If you’re still typing ssh -i ~/.ssh/mykey.pem ec2-user@ec2-54-123-45-67.compute-1.amazonaws.com, you’re working too hard.
SSH config transforms verbose commands into simple ssh prod invocations.
The Basics#
Create or edit ~/.ssh/config:
Now ssh prod connects with the right key and user. No more remembering IP addresses.
Multiple Environments#
Commands like scp file.txt staging:/app/ just work.
Wildcard Patterns#
Apply settings to multiple hosts:
Or match by domain:
Jump Hosts (Bastion)#
Access private servers through a bastion:
Now ssh private-db automatically tunnels through the bastion. No manual port forwarding needed.
Connection Persistence#
Keep connections alive and reuse them:
Create the sockets directory:
1
2
| mkdir -p ~/.ssh/sockets
chmod 700 ~/.ssh/sockets
|
First connection opens the socket. Subsequent connections reuse it instantly.
Port Forwarding#
Run ssh -N db-tunnel to create the tunnel. Your local localhost:5432 connects to the remote database.
Dynamic SOCKS Proxy#
Route browser traffic through a server:
Connect with ssh -N proxy, then configure your browser to use localhost:1080 as a SOCKS5 proxy.
Per-Host Settings#
Git Over SSH#
Configure GitHub/GitLab with specific keys:
Clone work repos with:
1
| git clone git@github-work:company/repo.git
|
Organizing Large Configs#
Split into multiple files:
Security Settings#
Useful Shortcuts#
Debugging Connections#
1
2
3
4
5
6
7
8
| # Verbose output
ssh -v prod
# Very verbose
ssh -vv prod
# Show which config options apply
ssh -G prod | grep -E "^(hostname|user|identityfile|proxyjump)"
|
The ~/.ssh Directory#
Permissions matter:
1
2
3
4
| chmod 700 ~/.ssh
chmod 600 ~/.ssh/config
chmod 600 ~/.ssh/id_*
chmod 644 ~/.ssh/*.pub
|
The Payoff#
Before:
1
| ssh -i ~/.ssh/prod-key.pem -o ProxyJump=ec2-user@bastion.example.com admin@10.0.1.50
|
After:
Your muscle memory will thank you.
Good SSH config is invisible. You forget it exists until you’re on a machine without it.