Your ~/.ssh/config file is the most underused productivity tool in your terminal. Here’s how to make SSH work for you.
Basic Structure#
Now ssh myserver replaces ssh admin@192.168.1.100.
Aliases for Everything#
Wildcards#
Match multiple hosts with patterns:
Jump Hosts (Bastion)#
Access internal servers through a bastion:
Now ssh internal-db automatically routes through bastion. No manual tunneling.
Old ProxyCommand Style#
ProxyJump is cleaner, but ProxyCommand offers more control.
Keep Connections Alive#
Prevent timeouts on flaky networks:
Sends keepalive every 60 seconds, disconnects after 3 failures.
Connection Multiplexing#
Reuse connections for speed:
First connection opens a socket. Subsequent connections reuse it. 10x faster for repeated connections.
1
2
3
| # Create the socket directory
mkdir -p ~/.ssh/sockets
chmod 700 ~/.ssh/sockets
|
Identity Management#
Specific Keys Per Host#
IdentitiesOnly yes prevents SSH from trying other keys.
Agent Forwarding#
Your local SSH agent is available on the remote host. Use sparingly — security risk on untrusted hosts.
Port Forwarding#
Local Forward (Access Remote Service Locally)#
Now ssh db-tunnel creates a tunnel. Connect to localhost:5432 for the remote database.
Remote Forward (Expose Local Service)#
Makes your local port 3000 available on the server’s port 8080.
Dynamic SOCKS Proxy#
Creates a SOCKS5 proxy on localhost:1080. Route browser traffic through it.
Per-Host Settings#
Security Settings#
Handling Legacy Servers#
Old servers need old algorithms:
The + prepends to defaults rather than replacing.
Include Files#
Split config into multiple files:
1
2
3
| mkdir -p ~/.ssh/config.d
# Put work hosts in ~/.ssh/config.d/work
# Put personal hosts in ~/.ssh/config.d/personal
|
Match Blocks#
Conditional configuration:
Useful Aliases in Shell#
Combine with shell aliases:
1
2
3
4
5
6
7
8
9
10
11
12
13
| # ~/.bashrc or ~/.zshrc
# Quick SSH with agent
alias ssh='ssh -A'
# SSH without host key checking (for ephemeral servers)
alias sshn='ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'
# Copy SSH key to server
alias ssh-copy='ssh-copy-id -i ~/.ssh/id_ed25519.pub'
# Kill all control sockets
alias ssh-kill='rm -f ~/.ssh/sockets/*'
|
Complete Example#
Debugging#
1
2
3
4
5
6
7
8
9
| # Verbose output
ssh -v myserver
ssh -vvv myserver # Even more verbose
# Test config without connecting
ssh -G myserver | grep -i proxy
# Check what config applies
ssh -G hostname | head -20
|
Key Takeaways#
- Alias everything — Never type full hostnames
- Use ProxyJump — Clean bastion access
- Enable multiplexing — Faster repeated connections
- Separate keys per purpose — Work, personal, per-service
- Use Include — Organize large configs
Your SSH config should eliminate typing and thinking. If you’re typing a hostname or remembering a port, your config is incomplete. 🌍