SysAdmin Tools

SSH Config Generator

Build a ~/.ssh/config file for all your servers — aliases, identity files, jump hosts, keep-alive and security options — then copy or download it.

Add Server
~/.ssh/config preview
# Generated by SysAdmin Tools — tools.techtransit.org
# SSH Config — copy to ~/.ssh/config

Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3

# Add a server on the left to generate a Host entry
Load example:

Advertisement

An ssh config generator builds a clean, correct ~/.ssh/config file so you can connect to any server with a short alias instead of a long command. Define your servers on the left — alias, hostname, user, port, and identity file — and a ready-to-paste config is written on the right in real time. Once saved, ssh myserver replaces ssh -i ~/.ssh/id_ed25519 -p 22 deploy@192.168.1.10.

The SSH config file is one of the most useful and underused features of OpenSSH. It lets you assign a Host alias to each server, pin a specific SSH identity file per host (essential when you manage multiple SSH keys), route connections through a SSH jump host with ProxyJump, and set sensible keep-alive and security defaults once under Host *. This ssh config builder generates all of that without you memorising directive names or their exact capitalisation.

Everything runs in your browser — no server, no accounts, nothing uploaded. Add as many servers as you need, reorder them, load an example to see the pattern, then copy the result or download it as a file named config (with no extension, because SSH reads ~/.ssh/config directly). Whether you're wondering how to create an SSH config file for the first time or standardising connection settings across a fleet, this tool gives you a correct starting point in seconds.

The generator covers the directives you reach for most: HostName, User, Port, IdentityFile, ConnectTimeout, ServerAliveInterval, ForwardAgent, StrictHostKeyChecking, Compression, and LogLevel — plus global defaults applied to every host.

How to Use the SSH Config Generator

  1. 1

    Fill in the server details

    Enter an alias (the shortcut you will type after ssh), the hostname or IP, the login user, the port, and optionally an identity file. The alias is the only required field — everything else is added only when provided.

  2. 2

    Add advanced options if needed

    Open the advanced panel to set per-server keep-alive intervals, ForwardAgent, StrictHostKeyChecking, Compression, or LogLevel. These are optional and only appear in the output when you set them.

  3. 3

    Add the server and repeat

    Click "Add Server" to append it to the list. Add as many as you like; each becomes its own Host block. Use the edit and delete buttons to change entries, and drag the handle to reorder them in the file.

  4. 4

    Set global defaults (optional)

    Open Global SSH Settings to configure the Host * block — ServerAliveInterval, ServerAliveCountMax, AddKeysToAgent, a default IdentityFile, and ConnectTimeout. These apply to every host unless a specific host overrides them.

  5. 5

    Copy or download the config

    The preview shows the complete file. Click "Copy Config" to paste into ~/.ssh/config, or "Download config" to save it as a file named config (no extension). Then run chmod 600 ~/.ssh/config to secure it.

Understanding the SSH Config File

The ~/.ssh/config file is read by the OpenSSH client every time you run ssh, scp, or sftp. It is organised into Host blocks. Each block starts with Host followed by an alias (or pattern), and the indented directives beneath it apply whenever that alias matches. The special pattern Host * matches every connection, which is why global defaults live there. When you connect, SSH reads the file top to bottom and, for each directive, uses the first value that matches — so more specific Host blocks should come before broad patterns. A directive like IdentityFile ~/.ssh/id_ed25519 tells SSH which private key to offer for that host, which is how you cleanly manage multiple SSH keys across GitHub, work servers, and personal VPSes without -i flags. Two categories are worth understanding. Keep-alive directives (ServerAliveInterval and ServerAliveCountMax) send periodic packets so idle sessions don't drop behind a NAT or firewall. Jump hosts (ProxyJump) let you reach a server that isn't directly accessible by transparently connecting through a bastion first — ssh internal-db can hop through bastion automatically once configured.
FieldDescription
HostDefines an alias (or pattern). The directives below it apply when you connect using that alias, e.g. ssh myserver.
HostNameThe real IP address or domain SSH connects to. The alias can differ from the actual hostname.
UserThe login username for that host, so you can omit user@ from the command.
PortThe SSH port on the server (default 22). Set this when the server listens on a non-standard port.
IdentityFilePath to the private key to use for this host — the key way to manage multiple SSH keys per server.
ProxyJumpRoutes the connection through a jump/bastion host first, e.g. ProxyJump bastion, to reach internal servers.
ServerAliveIntervalSeconds between keep-alive packets sent to the server to stop idle connections from dropping.
StrictHostKeyCheckingControls host-key verification: yes (strict), no (insecure), or accept-new (trust on first use, then enforce).

Advertisement

Common SSH Config Use Cases

Short aliases for frequent servers

Replace long ssh commands with memorable aliases. Instead of ssh -p 2222 deploy@203.0.113.10 you type ssh prod-web. The alias, port, user, and key are all remembered in the config.

A different key per server

Assign a specific IdentityFile to each Host block so the right private key is offered automatically — no more "Too many authentication failures" from SSH trying every key in your agent.

