OpenSSH client configuration

Rowan Puttergill Last review: 2026-06-12

This topic covers connecting to OpenSSH servers using ssh, scp, and sftp, plus client-side configuration files and SSH key management. For server-side configuration, see OpenSSH Server Configuration. For background on the SSH protocol, see About SSH and OpenSSH.

Status: work in progress. Content in this section is in review and being updated. Feedback welcome!

Make sure you have relevant packages installed

To connect to an OpenSSH server from a client machine, you must have the openssh-clients package installed. If it isn’t already installed, run:

---
$ sudo dnf install openssh-clients
---

Configuration files

User-specific SSH configuration information is stored in ~/.ssh/ within the user’s home directory, as described in User-specific configuration files below. For the system-wide client configuration file, /etc/ssh/ssh_config, and the server’s configuration files, see System-wide configuration files in OpenSSH Server Configuration.

Table 1. User-specific configuration files
File	Description
`~/.ssh/authorized_keys`	Holds a list of authorized public keys for servers. When the client connects to a server, the server authenticates the client by checking its signed public key stored within this file.
`~/.ssh/id_ecdsa`	Contains the ECDSA private key of the user.
`~/.ssh/id_ecdsa.pub`	The ECDSA public key of the user.
`~/.ssh/id_rsa`	The RSA private key used by ssh.
`~/.ssh/id_rsa.pub`	The RSA public key used by ssh.
`~/.ssh/id_ed25519`	The EdDSA private key used by ssh.
`~/.ssh/id_ed25519.pub`	The EdDSA public key used by ssh.
`~/.ssh/known_hosts`	Contains host keys of SSH servers accessed by the user. This file is very important for ensuring that the SSH client is connecting to the correct SSH server.

For information concerning various directives that can be used in the SSH configuration files, see the ssh_config(5) and sshd_config(5) manual pages.

Using the ssh utility

The ssh utility allows you to log in to a remote machine and execute commands there. It is a secure replacement for the rlogin, rsh, and telnet programs.

Similarly to the telnet command, log in to a remote machine by using the following command:

$ ssh hostname

For example, to log in to a remote machine named penguin.example.com, type the following at a shell prompt:

$ ssh penguin.example.com

This will log you in with the same user name you are using on the local machine. If you want to specify a different user name, use a command in the following form:

$ ssh username@hostname

For example, to log in to penguin.example.com as USER, type:

$ ssh USER@penguin.example.com

The first time you initiate a connection, you will be presented with a message similar to this:

The authenticity of host 'penguin.example.com (192.0.2.1)' can't be established.
ED25519 key fingerprint is SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Users should always check if the fingerprint is correct before answering the question in this dialog. The user can ask the administrator of the server to confirm the key is correct. This should be done in a secure and previously agreed way. If the user has access to the server’s host keys, the fingerprint can be checked by using the ssh-keygen command as follows:

$ ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub
256 SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c root@penguin.example.com (ED25519)

Type yes to accept the key and confirm the connection. You will see a notice that the server has been added to the list of known hosts, and a prompt asking for your password:

Warning: Permanently added 'penguin.example.com' (ED25519) to the list of known hosts.
USER@penguin.example.com's password:

Updating the host key of an SSH server

If the SSH server’s host key changes, the client notifies the user that the connection cannot proceed until the server’s host key is deleted from the ~/.ssh/known_hosts file. Before doing this, however, contact the system administrator of the SSH server to verify the server is not compromised.

To remove a key from the ~/.ssh/known_hosts file, issue a command as follows:

$ ssh-keygen -R penguin.example.com
# Host penguin.example.com found: line 15
/home/USER/.ssh/known_hosts updated.
Original contents retained as /home/USER/.ssh/known_hosts.old

After entering the password, you will be provided with a shell prompt for the remote machine.

Alternatively, the ssh program can be used to execute a command on the remote machine without logging in to a shell prompt:

$ ssh username@hostname command

For example, the /etc/redhat-release file provides information about the Fedora version. To view the contents of this file on penguin.example.com, type:

$ ssh USER@penguin.example.com cat /etc/redhat-release
USER@penguin.example.com's password:
Fedora release 44 (Forty Four)

After you enter the correct password, the user name will be displayed, and you will return to your local shell prompt.

Generating and managing SSH keys

To be able to use ssh, scp, or sftp to connect to a server, generate an authorization key pair by following the steps below. Note that keys must be generated for each user separately.

Fedora uses SSH Protocol 2 by default (see Protocol Versions for more information). When generating new keys, Ed25519 is the recommended key type; RSA and ECDSA are also supported for compatibility with older systems.

