SSH & GPG Cheat Sheet: Keys, Tunnels & Signed Commits

Quick reference tables

SSH key generation

SSH connections

Copy keys & files

SSH agent

SSH tunnels / port forwarding

GPG key management

GPG encryption & signing

Git commit signing

Detailed sections

SSH config file — stop typing long commands

Create ~/.ssh/config to give servers short aliases:

# Personal GitHub
Host github.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519

# Work GitHub
Host github-work
  HostName github.com
  User git
  IdentityFile ~/.ssh/work_key

# Remote server
Host myserver
  HostName 192.168.1.100
  User ubuntu
  Port 22
  IdentityFile ~/.ssh/id_ed25519
  ServerAliveInterval 60

# Bastion jump host
Host internal-server
  HostName 10.0.0.50
  User ec2-user
  ProxyJump [email protected]
  IdentityFile ~/.ssh/prod_key

Now you can just:

ssh myserver           # instead of: ssh -i ~/.ssh/id_ed25519 [email protected]
git clone github-work:org/repo  # uses work key automatically
ssh internal-server    # jumps through bastion automatically

Add SSH key to GitHub / GitLab

# 1. Generate key
ssh-keygen -t ed25519 -C "[email protected]"

# 2. Start agent and add key
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

# 3. Copy public key to clipboard
cat ~/.ssh/id_ed25519.pub   # copy this output

# On macOS:
pbcopy < ~/.ssh/id_ed25519.pub

# On Linux:
xclip -selection clipboard < ~/.ssh/id_ed25519.pub

# 4. Add to GitHub: Settings → SSH Keys → New SSH Key

# 5. Test connection
ssh -T [email protected]
# "Hi username! You've successfully authenticated..."

SSH agent forwarding — connecting from server to server

If you SSH into a server and need to clone a private repo from there, agent forwarding lets you use your local keys without copying them to the server.

# Connect with agent forwarding
ssh -A user@jumpserver

# Now on jumpserver, your local keys work:
git clone [email protected]:org/private-repo.git

# Or connect to another server from there
ssh user@internal-server

Set it permanently in ~/.ssh/config:

Host jumpserver
  HostName jump.example.com
  ForwardAgent yes

Security note: Only enable agent forwarding on servers you trust. Anyone with root on that server can use your forwarded agent.

Database tunneling — access remote DB locally

This is one of the most useful SSH tricks for developers:

# Forward remote PostgreSQL to local port
ssh -N -L 5432:localhost:5432 user@prod-server

# Now connect with any local Postgres client:
psql -h localhost -U dbuser mydb
# or open TablePlus, DBeaver, etc. connecting to localhost:5432

Run it in background:

ssh -f -N -L 5432:localhost:5432 user@prod-server
# -f = background, -N = no command, just tunnel

Kill it:

ps aux | grep "5432:localhost" | awk '{print $2}' | xargs kill

Set up GPG for signed commits

Signed commits show a “Verified” badge on GitHub. Here’s the full setup:

# 1. Generate GPG key
gpg --full-generate-key
# Choose: RSA and RSA, 4096 bits, key doesn't expire
# Enter your name and your GitHub email

# 2. Get your key ID
gpg --list-secret-keys --keyid-format=long
# sec   rsa4096/3AA5C34371567BD2 2024-01-01
#                 ^^^^^^^^^^^^^^^^ this is your key ID

# 3. Export public key for GitHub
gpg --armor --export 3AA5C34371567BD2
# Copy the output

# 4. Add to GitHub: Settings → SSH and GPG keys → New GPG Key

# 5. Configure Git
git config --global user.signingkey 3AA5C34371567BD2
git config --global commit.gpgsign true
git config --global gpg.program gpg

# 6. On macOS, fix GPG agent (required)
brew install pinentry-mac
echo "pinentry-program $(which pinentry-mac)" >> ~/.gnupg/gpg-agent.conf
gpgconf --kill gpg-agent

# 7. Test — commit should be signed
git commit -m "test: signed commit"
git log --show-signature -1

Encrypt files with GPG

# Encrypt for someone else (they need their key imported)
gpg --encrypt --armor -r [email protected] secrets.txt
# Creates: secrets.txt.asc

# Encrypt for yourself
gpg --encrypt --armor -r [email protected] secrets.txt

# Decrypt
gpg --decrypt secrets.txt.asc > secrets.txt

# Symmetric encryption (password only, no keys)
gpg --symmetric --armor secrets.txt
# Enter password twice
# Creates: secrets.txt.asc

# Decrypt symmetric
gpg --decrypt secrets.txt.asc

SSH hardening — server-side config

In /etc/ssh/sshd_config:

# Disable password auth (use keys only)
PasswordAuthentication no
ChallengeResponseAuthentication no

# Disable root login
PermitRootLogin no

# Only allow specific users
AllowUsers ubuntu deploy

# Change default port (security through obscurity, but reduces log noise)
Port 2222

# Timeout idle connections
ClientAliveInterval 300
ClientAliveCountMax 2

After editing:

sudo sshd -t          # test config for errors
sudo systemctl reload sshd

New to SSH keys? Start with How to Set Up SSH Keys for GitHub.

Related Reading.

Cheatsheet 7 min read

curl Cheat Sheet: API Testing, Auth & File Upload

Complete curl reference — GET and POST requests, headers, authentication, file upload, response inspection, timing breakdown, webhook testing, and scripting patterns.

Vishnu Damwala Mar 11, 2026

Cheatsheet 9 min read

Linux & Bash Cheat Sheet: Commands Every Dev Needs

Complete Linux and Bash reference — file operations, permissions, processes, grep, find, networking, pipes, cron jobs, SSH, and shell scripting.

Vishnu Damwala Mar 11, 2026

Cheatsheet 7 min read

Git Cheat Sheet: Every Command You Actually Need

Complete Git reference with copy-paste commands for setup, staging, branching, merging, rebasing, stashing, undoing mistakes, remotes, and log inspection.

Vishnu Damwala Mar 11, 2026