Reaching internal servers via a bastion

Use ProxyJump to hop through a jump host to servers with no public IP. Once configured, ssh internal-db connects through the bastion transparently, and scp works the same way.

Stable connections over flaky networks

Set ServerAliveInterval and ServerAliveCountMax globally under Host * so long-running SSH sessions survive brief network drops and idle timeouts on VPNs, NATs, and corporate firewalls.

SSH Config Generator — Frequently Asked Questions

What is the SSH config file?
The SSH config file is a per-user configuration file read by the OpenSSH client (ssh, scp, sftp). It lets you define connection settings for hosts — such as the hostname, username, port, and private key — under named Host blocks, so you can connect with a short alias instead of a long command. It also holds global options that apply to every connection. It is plain text and lives at ~/.ssh/config on Linux and macOS.
Where is the SSH config file located?
The user-level SSH config file is located at ~/.ssh/config (that is /home/username/.ssh/config on Linux or /Users/username/.ssh/config on macOS). On Windows with the built-in OpenSSH client it is at C:\Users\username\.ssh\config. There is also a system-wide file at /etc/ssh/ssh_config, but the per-user ~/.ssh/config is where you normally add your own host entries. The file does not exist by default — you create it yourself.
How to create an SSH config file?
Create the ~/.ssh directory if it does not exist (mkdir -p ~/.ssh), then create a file named config inside it (touch ~/.ssh/config) and set secure permissions with chmod 600 ~/.ssh/config. Open it in any text editor and add Host blocks. This generator produces the exact content to paste in — or you can download the ready-made file named config and move it to ~/.ssh/. The file must be named config with no extension, because SSH reads ~/.ssh/config directly.
What is a Host alias in SSH config?
A Host alias is the short name you put after the Host keyword, for example Host prod-web. It becomes the shortcut you type: ssh prod-web. The alias does not have to match the real server name — the actual address is set separately with the HostName directive. This lets you give servers memorable names (prod-web, db-1, bastion) regardless of their IP addresses or DNS names, and bundle each server's user, port, and key under that one alias.
How to use multiple SSH keys for different servers?
Give each Host block its own IdentityFile directive pointing at the correct private key, and add IdentitiesOnly yes so SSH offers only that key. For example, one host uses IdentityFile ~/.ssh/id_work and another uses IdentityFile ~/.ssh/id_personal. This ensures the right key is used automatically for each server, avoids "Too many authentication failures" errors caused by the agent trying every key, and keeps work and personal identities cleanly separated.
What is ProxyJump in SSH config?
ProxyJump tells SSH to connect through an intermediate jump host (a bastion) before reaching the target server — useful for servers on a private network with no public IP. In the target's Host block you add ProxyJump bastion, where bastion is another Host alias defined in the same config. Running ssh target then transparently hops through the bastion. It replaces the older, more verbose ProxyCommand with ssh -W and works with scp and sftp too.
How to configure SSH keep-alive settings?
Add ServerAliveInterval and ServerAliveCountMax to a Host block (or to Host * for all hosts). ServerAliveInterval is the number of seconds of inactivity after which SSH sends a keep-alive packet to the server; a common value is 60. ServerAliveCountMax is how many unanswered keep-alives are allowed before SSH gives up — for example 3. Together, ServerAliveInterval 60 and ServerAliveCountMax 3 keep idle sessions alive and detect a dead connection after about three minutes.
What does IdentityFile do in SSH config?
IdentityFile specifies the path to the private key SSH should use to authenticate to that host, for example IdentityFile ~/.ssh/id_ed25519. Without it, SSH tries the default keys and every key loaded in your agent. Setting IdentityFile per host ensures the correct key is offered immediately, which is how you manage multiple keys across different servers and services. Pair it with IdentitiesOnly yes to stop SSH from also trying other keys in the agent.
How to disable StrictHostKeyChecking safely?
StrictHostKeyChecking controls whether SSH verifies a server's host key before connecting. The safest modern setting is accept-new, which automatically trusts a host the first time you connect but still refuses if a known host's key later changes (which could indicate a man-in-the-middle attack). Avoid StrictHostKeyChecking no, which disables the protection entirely and only makes sense for disposable, non-sensitive lab machines. Set accept-new per host rather than globally so production servers keep strict verification.
What is ForwardAgent in SSH config and when to use it?
ForwardAgent yes makes your local SSH agent (and its loaded keys) available on the server you connect to, so you can hop from that server to another using your local keys without copying them onto the intermediate host. It is convenient for jumping between servers, but it carries risk: anyone with root on the intermediate server can use your forwarded agent while you are connected. Only enable ForwardAgent for hosts you fully trust, and prefer ProxyJump for reaching internal servers, which does not expose your agent.

Related Tools

Port Checker

Confirm the SSH port is open on a host before adding it to your config.

SSL Checker

Check the TLS certificate on servers you also administer over SSH.

Nginx Config Generator

Generate the web server config for the hosts you connect to via SSH.