meltaSSH config generator
Fill in the fields and copy a Host block for ~/.ssh/config, plus the short command that uses it. It all runs in your browser; nothing you type leaves the page.
What each line does
| Keyword | What it does | Default |
|---|---|---|
Host | Starts a block. The lines under it apply when the name you type after ssh matches one of its patterns, up to the next Host or Match. | Not set |
HostName | The real host name or IP address to connect to. | The name you typed |
User | The user to log in as on the remote machine. | Not set |
Port | The port to connect to on the remote host. | 22 |
IdentityFile | The private key to use. Several lines add to the list of keys tried. | The standard files in ~/.ssh, such as id_ed25519 |
IdentitiesOnly | Use only the configured key files, even if ssh-agent offers more. | no |
ProxyJump | Connect to a jump host first, then forward to this host from there. Same as ssh -J. | Not set |
ServerAliveInterval | Seconds without data from the server before ssh sends a check through the encrypted channel. | 0 (off) |
ServerAliveCountMax | Checks that may go unanswered before ssh disconnects. | 3 |
ForwardAgent | Forward your ssh-agent connection to the remote machine. | no |
LocalForward | Forward a local port over the connection to a host and port reachable from the remote machine. | Not set |
Keywords are case-insensitive; values are case-sensitive. Wrap a value in double quotes if it contains spaces, which the generator does for you.
Where the block goes
Your own settings live in ~/.ssh/config on the computer you connect from; system-wide defaults live in /etc/ssh/ssh_config. ssh reads command-line options first, then your file, then the system file, and for each setting it keeps the first value it finds. So put specific Host blocks near the top and a catch-all Host * block at the end.
The file must be readable and writable by you and not writable by others. To check what ssh will actually use for an alias, ssh -G prints the configuration after evaluating Host and Match blocks, then exits.
chmod 600 ~/.ssh/config ssh -G devbox
Keep-alives
With ServerAliveInterval 15 and the default count of 3, ssh disconnects about 45 seconds after the server stops responding, so you know the connection is dead. These checks travel inside the encrypted channel, so unlike TCPKeepAlive they cannot be spoofed. If the connection drops for other reasons, Fix SSH from your phone goes through the usual causes.
ForwardAgent, and the safer option
Agent forwarding lets the remote machine ask your local ssh-agent to sign with your keys. The OpenSSH manual says to enable it with caution: users who can bypass file permissions on the remote host can use your agent through the forwarded socket. They cannot extract the keys, but they can authenticate with them while you are connected. If you only want to reach a second machine through the first, use ProxyJump; the ssh manual calls a jump host a safer alternative. The destination's settings are not generally applied to the jump host, so give the jump host its own Host block.
Common questions
Where is the SSH config file?
Your personal file is ~/.ssh/config on the computer you run ssh from, and the system-wide file is /etc/ssh/ssh_config. Your file is read first, so its values win over the system file.
What do ServerAliveInterval and ServerAliveCountMax do?
ServerAliveInterval sets how many seconds ssh waits without hearing from the server before sending a check, and ServerAliveCountMax sets how many unanswered checks it allows before disconnecting. The interval defaults to 0, which means no checks; the count defaults to 3.
What does IdentitiesOnly yes do?
It makes ssh use only the key files you configured, even if ssh-agent offers more identities. It is meant for when your agent holds many keys and the server would otherwise see the wrong ones first.
Is ForwardAgent safe to turn on?
Only for hosts you trust. Anyone who can bypass file permissions on the remote machine can use your forwarded agent to authenticate as you while you are connected, so it is off by default. ProxyJump covers the common case of hopping through one machine to reach another.
What is ProxyJump in SSH config?
ProxyJump makes ssh connect to a jump host first and then open a forwarded connection to the real target from there. It takes [user@]host[:port] entries, separated by commas for several hops, and is the config file version of ssh -J.
Why is my SSH config being ignored?
Usually an earlier block, often a Host * at the top, already set the value, and ssh keeps the first value it finds. Run ssh -G alias to see what applies, and check that the file is not writable by other users.