Explain SSH config code

What this SSH config sample shows

Host and HostName

Host is the name you type, and HostName is the real server. So ssh staging goes to staging.example.com as deploy on port 2222: ssh -G staging, which prints the settings ssh would use without connecting, showed hostname staging.example.com, user deploy and port 2222.

keys per host

IdentityFile picks the key, and IdentitiesOnly yes tells ssh to offer only that one. work-github is a second name for github.com with the work key: ssh -G work-github showed hostname github.com and only id_ed25519_work. git clone git@work-github:acme/app.git called ssh with git@work-github, so the clone used the work key.

jump hosts

ProxyJump bastion makes ssh connect to bastion first and reach staging through it. The bastion's own block applies to that first hop: ssh -G bastion showed hostname bastion.example.com, user deploy and the default port 22.

Host * and first match

Host * matches every host, so ServerAliveInterval 60 showed up for all of them, including a host with no block of its own. With it, after 60 seconds without data from the server, ssh sends a message asking for a reply; the default, 0, never does. For each setting, ssh keeps the first value it reads, which is why the catch-all block goes last.

Good to know

• Checked with OpenSSH 10.6 using ssh -G -F config <host> on a test home folder: nothing connected anywhere.
• A misspelled option stops ssh before it connects: with HostNme, ssh printed Bad configuration option: hostnme and terminating, 1 bad configuration options.
• Hosts without IdentitiesOnly yes got ssh's whole list of default key files, six of them from ~/.ssh/id_rsa to ~/.ssh/id_mldsa44_ed25519, and ssh can offer keys from your agent too. Each key ssh offers counts as a try, and the OpenSSH server's MaxAuthTries default is 6, so with many keys the right one can come too late.

Watch out: Put Host * first and its values win over everything below it. With a Host * block holding User nobody at the top of the file, ssh -G staging showed user nobody, although the staging block says User deploy. Keep specific hosts at the top and the catch-all at the end.