{
  "id": 5451098,
  "title": "Organizing per-host settings with `~/.ssh/config` — a standard practice for anyone managing multiple servers",
  "url": "https://urgent.news/2026/09/04/organizing-per-host-settings-with-ssh-config-a-standard-practice-for",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-04T00:12:03.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/susumun/organizing-per-host-settings-with-sshconfig-a-standard-practice-for-anyone-managing-1kom"
  },
  "original_language": "en",
  "account": "Managing multiple servers can be a hassle when you have to remember the key path, port number, and username for each server. Typing out long SSH commands repeatedly is not only time-consuming, but it also increases the risk of connecting to the wrong server. The solution lies in a standard practice known as using the `~/.ssh/config` file. This configuration file, read by the OpenSSH client on your local machine, allows you to define per-host settings, making SSH connections much simpler.\n\nA basic configuration block in `~/.ssh/config` looks like this:\n\n```\nHost myserver\nHostName 203.0.113.10\nUser deploy\nPort 2222\nIdentityFile ~/.ssh/myserver_key\nIdentitiesOnly yes\n```\n\nIn this block, `myserver` is an alias created by you to represent the server. The `HostName` specifies the actual address of the server, `User` sets the username for connecting, `Port` defines the SSH port number, and `IdentityFile` points to the private key file used for authentication. The `IdentitiesOnly yes` option restricts the client from using any other keys registered with ssh-agent, ensuring that the correct key is used for authentication.\n\nThe `IdentitiesOnly yes` directive is crucial because it prevents the OpenSSH client from offering the specified key along with other registered keys. This avoids potential authentication issues like temporary IP blockages due to repeated failed authentication attempts. If you maintain separate keys for different projects or use both personal and work-related keys, enabling `IdentitiesOnly yes` becomes mandatory.\n\nFor servers with similar setups, you can take advantage of wildcard patterns using the `Host pattern*` syntax. For example:\n\n```\nHost staging-*\nUser deploy\nIdentitiesOnly yes\nServerAliveInterval 30\n```\n\nHere, `staging-*` matches any servers with names starting with \"staging\". The `ServerAliveInterval` option sends a keepalive packet every 30 seconds, preventing idle connections from being dropped by routers or firewalls. This is particularly useful when running long backup jobs over SSH.\n\nAs your number of projects grows, maintaining a single `~/.ssh/config` file can become cumbersome. To tackle this, OpenSSH 7.3 and later support the `Include` directive, allowing you to split your config file into smaller, more manageable files. For instance:\n\n```\n# ~/.ssh/config\nInclude ~/.ssh/config.d/*.conf\nHost *\nIdentitiesOnly yes\n```\n\nIn this setup, each project or client gets its own configuration file under the `~/.ssh/config.d` directory. When a project ends, you only need to remove that individual file, leaving the rest of the configuration intact.\n\nWhile `~/.ssh/config` streamlines your SSH connections, it's important to remember that it stores server connection details in plain text. To maintain security, set the file's permissions to 600, granting read and write access only to your user account. Additionally, make sure not to accidentally commit the `~/.ssh/config` file into a Git repository, as it could expose internal connection details.",
  "summary": "If you maintain WordPress sites across more than a couple of servers, you've probably typed a command like ssh -i ~/.ssh/xxx_key.pem -p 2222 user@203.0.113.10 more times than you'd like. Remembering the right key path, port number, and username for each server isn't realistic, and copying a similar-looking command from shell history is exactly how you end up connecting to the wrong box.…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}