NODELOG by THIVELAB
Subscribe
Home/Engineer/Linux / Shell/SSH Config File: Managing Mu…
Linux / ShellBeginnerUbuntuDebianCentOSmacOSsshssh-configjump-host

SSH Config File: Managing Multiple Servers with Host Aliases, Jump Hosts, and ssh-agent

How to manage multi-server shortcuts, jump hosts, key files, and port forwarding with ~/.ssh/config, and how to load keys automatically with ssh-agent.

NONodelogUpdated 0 views
Contents
  1. Basic Structure of ~/.ssh/config
  2. Registering Basic Servers
  3. Setting Global Defaults
  4. Jump Host (Bastion/Jump Server)
  5. Automatic Port Forwarding Setup
  6. ssh-agent — Automatic Key Management
  7. File Permissions (Important)

Basic Structure of ~/.ssh/config

CODE
Host <alias>
    HostName <actual IP or domain>
    User <username>
    Port <port>
    IdentityFile <path to key file>

Create the file:

Bash
mkdir -p ~/.ssh
touch ~/.ssh/config
chmod 600 ~/.ssh/config

Registering Basic Servers

CODE
# ~/.ssh/config

# Production server
Host prod
    HostName 203.0.113.10
    User deploy
    Port 2222
    IdentityFile ~/.ssh/prod_rsa

# Development server
Host dev
    HostName 203.0.113.20
    User ubuntu
    IdentityFile ~/.ssh/dev_rsa

# AWS instance
Host aws-web
    HostName ec2-12-34-56-78.ap-northeast-2.compute.amazonaws.com
    User ec2-user
    IdentityFile ~/.ssh/my-key.pem
Bash
# Connect like this
ssh prod
ssh dev
ssh aws-web

Setting Global Defaults

CODE
Host *
    ServerAliveInterval 60      # keepalive every 60 seconds
    ServerAliveCountMax 3       # disconnect after 3 unanswered keepalives
    AddKeysToAgent yes          # automatically add keys to ssh-agent
    IdentityFile ~/.ssh/id_ed25519
    StrictHostKeyChecking ask   # prompt to confirm new hosts

Jump Host (Bastion/Jump Server)

Reach internal servers that are not directly accessible from outside by going through a jump host.

CODE
Host bastion
    HostName 203.0.113.1
    User admin
    IdentityFile ~/.ssh/bastion_rsa

Host internal-db
    HostName 10.0.1.50
    User ubuntu
    IdentityFile ~/.ssh/internal_rsa
    ProxyJump bastion          # via bastion
    # Older OpenSSH:
    # ProxyCommand ssh -W %h:%p bastion
Bash
ssh internal-db    # automatically connects via bastion

Automatic Port Forwarding Setup

CODE
Host tunnel-db
    HostName prod-server.example.com
    User deploy
    LocalForward 15432 localhost:5432   # local 15432 → server 5432
    LocalForward 16379 localhost:6379   # local 16379 → server 6379
Bash
ssh -N tunnel-db    # port forwarding only (no shell)
# You can now connect to PostgreSQL at localhost:15432 from your local machine

ssh-agent — Automatic Key Management

Use ssh-agent to reuse keys without entering a passphrase each time.

Bash
# start the agent
eval "$(ssh-agent -s)"

# add keys
ssh-add ~/.ssh/id_ed25519
ssh-add ~/.ssh/prod_rsa

# list loaded keys
ssh-add -l

# remove all keys
ssh-add -D

# macOS: store in Keychain (persists across reboots)
ssh-add --apple-use-keychain ~/.ssh/id_ed25519

Adding this to ~/.ssh/config loads keys automatically:

CODE
Host *
    AddKeysToAgent yes
    UseKeychain yes    # macOS only

File Permissions (Important)

Bash
chmod 700 ~/.ssh
chmod 600 ~/.ssh/config
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub
chmod 600 ~/.ssh/authorized_keys

If permissions are too open, SSH will refuse to use the key files.

#ssh#ssh-config#jump-host#ssh-agent
Editorial note

AI tools may assist drafting. Check the evidence in each guide for whether commands were run and which environment was used. Confirm the current docs for your version before applying instructions, and email us about errors. email us

Topic-related official docs (auto-linked · not per-claim sources)Linux man pages ↗
How we write and review →Editorial policy →

Questions & answers

Ask a question about this guide. We'll review and reply.