Where does the config go?

In `~/.ssh/config` on your own machine, readable only by you (`chmod 600 ~/.ssh/config`). ssh reads it automatically.

Does order matter in ~/.ssh/config?

Yes. For each option ssh uses the first value it finds, so put specific Host blocks before general ones such as `Host *`.

How do I check what ssh will actually use?

Run `ssh -G alias`. It prints the fully resolved configuration for that host without connecting.

Free tool · no account

~/.ssh/config generator

Describe your servers and the bastion in front of them, and get a ready-to-paste ~/.ssh/config - so `ssh prod-web` does the right thing - along with the equivalent one-line ssh command for each host.

Host 1

Alias (what you type)

HostName (address)

User

Port

IdentityFile

ProxyJump (bastion)

ForwardAgent (not recommended)

Host 2

Alias (what you type)

HostName (address)

User

Port

IdentityFile

ProxyJump (bastion)

ForwardAgent (not recommended)

~/.ssh/config

Host bastion
    HostName bastion.example.com
    User ubuntu
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Host prod-web
    HostName 10.0.1.12
    User deploy
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes
    ProxyJump bastion

Append to ~/.ssh/config, then keep it private: chmod 600 ~/.ssh/config.

ssh bastion - without the config file

ssh -i ~/.ssh/id_ed25519 ubuntu@bastion.example.com

ssh prod-web - without the config file

ssh -J ubuntu@bastion.example.com -i ~/.ssh/id_ed25519 deploy@10.0.1.12

Runs entirely in your browser. Nothing you enter is sent to Shortspan or saved, and no account is needed.

Next step

Or connect without holding the key

Register servers in Shortspan once, and shortspan ssh prod-web opens the session with a brokered credential - nobody keeps the key, and every session is recorded. Databases behind a bastion connect with shortspan db --via.

Create a free workspace See what Shortspan does

ProxyJump instead of agent forwarding

ProxyJump (OpenSSH 7.3 and later) connects to the target through the bastion while keeping the encrypted session end to end, so the bastion never sees your keys. ForwardAgent instead lets the bastion use your agent - and anyone with root on it can too, while you are connected. The generator uses ProxyJump and warns if you turn agent forwarding on.

IdentitiesOnly

When you name an identity file, the generator adds IdentitiesOnly yes, so ssh offers only that key instead of every key in your agent. Servers that limit authentication attempts otherwise reject you with "Too many authentication failures".

Common questions

Where does the config go?: In ~/.ssh/config on your own machine, readable only by you (chmod 600 ~/.ssh/config). ssh reads it automatically.
Does order matter in ~/.ssh/config?: Yes. For each option ssh uses the first value it finds, so put specific Host blocks before general ones such as Host *.
How do I check what ssh will actually use?: Run ssh -G alias. It prints the fully resolved configuration for that host without connecting.

More free tools