SSH Config Inspector

What it's for

Work out which settings ssh uses for a host when your ~/.ssh/config has grown long. ssh keeps the first value it finds for each option, reading the file from the top, so a Host * block near the top quietly wins over the specific blocks below it. That surprises people who expect later settings to override earlier ones.

For example, when ssh web-test keeps logging in as the wrong user, paste the config and type web-test to see which line the user name comes from.

How to use it

Paste the config and type a host as you’d type it after ssh; the box suggests the names in your Host lines. You get the settings ssh would use, each with its line and any later values that are ignored, then every block with whether it applies and why. HostName has %h filled in, and IdentityFile, LocalForward and the other options that collect every value list them all, in order. A port and user that aren’t set show ssh’s defaults.

Mistakes are listed whether or not you type a host: options ssh doesn’t know (which stop it with “Bad configuration option”), settings for every host placed before more specific ones, and risky choices such as agent forwarding for every host or StrictHostKeyChecking no.

Example

Press Try an example, with the host web-test. It connects to web-test.example.com as admin, not deploy: User admin on line 3, in the Host * block at the top, comes first, and a warning says so. Port 2222 comes from line 11, ProxyJump from the Match host *.example.com block (matched against the host name after HostName is applied), and both IdentityFile lines are used. StrictHostKeyChecking no is flagged as risky.

Good to know

Nothing is connected to or run, and no file is read: an Include is noted but its file isn’t read, so paste its contents in place of the line. Match conditions that depend on your computer or network (exec, localuser, localnetwork, address and so on), and canonical and final, can’t be checked, so those blocks are left out and marked. Host name canonicalisation and % tokens other than %h in HostName aren’t applied. On your own computer, ssh -G <host> prints the settings ssh will use without connecting.