Hosts
Edit Host
Advanced Options
~/.ssh/config
Append to
~/.ssh/config then run chmod 600 ~/.ssh/configBuild ~/.ssh/config Host entries visually
← devnestio~/.ssh/config then run chmod 600 ~/.ssh/configSSH Config Generator creates properly formatted entries for your ~/.ssh/config file. Specify a hostname alias, real host address, username, port, identity file path, and other options — the generator produces the SSH config block you can paste directly into your config file. This lets you connect with short aliases instead of long ssh commands.
The SSH config file (~/.ssh/config) allows you to set per-host defaults and create short aliases for servers you connect to frequently. Instead of: ssh -i ~/.ssh/my_key -p 2222 user@192.168.1.100, define a Host block and just type: ssh myserver. The file uses Host patterns — * applies to all hosts, specific patterns override the default. Options in more-specific blocks take precedence over wildcards.
Important SSH config options: IdentityFile (which key to use), Port (non-default SSH port), User (username), ProxyJump (jump through an intermediate host — essential for connecting to private network hosts), ServerAliveInterval (send keepalive packets to prevent disconnection), StrictHostKeyChecking (whether to verify host keys — always yes for security), ForwardAgent (forward your SSH key to the remote host — be careful with this on untrusted servers), and LocalForward/RemoteForward for SSH tunnels.
Basic alias
Result: Host prod / HostName 203.0.113.10 / User deploy / IdentityFile ~/.ssh/prod_key
Non-standard port
Result: Host staging / HostName staging.example.com / Port 2222 / User admin
Through bastion host
Result: Host private-server / HostName 10.0.1.50 / ProxyJump bastion.example.com / User ubuntu
What is a ProxyJump and when do I use it?
ProxyJump (ssh -J) connects to a target host through one or more intermediate hosts. Used for: reaching servers in private networks that aren't directly accessible from the internet, connecting to multiple cloud environments through a single bastion host, and corporate environments where all SSH goes through a jump server. Config example: Host internal / HostName 10.0.0.5 / ProxyJump bastion.example.com. You can chain multiple jumps: ProxyJump bastion1,bastion2. ProxyJump replaced the older ProxyCommand nc -W1 %h %p for most use cases.
How do SSH key pairs work?
SSH key authentication uses asymmetric cryptography. You have a key pair: private key (kept secret on your machine, never shared) and public key (safe to share — put it on servers). When you connect: the server has your public key in ~/.ssh/authorized_keys. SSH uses the public key to create a challenge that only the private key holder can answer. The private key never leaves your machine. Common key types: RSA 4096-bit (widely compatible), Ed25519 (recommended — smaller, faster, equally secure). Generate: ssh-keygen -t ed25519 -C 'your_email@example.com'.
What is the SSH known_hosts file?
~/.ssh/known_hosts stores the public keys of servers you've connected to. On first connection, SSH asks you to verify the server's fingerprint — if you accept, the key is saved. On subsequent connections, SSH verifies the key matches. If the key changed (could indicate a server reinstall or man-in-the-middle attack), SSH warns you and refuses to connect. To remove a stale key: ssh-keygen -R hostname. For automation (not recommended for security): set StrictHostKeyChecking no in ssh config to skip verification.
How do I set up SSH agent forwarding?
SSH agent forwarding allows you to use your local SSH keys on a remote host — useful when you need to git clone from a remote server using your local GitHub key without copying the key to the server. Enable in config: Host server / ForwardAgent yes. Or on the command line: ssh -A server. Security warning: agent forwarding is risky on untrusted servers — anyone with root on the remote can use your forwarded agent to authenticate as you elsewhere. Alternative: ProxyJump (ssh -J) is safer as it doesn't forward the agent socket.
What SSH ports are commonly used?
Port 22: the standard SSH port — the first thing port scanners target, so many admins move SSH to a non-standard port to reduce automated brute-force attempts. Common alternative ports: 2222, 22222, 2200. This is 'security through obscurity' — not a real security measure, but it reduces log noise. Defense: disable password authentication (PasswordAuthentication no in sshd_config), use key-only auth, and use fail2ban to block repeated failed attempts. Cloud providers (AWS, GCP) use port 22 by default with security groups to restrict access to specific IPs.