All free tools Generated in your browser

SSH Config Builder

Describe the servers you connect to and generate a complete OpenSSH client configuration file for ~/.ssh/config.

CLIENT CONFIGURATION

Build an SSH client config

ssh_config
Host blocks
Global defaults (Host *)

These optional values are written as a Host * block at the end of the file, so they apply to every connection that has not already set the same keyword in a host block above.

How often the client sends a keepalive. Leave empty to omit.
Unanswered keepalives allowed before the client drops the session.
Socket path. %r is the remote user, %h the host and %p the port, so each server gets its own socket. Create the directory first with mkdir -p ~/.ssh/sockets.
How long the shared connection stays open after the last session: a number of seconds, a value such as 10m, yes or no.

Two options weaken security. ForwardAgent yes lets anyone with root on the remote host use your loaded keys while you are connected, so enable it only for hosts you control. StrictHostKeyChecking no accepts changed host keys silently and removes your protection against an intercepted connection.

We do not store your data. The file is assembled entirely in your browser and never sent to VPSLake. This tool asks only for key file paths; it never asks for a private key, a passphrase or a password.

HOW TO USE IT

Build your config in four steps

Work from the connection details you already use on the command line: the address, the account name, the port and the key file.

  1. 1

    Describe each server

    Give the host block a short alias, then add the real address, the login account, a non-default port and the path to your private key. Add a block for every server you connect to regularly.

  2. 2

    Add jumps and forwarding if you need them

    Set ProxyJump when the server is only reachable through a bastion, and add port-forwarding rules for databases, admin panels or a SOCKS proxy.

  3. 3

    Set the shared defaults

    Keepalives, agent handling and connection sharing go in the Host * block, which is written last so that anything set in a host block above still wins.

  4. 4

    Install and test the file

    Copy or download the file, save it as ~/.ssh/config, then run chmod 600 ~/.ssh/config. Check what SSH will actually use with ssh -G myalias, and connect with ssh -v myalias if something does not work.

What the generated file contains

The output is a normal OpenSSH client configuration file. Each Host line names one or more patterns you can type after ssh, and the indented lines below it are the settings applied when a pattern matches. Four-space indentation is only a readability convention, but it is the one OpenSSH itself uses.

Order matters. For each keyword, SSH uses the first value it finds while reading the file from top to bottom, which is why the catch-all Host * block is written last. A value you set for a specific host always beats the same value in the defaults block.

What it saves you typing

Once the file is in place, a long command such as ssh -p 2222 -i ~/.ssh/id_ed25519 -J bastion [email protected] becomes ssh web1. The same aliases are picked up automatically by scp, sftp, rsync, Git over SSH and most editors with a remote-development plugin.

  • Host aliases with address, user and port
  • Per-host identity files and IdentitiesOnly
  • Bastion hops with ProxyJump
  • Local, remote and dynamic port forwarding
  • Keepalives and multiplexed connection sharing

Review the file before it replaces an existing config

This is a reviewed starting point, not an audited configuration. If you already have a ~/.ssh/config, back it up first, because saving over it can break connections you rely on. Check the result with ssh -G <alias> before trusting it, keep the file readable only by you with chmod 600, and remember that agent forwarding and disabled host-key checking both trade real security for convenience.

FREQUENTLY ASKED QUESTIONS

SSH Config Builder FAQ

Save it as ~/.ssh/config on the machine you connect from. Create the directory first if it does not exist with mkdir -p ~/.ssh && chmod 700 ~/.ssh, then run chmod 600 ~/.ssh/config. OpenSSH refuses to use a config file that other users can write to. On Windows the same file lives at %USERPROFILE%\.ssh\config and is used by the built-in OpenSSH client, Git for Windows and WSL separately.
No. It asks only for the path to a key file, such as ~/.ssh/id_ed25519, because that path is what belongs in the config file. It never asks for the key contents, a passphrase or a password, and no field on this page is submitted anywhere. Everything is assembled in your browser.
Every value written into the file is checked first. Aliases must be made of letters, digits and _ . * ? @ -; usernames must match a normal Linux account name; ports must be between 1 and 65535; forwarding rules must be two whitespace-separated parts on one line; and extra directives must look like Keyword value. Line breaks inside a value, control characters and # are refused, because they could turn one directive into two or comment out the rest of a line.
LocalForward 5433 10.0.0.9:5432 opens port 5433 on your own machine and sends anything that connects to it out to 10.0.0.9:5432 as reached from the server, which is the usual way to reach a database that is not exposed publicly. RemoteForward works in the opposite direction: the listening port opens on the server and traffic is delivered to a target reachable from your machine. A remote forward that should listen on more than the server loopback also needs GatewayPorts enabled in the server's sshd_config.
ProxyJump was added in OpenSSH 7.3, released in 2016, so anything current supports it. Check your version with ssh -V. On an older client, remove the ProxyJump value and put ProxyCommand ssh -W %h:%p bastion in the extra directives box instead; it achieves the same result with more typing.
Run ssh -G myalias. It prints the complete, resolved set of options SSH would use for that alias without opening a connection, so you can confirm that the hostname, user, port and identity file are what you expected. If a real connection then fails, ssh -v myalias shows which config files were read, which keys were offered and where the handshake stopped.
Yes. OpenSSH 7.3 and newer support Include. Put Include ~/.ssh/config.d/* as the first line of ~/.ssh/config and drop per-project or per-client files into ~/.ssh/config.d/. Because the first value found for a keyword wins, put the include line near the top and keep the catch-all Host * block at the very bottom of the main file.
It does not generate keys, read or upload key files, contact any server, test whether a host is reachable, or manage known_hosts. It also leaves out keywords it cannot validate confidently; if you need one of those, add it through the extra directives box after checking it in man ssh_config.