🔐 SSH Config Generator

⚙️ Generate

Choose which configuration file(s) to generate. "Both" emits client and server side-by-side.

🎯 Preset

Repopulates the form below with a curated configuration.

👤 Client hosts (~/.ssh/config)

No client hosts yet — click "Add host" to create one.

{{ host.alias || 'unnamed' }}

IdentitiesOnly ForwardAgent (risky)

LocalForward (one per line, "localPort remoteHost:remotePort") RemoteForward (one per line)

🖥️ Server settings (sshd_config)

Port

ListenAddress (one per line)

PermitRootLogin

PasswordAuthentication

PubkeyAuthentication

AllowUsers (space or newline separated)

AllowGroups (preferred for multi-user)

DenyUsers

AllowAgentFwd

AllowTcpFwd

X11Forwarding

ClientAliveInterval (s)

ClientAliveCountMax

MaxAuthTries

MaxSessions

Ciphers (comma-separated)

KexAlgorithms

MACs

HostKeyAlgorithms

📤 Client ~/.ssh/config

{{ clientConfig || '# Choose a preset or add a host on the left to populate this file.' }}

📤 Server /etc/ssh/sshd_config

{{ serverConfig || '# Fill in any server setting on the left to populate this file.' }}

⚠️ Security warnings

{{ w }}

📂 Directives in use

{{ e.directive }} — {{ e.meaning }}

⚠️

ℹ️ About SSH Config Generator

SSH client and server configuration

OpenSSH reads two configuration files: ~/.ssh/config on the client side, and /etc/ssh/sshd_config on the server side. The client file lets you save host aliases, assign per-host keys, define jump-host (bastion) chains, configure port forwarding, and enable connection multiplexing so repeated ssh invocations share a single TCP socket. The server file controls authentication policy, listen addresses, allowed users / groups, idle-session timeouts, and the cipher / KEX / MAC algorithm catalogue offered to clients.

This generator builds both files from a form. It surfaces inline warnings whenever the requested configuration violates the Mozilla OpenSSH guidelines (e.g. PermitRootLogin yes, PasswordAuthentication yes, weak ciphers like 3des-cbc / arcfour, or MaxAuthTries high enough to enable brute-force).

Client (~/.ssh/config) directives

Host alias — short name you type after ssh (e.g. ssh prod).
HostName — real DNS name or IP the alias maps to.
User / Port — username and TCP port. Saves typing ssh user@host -p PORT.
IdentityFile / IdentitiesOnly — specific private key path; IdentitiesOnly yes stops ssh from also trying every key in ssh-agent (which causes MaxAuthTries exhaustion on busy agents).
ProxyJump — connect through a bastion host. RFC-style syntax accepts a chain (jump1,jump2,jump3) and inherits each hop's Host block.
ForwardAgent — relay ssh-agent to the remote shell. Powerful but dangerous — a compromised remote shell can hijack your local agent and impersonate you on downstream hosts.
LocalForward / RemoteForward — set up -L / -R tunnels in the file so they activate every time you connect.
StrictHostKeyChecking — accept-new (record new keys on first use, reject changes) is the modern best practice; no disables MITM protection entirely.
ControlMaster / ControlPath / ControlPersist — multiplex multiple sessions over one TCP connection (massive speed-up for tools that re-open sessions like git/rsync).

Server (sshd_config) directives

Port / ListenAddress — TCP port and bind addresses. Moving off 22 cuts noise from opportunistic scanners; ListenAddress can restrict sshd to a VPN interface.
PermitRootLogin — root login policy. no (recommended), prohibit-password (key-only root), without-password (legacy alias), forced-commands-only, or yes (avoid).
PasswordAuthentication / PubkeyAuthentication — auth methods. Hardened policy is PasswordAuthentication no + PubkeyAuthentication yes.
AllowUsers / AllowGroups / DenyUsers — narrow the set of accounts allowed to log in. AllowGroups ssh-users is the operational sweet spot — manage membership with normal UNIX group tooling.
AllowAgentForwarding / AllowTcpForwarding / X11Forwarding — disable on public-facing servers; keep AllowTcpForwarding yes on bastions so ProxyJump still works.
ClientAliveInterval / ClientAliveCountMax — server-driven keepalives. A common hardened pair is 300 and 2 — disconnect idle clients after 10 min.
MaxAuthTries / MaxSessions — limit auth attempts per connection (Mozilla / CIS recommend 3) and concurrent multiplexed sessions per connection.
Ciphers / KexAlgorithms / MACs / HostKeyAlgorithms — symmetric, key-exchange, MAC, and host-key catalogues. Pin to Mozilla Modern defaults to refuse weak / legacy algorithms.

Security warnings this tool surfaces

PermitRootLogin yes — direct root over ssh is a Mozilla / CIS Level 1 violation. Use without-password or no and elevate via sudo.
PasswordAuthentication yes — passwords are brute-forceable; enrol a key and disable passwords.
Default Port 22 — attracts opportunistic scanners. Move off 22 and combine with fail2ban / sshguard.
Weak ciphers — 3des-cbc, arcfour*, and CBC modes are insecure (broken or padding-oracle vulnerable). Restrict to AEAD ciphers [email protected] and aes*[email protected].
Weak KEX — SHA-1 KEX (diffie-hellman-group1-sha1, diffie-hellman-group14-sha1) is deprecated; prefer curve25519-sha256 and diffie-hellman-group16-sha512.
Weak MACs — hmac-md5, hmac-sha1 are deprecated; prefer Encrypt-then-MAC variants ([email protected]).
MaxAuthTries ≥ 6 — too many attempts per connection makes brute-force easier. Lower to 3.
StrictHostKeyChecking no — disables MITM protection. Use accept-new.
ForwardAgent yes — a compromised remote shell can impersonate you on downstream hosts via your local agent socket.

ProxyJump and bastion hosts

A bastion (jump host) is an SSH server that brokers connections to an internal network you cannot reach directly. ProxyJump (introduced in OpenSSH 7.3) is the modern way to chain through a bastion:

Host bastion
    HostName bastion.example.com
    User jumpuser
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Host db-prod
    HostName 10.0.1.10
    User dbadmin
    ProxyJump bastion
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes
    LocalForward 5432 localhost:5432

ssh db-prod opens a connection through bastion.example.com to 10.0.1.10 with the PostgreSQL port tunnelled to your laptop. The bastion host's sshd_config typically keeps AllowTcpForwarding yes but disables shells in user accounts.

Source references

OpenSSH ssh_config(5) — canonical client configuration reference.
OpenSSH sshd_config(5) — canonical server configuration reference.
Mozilla OpenSSH security guidelines — Modern, Intermediate, Legacy cipher / KEX / MAC catalogues plus host hardening checklist.
OpenSSH release notes — track when defaults change (e.g. ssh-rsa removed in 8.8, scp legacy protocol off by default in 9.0).

API Usage Example:

POST /api/tools/linux/ssh-config-generator
Content-Type: application/json

{
    "operation": "generate",
    "input": {
        "mode": "server",
        "serverSettings": {
            "port": 2222,
            "permitRootLogin": "no",
            "passwordAuthentication": false,
            "pubkeyAuthentication": true
        }
    }
}