SSH & GPG Cheat Sheet: Keys, Tunnels & Signed Commits

Quick reference tables

SSH key generation

SSH connections

Copy keys & files

SSH agent

SSH tunnels / port forwarding

GPG key management

GPG encryption & signing

Git commit signing

Detailed sections

SSH config file — stop typing long commands

Create ~/.ssh/config to give servers short aliases:

# Personal GitHub
Host github.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519

# Work GitHub
Host github-work
  HostName github.com
  User git
  IdentityFile ~/.ssh/work_key

# Remote server
Host myserver
  HostName 192.168.1.100
  User ubuntu
  Port 22
  IdentityFile ~/.ssh/id_ed25519
  ServerAliveInterval 60

# Bastion jump host
Host internal-server
  HostName 10.0.0.50
  User ec2-user
  ProxyJump bastion@jump.example.com
  IdentityFile ~/.ssh/prod_key

Now you can just:

ssh myserver           # instead of: ssh -i ~/.ssh/id_ed25519 ubuntu@192.168.1.100
git clone github-work:org/repo  # uses work key automatically
ssh internal-server    # jumps through bastion automatically

Add SSH key to GitHub / GitLab

# 1. Generate key
ssh-keygen -t ed25519 -C "you@email.com"

# 2. Start agent and add key
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

# 3. Copy public key to clipboard
cat ~/.ssh/id_ed25519.pub   # copy this output

# On macOS:
pbcopy < ~/.ssh/id_ed25519.pub

# On Linux:
xclip -selection clipboard < ~/.ssh/id_ed25519.pub

# 4. Add to GitHub: Settings → SSH Keys → New SSH Key

# 5. Test connection
ssh -T git@github.com
# "Hi username! You've successfully authenticated..."

SSH agent forwarding — connecting from server to server

If you SSH into a server and need to clone a private repo from there, agent forwarding lets you use your local keys without copying them to the server.

# Connect with agent forwarding
ssh -A user@jumpserver

# Now on jumpserver, your local keys work:
git clone git@github.com:org/private-repo.git

# Or connect to another server from there
ssh user@internal-server

Set it permanently in ~/.ssh/config:

Host jumpserver
  HostName jump.example.com
  ForwardAgent yes

Security note: Only enable agent forwarding on servers you trust. Anyone with root on that server can use your forwarded agent.

Database tunneling — access remote DB locally

This is one of the most useful SSH tricks for developers:

# Forward remote PostgreSQL to local port
ssh -N -L 5432:localhost:5432 user@prod-server

# Now connect with any local Postgres client:
psql -h localhost -U dbuser mydb
# or open TablePlus, DBeaver, etc. connecting to localhost:5432

Run it in background:

ssh -f -N -L 5432:localhost:5432 user@prod-server
# -f = background, -N = no command, just tunnel

Kill it:

ps aux | grep "5432:localhost" | awk '{print $2}' | xargs kill

Set up GPG for signed commits

Signed commits show a “Verified” badge on GitHub. Here’s the full setup:

# 1. Generate GPG key
gpg --full-generate-key
# Choose: RSA and RSA, 4096 bits, key doesn't expire
# Enter your name and your GitHub email

# 2. Get your key ID
gpg --list-secret-keys --keyid-format=long
# sec   rsa4096/3AA5C34371567BD2 2024-01-01
#                 ^^^^^^^^^^^^^^^^ this is your key ID

# 3. Export public key for GitHub
gpg --armor --export 3AA5C34371567BD2
# Copy the output

# 4. Add to GitHub: Settings → SSH and GPG keys → New GPG Key

# 5. Configure Git
git config --global user.signingkey 3AA5C34371567BD2
git config --global commit.gpgsign true
git config --global gpg.program gpg

# 6. On macOS, fix GPG agent (required)
brew install pinentry-mac
echo "pinentry-program $(which pinentry-mac)" >> ~/.gnupg/gpg-agent.conf
gpgconf --kill gpg-agent

# 7. Test — commit should be signed
git commit -m "test: signed commit"
git log --show-signature -1

Encrypt files with GPG

# Encrypt for someone else (they need their key imported)
gpg --encrypt --armor -r colleague@company.com secrets.txt
# Creates: secrets.txt.asc

# Encrypt for yourself
gpg --encrypt --armor -r your@email.com secrets.txt

# Decrypt
gpg --decrypt secrets.txt.asc > secrets.txt

# Symmetric encryption (password only, no keys)
gpg --symmetric --armor secrets.txt
# Enter password twice
# Creates: secrets.txt.asc

# Decrypt symmetric
gpg --decrypt secrets.txt.asc

SSH hardening — server-side config

In /etc/ssh/sshd_config:

# Disable password auth (use keys only)
PasswordAuthentication no
ChallengeResponseAuthentication no

# Disable root login
PermitRootLogin no

# Only allow specific users
AllowUsers ubuntu deploy

# Change default port (security through obscurity, but reduces log noise)
Port 2222

# Timeout idle connections
ClientAliveInterval 300
ClientAliveCountMax 2

After editing:

sudo sshd -t          # test config for errors
sudo systemctl reload sshd

New to SSH keys? Start with How to Set Up SSH Keys for GitHub.

Related Articles

Deepen your understanding with these curated continuations.

View All Articles

Cheatsheet 5 min read

tmux Cheat Sheet: Sessions, Panes, Windows & Config

Complete tmux reference — prefix key, sessions, windows, panes, copy mode, key bindings, plugins, and a starter .tmux.conf for 2026.

Jena Mar 28, 2026

Cheatsheet 5 min read

Git Cheat Sheet: Every Command You Actually Need

Complete Git reference with copy-paste commands for setup, staging, branching, merging, rebasing, stashing, undoing mistakes, remotes, and log inspection.

Vishnu Jan 25, 2026

Cheatsheet 5 min read

Vim Cheat Sheet: Modes, Navigation, Editing & Config

Complete Vim reference covering modes, movement, editing commands, search and replace, visual mode, split panes, macros, text objects, and a starter .vimrc.

Vishnu Jan 01, 2026