Do not generate key pairs as root

If you complete the steps as root, only root will be able to use the keys.

Backup your ~/.ssh/ directory

If you reinstall your system and want to keep previously generated key pairs, backup the ~/.ssh/ directory. After reinstalling, copy it back to your home directory. This process can be done for all users on your system, including root.

Generating an RSA key pair

To generate an RSA key pair for version 2 of the SSH protocol, follow these steps:

Generate an RSA key pair by typing the following at a shell prompt:

$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/USER/.ssh/id_rsa):

Press kbd:[Enter] to confirm the default location, ~/.ssh/id_rsa, for the newly created key.

Enter a passphrase, and confirm it by entering it again when prompted to do so. For security reasons, avoid using the same password as you use to log in to your account.

After this, you will be presented with a message similar to this:

Your identification has been saved in /home/USER/.ssh/id_rsa
Your public key has been saved in /home/USER/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:y6f0DGlHe28YWotEypnhfk3WLYQ5TgaQwoSlOFwmmm0 USER@penguin.example.com
The key's randomart image is:
+---[RSA 3072]----+
|             E.  |
|            . .  |
|             o . |
|              . .|
|        S .    . |
|         + o o ..|
|          * * +oo|
|           O +..=|
|           o*  o.|
+----[SHA256]-----+

By default, the permissions of the ~/.ssh/ directory are set to rwx------ or 700 expressed in octal notation. This is to ensure that only the USER can view the contents. If required, this can be confirmed with the following command:
```
$ ls -ld ~/.ssh
drwx------. 2 USER USER 54 Nov 25 16:56 /home/USER/.ssh/
```
To copy the public key to a remote machine, issue a command in the following format:
```
$ ssh-copy-id user@hostname
```
This will copy the most recently modified ~/.ssh/id*.pub public key if it is not yet installed. Alternatively, specify the public key’s file name as follows:
```
$ ssh-copy-id -i ~/.ssh/id_rsa.pub user@hostname
```
This will copy the content of ~/.ssh/id_rsa.pub into the ~/.ssh/authorized_keys file on the machine to which you want to connect. If the file already exists, the keys are appended to its end.

Generating an ECDSA key pair

To generate an ECDSA key pair for version 2 of the SSH protocol, follow these steps:

Generate an ECDSA key pair by typing the following at a shell prompt:

$ ssh-keygen -t ecdsa
Generating public/private ecdsa key pair.
Enter file in which to save the key (/home/USER/.ssh/id_ecdsa):

Press kbd:[Enter] to confirm the default location, ~/.ssh/id_ecdsa, for the newly created key.

Enter a passphrase, and confirm it by entering it again when prompted to do so. For security reasons, avoid using the same password as you use to log in to your account.

After this, you will be presented with a message similar to this:

Your identification has been saved in /home/USER/.ssh/id_ecdsa
Your public key has been saved in /home/USER/.ssh/id_ecdsa.pub
The key fingerprint is:
SHA256:y6f0DGlHe28YWotEypnhfk3WLYQ5TgaQwoSlOFwmmm0 USER@penguin.example.com
The key's randomart image is:
+---[ECDSA 256]---+
|       .+ +o     |
|       . =.o     |
|        o o +  ..|
|         + + o  +|
|        S o o oE.|
|           + oo+.|
|            + o  |
|                 |
|                 |
+----[SHA256]-----+

By default, the permissions of the ~/.ssh/ directory are set to rwx------ or 700 expressed in octal notation. This is to ensure that only the USER can view the contents. If required, this can be confirmed with the following command:
```
$ ls -ld ~/.ssh
drwx------. 2 USER USER 54 Nov 25 16:56 /home/USER/.ssh/
```
To copy the public key to a remote machine, issue a command in the following format:
```
$ ssh-copy-id USER@hostname
```
This will copy the most recently modified ~/.ssh/id*.pub public key if it is not yet installed. Alternatively, specify the public key’s file name as follows:
```
$ ssh-copy-id -i ~/.ssh/id_ecdsa.pub USER@hostname
```
This will copy the content of ~/.ssh/id_ecdsa.pub into the ~/.ssh/authorized_keys on the machine to which you want to connect. If the file already exists, the keys are appended to its end.

Generating an Ed25519 key pair

This section is a placeholder. Ed25519 is the current recommended default for new keys — it produces smaller keys than RSA or ECDSA while remaining very secure and fast. This section should mirror the RSA/ECDSA steps above using ssh-keygen -t ed25519, including the default key location (~/.ssh/id_ed25519) and ssh-copy-id usage.

