SSH Advanced Features to Simplify Your Daily Routine

Updated 7 November 2026 · Standard formula, shown below

Using SSH every day, you can streamline your workflow with advanced features like ControlMaster multiplexing, SSH keys with agents, and remote port forwarding. This article explains these features and shows how to configure them for faster, more secure connections.

Background: Why SSH Feels Slow and Repetitive

OpenSSH, the most common implementation, has been around since 1999. Many users only ever use ssh user@host and maybe scp. The default behavior creates a new TCP connection and performs a full cryptographic handshake for every command. That means each time you run ssh, you wait for the handshake, type your password or passphrase, and then the connection closes. Over a day, this adds up to seconds of waiting and dozens of password prompts.

But OpenSSH includes several features designed to reduce this overhead and automate routine tasks. Most are disabled by default or require a small one-time configuration. Learning them can turn SSH from a slow, repetitive chore into a fast, transparent part of your workflow.

How SSH Authentication Works (and Where Keys Fit)

SSH uses public-key cryptography to verify your identity. When you generate a key pair with ssh-keygen, you get a private key (kept secret on your machine) and a public key (placed on the server in ~/.ssh/authorized_keys). When you connect, the server sends a challenge that only your private key can answer. This is more secure than a password because the private key is never transmitted.

The main friction is that your private key is usually encrypted with a passphrase. Every time you use it, you must type that passphrase. The solution is an SSH agent, a small program that holds your decrypted private key in memory. On most Linux and macOS systems, the agent is started automatically. You add your key once with ssh-add, and from then on, the agent answers authentication requests without prompting you.

To make this work, ensure your ~/.ssh/config includes AddKeysToAgent yes and IdentityFile ~/.ssh/id_ed25519. Then run ssh-add once per login. If you use a desktop environment, the keychain may handle this automatically.

ControlMaster: Reuse One Connection for Everything

The biggest daily win is connection multiplexing. With ControlMaster, the first SSH connection to a host creates a master socket. Subsequent connections to the same host reuse that socket, skipping the TCP handshake and cryptographic negotiation entirely. The effect is dramatic: commands that took 1-2 seconds now run in milliseconds.

To enable it, add these lines to ~/.ssh/config:

Host *
    ControlMaster auto
    ControlPath ~/.ssh/controlmasters/%r@%h:%p
    ControlPersist 10m

Create the controlmasters directory with mkdir -p ~/.ssh/controlmasters. The ControlPersist 10m keeps the master alive for 10 minutes after the last connection closes, so a quick command doesn’t tear down the socket. You can adjust the time. This works for scp, sftp, and even rsync over SSH, because they all use the same underlying connection.

One caveat: if the master connection drops (e.g., network change), all multiplexed sessions break. You can kill the master with ssh -O exit host and reconnect fresh.

Port Forwarding: Tunneling Services Without Extra Software

SSH can forward ports, letting you access services on remote networks securely. There are three types:

Local forwarding (-L local_port:target_host:target_port): makes a remote service appear on your local machine. Example: ssh -L 8080:localhost:80 user@server lets you open http://localhost:8080 to reach the server’s web interface.
Remote forwarding (-R remote_port:target_host:target_port): exposes a local service to the remote server. Useful for letting a colleague access your local development server.
Dynamic forwarding (-D local_port): creates a SOCKS proxy. Set your browser to use localhost:port and all traffic goes through the SSH server, encrypting it on untrusted networks.

These can be configured permanently in ~/.ssh/config with LocalForward or RemoteForward lines. For example, to always forward local port 8080 to a remote web server, add:

Host myserver
    HostName example.com
    LocalForward 8080 localhost:80

Now every connection to myserver sets up the tunnel automatically.

Jump Hosts and ProxyJump: Reaching Machines Behind Firewalls

Many networks require you to go through a bastion host before reaching internal servers. Instead of manually connecting to the bastion and then SSHing again, you can use ProxyJump. Add to your config:

Host internal
    HostName 10.0.0.5
    ProxyJump bastion

Then ssh internal automatically connects to bastion first and then to 10.0.0.5. This also works with scp and rsync. If you need to chain multiple jumps, separate them with commas: ProxyJump jump1,jump2.

This feature eliminates the need to copy keys to the bastion or use agent forwarding (which can be risky). Each hop uses its own authentication, and you can still use ControlMaster on the final host if you set it up.

Common Problems and How to Avoid Them

Even with these features, you may hit issues:

“Too many authentication failures”: This happens when you have many keys and the server rejects after a few tries. Fix by specifying the exact key with IdentitiesOnly yes in your config for that host.
ControlMaster socket not created: Ensure the ControlPath directory exists. The %r, %h, and %p variables expand to username, host, and port, so the path is unique per connection.
Agent forwarding not working: Add ForwardAgent yes to the config for the specific host. Be cautious: forwarding your agent to an untrusted server lets its admin use your keys. Only do this on hosts you control.
Connection hangs after sleep: The master connection dies. Use ServerAliveInterval 60 and ServerAliveCountMax 3 to detect dead connections and close them.

Security Considerations and Best Practices

These features are safe if configured correctly. Use ed25519 keys (default in modern OpenSSH) rather than RSA, as they are faster and more secure. Protect your private key with a strong passphrase and never share it. The SSH agent should be locked with ssh-add -x on shared machines.

For port forwarding, be aware that -R exposes your local service to the remote network. Only forward to trusted servers. Also, disable password authentication on servers you control by setting PasswordAuthentication no in sshd_config, forcing key-based logins.

Finally, keep OpenSSH updated. The client and server regularly receive security patches. On Linux, use your package manager; on macOS, the built-in version is updated with system updates.

Frequently Asked Questions

Can I use these features with Windows?

Yes. OpenSSH is built into Windows 10 and 11. The config file is at C:\Users\YourName\.ssh\config. ControlMaster and ProxyJump work the same way, though the ControlPath syntax may need adjusting (use %p for port). The built-in PowerShell SSH client supports all these options.

Why is my SSH connection slow even with ControlMaster?

If the first connection is slow, it may be due to DNS lookups. Add UseDNS no to the server’s sshd_config (if you control it) or set GSSAPIAuthentication no in your client config. Also, ensure you are not using a password; key-based auth with an agent is much faster.

How do I stop a stuck SSH session?

Type ~. (tilde followed by period) at the start of a line. This closes the connection. If that doesn’t work, use ~Ctrl-Z to suspend it and then kill %1 in the shell.

Is it safe to use ControlMaster on a public network?

Yes, because the multiplexed connection is encrypted. However, the control socket file is accessible to your user only, so ensure your ~/.ssh directory has permissions 700 and the socket files are not world-readable. Set ControlPath to a directory with restrictive permissions.

Can I use these features with `rsync`?

Absolutely. rsync uses SSH as its transport, so it inherits ControlMaster and ProxyJump settings from your config. You can also specify -e "ssh -J bastion" for a one-off jump host.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.