https://clihub.com/api/tools/ssh | jq '.agentHints.provenRecipes[] | {task, command, verified}'

Or call get_tool with slug ssh on the MCP server at https://clihub.com/mcp.

Homepage ↗BSD-2-Clause3 views