See Configuring ssh-agent below for information on how to set up your system to remember the passphrase.

Never share your private key

The private key is for your personal use only, and it is important that you never give it to anyone.

Configuring ssh-agent

To store your passphrase so that you do not have to enter it each time you initiate a connection with a remote machine, you can use the ssh-agent authentication agent.

To save your passphrase for a certain shell prompt, use the following command:

$ ssh-add
Enter passphrase for /home/USER/.ssh/id_rsa:

Note that when you log out, your passphrase will be forgotten. You must execute the command each time you log in to a virtual console or a terminal window.

The SSH client configuration file (~/.ssh/config)

This section is a placeholder and is not covered in the original topic. It should cover the per-user ~/.ssh/config file (and the system-wide /etc/ssh/ssh_config), including Host blocks/aliases, common per-host options such as HostName, User, Port, and IdentityFile, the ProxyJump directive for jump hosts, and global defaults such as ServerAliveInterval.

Using the scp utility

scp can be used to transfer files between machines over a secure, encrypted connection. In its design, it is very similar to rcp.

To transfer a local file to a remote system, use a command in the following form:

$ scp localfile username@hostname:remotefile

For example, if you want to transfer taglist.vim to a remote machine named penguin.example.com, type the following at a shell prompt:

$ scp taglist.vim USER@penguin.example.com:.vim/plugin/taglist.vim
USER@penguin.example.com's password:
taglist.vim                                   100%  144KB 144.5KB/s   00:00

Multiple files can be specified at once. To transfer the contents of .vim/plugin/ to the same directory on the remote machine penguin.example.com, type the following command:

$ scp .vim/plugin/* USER@penguin.example.com:.vim/plugin/
USER@penguin.example.com's password:
closetag.vim                                  100%   13KB  12.6KB/s   00:00
snippetsEmu.vim                               100%   33KB  33.1KB/s   00:00
taglist.vim                                   100%  144KB 144.5KB/s   00:00

To transfer a remote file to the local system, use the following syntax:

$ scp username@hostname:remotefile localfile

For instance, to download the .vimrc configuration file from the remote machine, type:

$ scp USER@penguin.example.com:.vimrc .vimrc
USER@penguin.example.com's password:
.vimrc                                        100% 2233     2.2KB/s   00:00

The SCP protocol is not well designed and can cause unexpected results. In the past it was source of several CVEs where malicious server could override files in local filesystem when downloading files. It is recommended to use SFTP when possible. See the next section for more information.

Using the sftp utility

The sftp utility can be used to open a secure, interactive SFTP session. In its design, it is similar to ftp except that it uses a secure, encrypted connection.

To connect to a remote system, use a command in the following form:

$ sftp username@hostname

For example, to log in to a remote machine named penguin.example.com with USER as a user name, type:

$ sftp USER@penguin.example.com
USER@penguin.example.com's password:
Connected to penguin.example.com.
sftp>

After you enter the correct password, you will be presented with a prompt. The sftp utility accepts a set of commands similar to those used by ftp (see A selection of available sftp commands).

Table 2. A selection of available sftp commands
Command	Description
ls [directory]	List the content of a remote directory. If none is supplied, a current working directory is used by default.
cd directory	Change the remote working directory to directory.
mkdir directory	Create a remote directory.
rmdir directory	Remove a remote directory.
put localfile [remotefile]	Transfer localfile to a remote machine.
get remotefile [localfile]	Transfer remotefile from a remote machine.

For a complete list of available commands, see the sftp(1) manual page.

SSH certificates

Generating user certificates and configuring IdentityFile to present them is covered as part of the SSH Certificate Authentication use case in Advanced SSH Usage.

Additional resources

For more information on how to connect to an OpenSSH server from Fedora, see the resources listed below.

ssh(1) — The manual page for the ssh client application provides a complete list of available command line options and supported configuration files and directories.
scp(1) — The manual page for the scp utility provides a more detailed description of this utility and its usage.
sftp(1) — The manual page for the sftp utility.
ssh-keygen(1) — The manual page for the ssh-keygen utility documents in detail how to use it to generate, manage, and convert authentication keys used by ssh.
ssh_config(5) — The manual page named ssh_config documents available SSH client configuration options.

For server-side resources and information about the SSH protocol, see OpenSSH Server Configuration and About SSH and OpenSSH.

Want to help? Learn how to contribute to Fedora Docs ›