Guide
Organising SSH connections with ~/.ssh/config
If you connect to more than a couple of servers, typing ssh -i ~/.ssh/key -p 2222 [email protected] gets old quickly, and remembering which key goes with which host is error-prone. The OpenSSH client reads ~/.ssh/config, where each server gets a short alias and its own settings. This generator builds that file from a form, including jump hosts and tunnels.
How ssh reads the file
The file is a list of Host blocks. When you run ssh alias, the client walks through the file from top to bottom and, for every option, keeps the first value it finds in a block that matches. That rule explains the layout the generator uses: specific hosts first, and a catch-all Host * block at the very end with defaults that should only apply when nothing more specific was set.
What each block sets
Host is the alias you type. HostName is the real address or DNS name, User the login name and Port the SSH port, which is left out when it is the standard 22. IdentityFile names the private key for that server. With the IdentitiesOnly option on, the block also says IdentitiesOnly yes, so ssh offers only that key instead of every key loaded in your agent, which avoids “Too many authentication failures” on servers with strict limits.
Jump hosts
Private servers are often reachable only through a bastion. ProxyJump bastion tells ssh to connect to the bastion first and tunnel through it, using the bastion’s own block for its address, user and key. It replaces older ProxyCommand recipes and works with scp, rsync and Git too. Agent forwarding is an alternative that lets the remote server use your local keys, but anyone with root on that server can then use them while you are connected, so prefer ProxyJump.
Port forwarding
LocalForward 5432 localhost:5432 opens port 5432 on your machine and forwards it through the SSH connection to port 5432 as seen from the server. With that line in place, ssh db-prod also makes the remote database available at localhost:5432 for a local client, without opening the database port to the internet.
Defaults for every host
The final Host * block can send keep-alive messages every 60 seconds and give up after three missed replies, which stops idle connections from freezing behind NAT routers, and AddKeysToAgent yes, which adds a key to the agent the first time you unlock it so you type its passphrase only once per session.
A worked example
The Sample defines three hosts. The db-prod block reads Host db-prod, HostName 10.0.2.15, User ubuntu, IdentityFile ~/.ssh/id_ed25519, IdentitiesOnly yes, ProxyJump bastion and LocalForward 5432 localhost:5432, with no Port line because it uses 22. A github.com block uses a separate key for Git, and the file ends with Host * holding the keep-alive settings. Typing ssh db-prod now hops through the bastion and opens the database tunnel in one step.
Saving the file
Save the result as ~/.ssh/config and restrict it with chmod 600 ~/.ssh/config; OpenSSH refuses to use a config file that other users can write. On Windows, the built-in OpenSSH client reads C:\Users\you\.ssh\config with the same syntax.
Related tools
- rsync Command Builder uses the same aliases for backups.
- Firewall Rule Generator limits who can reach SSH at all.
- Chmod Calculator sets 600 and 700 on keys and folders.
- Git Command Finder covers switching remotes to SSH.
Checked against the current version of the SSH Config Generator on .