# SSH Config Studio

Paste your \~/.ssh/config to see the settings for each Host and the values that actually apply when you connect to a host name you choose. The first value found wins, so a Host \* placed first hides later settings, and this tool flags that. It does not read Include files. To check how names resolve, use Hosts Studio.

- URL: https://tools.itlibra.com/en/ssh-config-studio
- On-device・No upload
- Last updated: 2026-10-26

## How to use

1. Paste the contents of your \~/.ssh/config. “Try a sample” loads an example with a bastion host and a misplaced Host \* line.
2. Enter a host name (for example web1) in “Host name”. The values that apply when you connect to that name are shown.
3. In “Findings”, check old algorithms, StrictHostKeyChecking no, ForwardAgent yes on wide Host patterns, and settings hidden by an earlier one, each with its line number.
4. In “Build”, enter the Host name, target, user, port, key path and ProxyJump to create a Host block. Copy it and add it to \~/.ssh/config.

## Use cases

- Check how to write a Host that goes through a bastion with ProxyJump
- Check whether a Host \* line placed before the others hides their settings
- Check whether an old algorithm such as ssh-rsa is still being used
- Get a Host block template for a new server

## What it does

### First value wins

For a host name you enter, the first matching value is used, as in ssh\_config(5). Keywords such as IdentityFile use every matching line.

### Host pattern matching

Supports \* and ? wildcards and ! exclusions (if any ! pattern matches, that line does not apply). Matching ignores letter case.

### Findings by line

Flags settings hidden after Host \*, StrictHostKeyChecking no, UserKnownHostsFile /dev/null, ForwardAgent yes on wide patterns, algorithms turned off by default in recent OpenSSH, and duplicate IdentityFile lines.

### Key paths only

IdentityFile shows the path. There is no field for key contents, and a key pasted into the input is not used in the calculation.

### Host block templates

Builds a Host block in ssh\_config format from a Host name, target, user, port, key path and ProxyJump.


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| Table per Host and Host \*, and the values that apply to a host name | Supported | — |
| Wildcard (\* ?) and ! exclusion matching | Supported | — |
| Line-numbered findings (hidden, risky, old algorithms, duplicates) | Supported | — |
| Host block templates (ProxyJump, port, key path) | Supported | — |
| Evaluating Match conditions | Not supported | Shown as text, but the condition is not evaluated and its values are not counted as applying |
| Include (reading other files) | Not supported | Files are not read; only a finding is shown |
| Running ssh, checking key validity or resolving names | Not supported | No network requests; ssh is not run |
| Checking the server-side sshd\_config | Not supported | Only the client-side \~/.ssh/config is checked |

## Limits & notes

- Input is limited to 200,000 characters and 5,000 lines. Anything beyond is not read, and you are told.
- Command-line options (for example ssh -o) are not part of the calculation. They can override the values shown here.
- Values inside Match blocks are shown as text only and are not counted as applying.
- Old algorithms are flagged only if they were turned off by default in OpenSSH 7.0 or 8.8 release notes.

## Privacy & safety

Pasted text is processed only inside your browser. Nothing is sent to or stored on a server, and nothing is saved in the browser. Usage analytics never include content.

## FAQ

### Which value is used when a keyword appears twice?

The first matching value is used. IdentityFile, CertificateFile, LocalForward, RemoteForward, DynamicForward and SendEnv are the exception: every matching line is used.

### Where should Host \* go?

After the specific Host blocks. Placed first, it sets the value for a keyword before the later specific blocks, and their setting for that keyword is ignored (ssh\_config(5)).

### How do I reach a server through a bastion with ProxyJump?

Add ProxyJump followed by the bastion’s Host name to the target’s Host block. The bastion needs its own Host block in the same file.

### Is StrictHostKeyChecking no safe?

No. It skips the check of the server’s key on first connection, so a man-in-the-middle attack is easier. Combined with UserKnownHostsFile /dev/null, the record is not kept either. Use it only for a temporary test.

### Why does ssh-rsa stop working?

OpenSSH 8.8 turned off RSA signatures that use SHA-1 (ssh-rsa) by default. Existing keys keep working with newer signature methods (such as rsa-sha2-256). Older servers may need +ssh-rsa in HostKeyAlgorithms or PubkeyAcceptedAlgorithms as a temporary workaround.