EMZETT.
Login

Emzett Wiki

SSH config: Managing several servers conveniently

Properties1
tagsglossar, linux, ssh

2 min read

SSH config: Managing several servers conveniently

In short: The file ~/.ssh/config stores short names, users, ports and keys for servers; instead of long commands ssh myserver is enough.

In more detail: Whoever works with several machines otherwise types ssh -i ~/.ssh/id_ed25519 -p 2222 admin@203.0.113.10. The SSH config turns that into a short ssh web. It also applies to scp, rsync and Git over SSH.

In Depth

Example

# ~/.ssh/config
Host web
    HostName 203.0.113.10
    User admin
    Port 2222
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Host github.com
    User git
    IdentityFile ~/.ssh/id_github

Host *
    ServerAliveInterval 60
    AddKeysToAgent yes

Now: ssh web, scp file web:/tmp/, rsync -av folder/ web:backup/. Host * applies to all as default.

Useful options

  • ProxyJump (jump server): ProxyJump bastion connects via an intermediate machine to a server in the internal network.
  • LocalForward / RemoteForward: store port forwarding (tunnels) permanently.
  • ControlMaster/ControlPersist: reuses an existing connection, saves login time.
  • ServerAliveInterval: prevents connection drops when idle.
  • StrictHostKeyChecking: checking the server fingerprint (do not switch off!).
  • IdentityFile + IdentitiesOnly: deliberately uses the right key.

Security

Permissions: chmod 700 ~/.ssh, chmod 600 ~/.ssh/config and private keys. Use separate keys per service or at least per environment, protected with a passphrase, and the ssh-agent. Disable password login on the server once keys work. The config contains no secrets, but host names and users: do not share blindly in public.

Troubleshooting

ssh -v web (more -vvv) shows details; ssh -G web prints the effective configuration. Typical errors: wrong key, wrong file permissions, changed server fingerprint (check the known_hosts entry, do not simply delete it if you do not know why), firewall or wrong port.

See also: ssh-agent, SSH tunnel, scp

Backlinks