OpenSSH ~/.ssh/config · ProxyJump Bastion · Port Forwarding · ServerAlive

OpenSSH Client Config Generator

Visually build and organize your ~/.ssh/config file. Simplify complex terminal logins like ssh ubuntu@ec2-54-1-2-3... into ssh prod.

Configuring Host: prod-web

Host Alias / Shortcut:Command: ssh prod-web

HostName (FQDN or IP):

Remote Username:

SSH Port:

Private Key File (IdentityFile):

ProxyJump (Bastion / Jump Host):

LocalForward (Tunneling):

ServerAliveInterval (Keepalive):

StrictHostKeyChecking:

IdentitiesOnly: Prevents "Too many authentication failures"Compression: Enable gzip on slow connectionsForwardAgent: Forward local ssh-agent

Generated ~/.ssh/config File:(2 configured hosts)

Host prod-web
    HostName 198.51.100.42
    User ubuntu
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes
    ServerAliveInterval 60
    ServerAliveCountMax 3
    Compression yes
    StrictHostKeyChecking accept-new

Host private-db
    HostName 10.0.2.15
    User postgres
    Port 5432
    IdentityFile ~/.ssh/db_key.pem
    IdentitiesOnly yes
    ProxyJump prod-web
    ServerAliveInterval 30
    ServerAliveCountMax 3
    StrictHostKeyChecking accept-new
    LocalForward 5432 127.0.0.1:5432

OpenSSH Permissions Requirements (chmod 600)

OpenSSH will refuse to read config files if file permissions are too open. Ensure correct POSIX permissions on your system:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
touch ~/.ssh/config && chmod 600 ~/.ssh/config
chmod 600 ~/.ssh/id_ed25519

Mastering OpenSSH Configuration: Architecture & Best Practices

01.The Power of the ~/.ssh/config File

Typing cumbersome commands like ssh -i ~/.ssh/company_key.pem -p 2222 [email protected] every day is inefficient and error-prone.

By defining host aliases in ~/.ssh/config, OpenSSH automatically injects the username, port, private key, and connection flags. You simply run:

ssh prod

This shortcut also applies seamlessly to scp, rsync, and VS Code Remote SSH!

02.ProxyJump: Secure Bastion Architecture

In modern cloud security (AWS VPC, GCP Cloud), backend database servers and worker nodes have no public IP addresses. They are only reachable via an edge Bastion host (jump box).

Instead of manually SSHing into the bastion and storing private keys on that intermediate host (a severe security risk!), OpenSSH ProxyJump creates an encrypted end-to-end TCP tunnel:

Host private-db
HostName 10.0.2.15
ProxyJump bastion-host

Your local client authenticates directly with the private database; the bastion never sees your unencrypted session data or keys.

03.Preventing Frozen Sessions: ServerAliveInterval

If your terminal frequently freezes with "packet_write_wait: Connection to ... broken pipe" after 5 minutes of inactivity:

Network stateful firewalls and NAT gateways drop idle TCP connections after an inactivity timeout. Adding keepalive signals instructs your client to send a tiny heartbeat probe through the tunnel:

ServerAliveInterval 60 – Transmits a heartbeat every 60 seconds.
ServerAliveCountMax 3 – Drops connection only if 3 probes fail consecutively.

04.IdentitiesOnly: Solving "Too Many Authentication Failures"

If you have multiple SSH keys loaded in your ssh-agent, OpenSSH attempts each key sequentially until one matches.

Most hardened servers have MaxAuthTries 6. If your agent presents 6 mismatching keys, the server terminates the connection with an authentication failure before ever trying the right key!

Setting IdentitiesOnly yes forces SSH to use exclusively the key explicitly specified in IdentityFile for that host.