SSH Config File: Connect to Servers Effortlessly

SSH config lives in ~/.ssh/config and eliminates repeated typing. Instead of ssh -i ~/keys/prod.pem -p 2222 admin@192.168.1.100, use ssh prod. Config makes complex SSH setups simple: ProxyJump through bastion hosts, local port forwarding, persistent connections. Essential for DevOps.

SSH Config Overview

• File location: ~/.ssh/config
• Permissions must be 600: chmod 600 ~/.ssh/config
• Read top-to-bottom (first match wins)
• Supports wildcards and patterns
• Applied automatically by ssh command

Basic Host Configuration

Host myserver
    HostName example.com
    User admin
    IdentityFile ~/.ssh/id_rsa
    Port 22

# Now: ssh myserver (instead of ssh -i ~/.ssh/id_rsa admin@example.com)

Create Host Aliases

# ~/.ssh/config examples
Host staging
    HostName staging.internal
    User deploy
    IdentityFile ~/.ssh/staging_key
    Port 2222

Host production
    HostName prod.internal
    User deploy
    IdentityFile ~/.ssh/prod_key
    StrictHostKeyChecking accept-new

Host backup-server
    HostName backup.company.com
    User backupuser
    IdentityFile ~/.ssh/backup_key

Usage:

ssh staging           # Connects with staging config
ssh production        # Connects with production config
scp staging:/data/file.txt ~/  # Copy from staging

Advanced Configuration

# Global defaults (applies to all hosts)
Host *
    ServerAliveInterval 60      # Keep connection alive
    ServerAliveCountMax 10      # Retry 10 times
    TCPKeepAlive yes
    AddKeysToAgent yes          # Add key to SSH agent
    IdentitiesOnly yes          # Only use specified keys
    Compression yes             # Compress traffic

# Specific host overrides defaults
Host production
    HostName prod.example.com
    User deploy
    IdentityFile ~/.ssh/prod_key
    Compression no              # No compression for prod

ProxyJump (Bastion Hosts)

Connect to internal server through bastion (jump host):

# Old way (complex tunneling)
ssh -J admin@bastion.example.com internal.private

# Config way (simple)
Host internal
    HostName 10.0.0.10
    User admin
    ProxyJump bastion

Host bastion
    HostName bastion.example.com
    User jumpuser
    IdentityFile ~/.ssh/bastion_key

# Now: ssh internal (automatically routes through bastion)

Port Forwarding

# Local port forwarding (access remote service locally)
Host database-tunnel
    HostName db.internal
    User admin
    LocalForward 3306 localhost:3306

# Usage: ssh -N database-tunnel
# Then: mysql -h 127.0.0.1 (connects through tunnel)

# Remote port forwarding (expose local service remotely)
Host expose-local
    HostName webserver.example.com
    RemoteForward 8080 localhost:3000

# Dynamic SOCKS proxy (encrypt all traffic)
Host socks-proxy
    HostName proxy.example.com
    DynamicForward 1080

Key Management

# Use specific key for specific host
Host github.com
    IdentityFile ~/.ssh/github_key
    User git

Host gitlab.com
    IdentityFile ~/.ssh/gitlab_key
    User git

Host *
    IdentityFile ~/.ssh/id_rsa
    IdentityFile ~/.ssh/id_ed25519

# Use SSH agent to avoid typing passphrase repeatedly
Host *
    AddKeysToAgent yes
    IdentitiesOnly yes

Real-World Examples

# Complete production setup
Host prod
    HostName 203.0.113.50
    User deploy
    IdentityFile ~/.ssh/prod_key
    Port 2222
    StrictHostKeyChecking accept-new
    User Command ssh-keyscan

# Development server with bastion
Host dev
    HostName 10.0.1.50
    User dev
    IdentityFile ~/.ssh/dev_key
    ProxyJump bastion

Host bastion
    HostName bastion.company.com
    User jumpuser
    IdentityFile ~/.ssh/bastion_key

# Multiple production servers (pattern matching)
Host prod-web-*
    User deploy
    IdentityFile ~/.ssh/prod_key
    ProxyJump bastion

# Usage: ssh prod-web-01, prod-web-02, etc.

Related: SSH key generation | SSH tunneling | Command-line basics | Secure shell

Related articles