$ sshconfig-lint
Back to the checker
ENDEFRES

SSH CONFIG BASICS

Learn SSH config in 20 minutes.

A short, practical introduction to Host blocks, OpenSSH matching, and safer defaults. Read three lessons, find five real mistakes, then check the result in the browser.

20 minutesBeginner3 lessons and 1 exercise

Three ideas that prevent most config mistakes

Give connections useful names

A Host block creates an alias. HostName is the real server, while User and IdentityFile provide connection-specific settings. You can then run ssh school-server instead of remembering every option.

Host school-server
  HostName 203.0.113.42
  User student
  IdentityFile ~/.ssh/id_ed25519

Remember: Host is the name you type. HostName is the server SSH connects to.

Specific hosts belong before Host *

For many options, OpenSSH keeps the first value it obtains. A broad Host * block near the top can therefore win before a later specific block is evaluated.

Host school-server
  User student

Host *
  User deploy

Remember: Put specific Host blocks first and shared defaults at the end.

Prefer safe, narrow settings

Do not disable host key checks globally. Keep forwarding off by default and enable it only for a trusted host that actually needs it. OpenSSH defaults are usually a better starting point than copied legacy settings.

Host legacy-lab
  StrictHostKeyChecking accept-new
  ForwardAgent no

Remember: Scope exceptions to one host instead of weakening every connection.

CLASSROOM EXERCISE

Find five problems in this config

Answer each question. The related config line is highlighted while you work, and the corrected version unlocks after all five answers are right. Progress is kept only in this browser.

Configuration to inspect
Host *  StrictHostKeyChecking no  User deploy  ControlMaster auto  ControlPath ~/.ssh/control-%h Host school-server  HostName 203.0.113.42  User student  Ciphers aes256-gcm@openssh.com,3des-cbc Host school-server  IdentityFile ~/.ssh/id_ed25519
Solved 0 of 5
Question 1Which User value reaches school-server?
Question 2Which setting weakens connection security?
Question 3Why can this ControlPath collide?
Question 4Which algorithm should be removed?
Question 5What structural problem makes the config harder to reason about?

Using this in a lesson

Using this in a lesson

The exercise works as a short individual task or a pair discussion. No account, installation, or uploaded file is required.

  1. Give learners 5 minutes to explain each problem.
  2. Compare answers in pairs and propose a corrected config.
  3. Paste the correction into the checker and discuss every remaining finding.
Try the browser checkerOpen all rule guidesPrint classroom worksheet