About the SSH Config Generator
An SSH config file exists mainly to stop you memorising things. Host aliases turn a long user-and-hostname-and-port invocation into a short name, and the same aliases work for anything built on SSH — scp, rsync, and Git remotes.
The case that drives most people to write one is multiple identities on the same host. Two GitHub accounts both authenticate to github.com, so SSH cannot tell from the hostname which key to offer. The fix is an alias per identity, each pinned to its own key, and Git remotes written against the alias rather than the real hostname.
Pin the identity explicitly. Without it, SSH offers every key the agent holds until one is accepted, which is slow, leaks which keys you have to every server you connect to, and can trip failed-authentication limits before the right key is tried. Setting the identity file and disabling agent key offering makes each alias deterministic.
Frequently asked questions
How do I use two GitHub accounts on one machine?
Create an alias per account, each with its own identity file, both pointing at github.com as the real hostname. Then write repository remotes against the alias instead of the real host. The alias is what selects the key, so each repository authenticates as the intended account with no manual switching.
Why is SSH offering the wrong key?
By default it offers every key the agent holds in turn until one is accepted. Set the identity file for the host and enable identities-only, which restricts it to the key you named. Without that, the first accepted key wins — which on a shared host may be an identity you did not intend to use.
Does order matter in the config file?
Yes, and it surprises people. SSH applies the first value it finds for each option, so a specific host block must come before a broader wildcard, not after. Put general defaults at the bottom of the file. Options set in an earlier block cannot be overridden later.
What are the permissions requirements?
The config file should not be group- or world-writable, and private keys must be readable only by you or SSH refuses to use them. A permissions error on a key is one of the more common causes of an authentication failure that looks like a server-side rejection.
How do I reach a host through a bastion?
Use ProxyJump on the target host entry, naming the bastion's alias. SSH then establishes the connection through it transparently, so scp, rsync and Git work against the target without a separate tunnel. This is cleaner than the older ProxyCommand netcat pattern and needs no extra tooling on the bastion.
Need this managed for you, not just automated?
We're also a hands-on DevOps consultancy — Kubernetes, CI/CD, and cloud infrastructure.