Connecting, ports and host keys

Connect on a custom port, run one command, and understand the first-connection fingerprint warning.

Syntax you will use every day

ssh user@host
ssh -p 2222 user@host        # custom port
ssh -l user host             # same as user@host
ssh user@host uptime         # run one command and return
ssh -v user@host             # verbose: shows the handshake, useful for debugging

Many servers move SSH away from port 22 to cut down on automated login noise. When they do, you need -p, with a lowercase p. (scp uses an uppercase -P, which trips up almost everyone once.)

Run a command without opening a shell

Put the command after the host and SSH runs it, prints the output locally and exits. Quote it when it has spaces or special characters:

ssh ana@server.example.com 'df -h /'
ssh ana@server.example.com 'ls -l /var/log | head'

The first-connection warning

The first time you connect to a server, SSH shows something like this:

The authenticity of host 'server.example.com (192.0.2.10)' can't be established.
ED25519 key fingerprint is SHA256:abc123...
Are you sure you want to continue connecting (yes/no/[fingerprint])?

The server presents its host key. The fingerprint is a short hash of that key. If you can compare it with a trusted source, for example the provider console, you confirm you are talking to the real server. When you answer yes, SSH saves the key in ~/.ssh/known_hosts.

When the key changes

CarefulIf you later see "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!", stop. It can be harmless (the server was reinstalled) or it can mean someone is intercepting the connection. Check with the server owner before deleting the old entry.

Once you have verified a reinstall, remove only that host with ssh-keygen -R server.example.com, then reconnect and verify the new fingerprint.