`ssh-config` Name your hosts and choose which key each one uses

The file ~/.ssh/config holds per-host settings for ssh. Give each router, NAS or service a short name, set its user, address and key once, and then connect with just ssh name. This is also where the macOS Keychain settings go.

Synopsis

~/.ssh/config

Common options

Option or form	What it does
`Host NAME`	Starts a block. Settings below it apply when you run ssh NAME. Use Host * for settings that apply to everything
`HostName ADDRESS`	The real address or domain to connect to, such as 192.168.1.1
`User NAME`	The login name on that machine
`Port NUMBER`	The port, if it is not the default 22. Many NAS devices use a different one
`IdentityFile PATH`	The private key to use for this host
`IdentitiesOnly yes`	Offer only the key named here, not every key in the agent. Stops "too many authentication failures"
`AddKeysToAgent yes`	Load a key into the agent the first time it is used
`UseKeychain yes`	Read and save the passphrase in the macOS Keychain. This line is macOS only

Examples

Keychain settings for every host

Host *
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519

A router you can then reach with ssh router

Host router
  HostName 192.168.1.1
  User admin
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes

A NAS on a custom port with its own key

Host nas
  HostName nas.local
  User bob
  Port 2222
  IdentityFile ~/.ssh/id_rsa_nas
  IdentitiesOnly yes

GitHub with a dedicated key

Host github.com
  User git
  IdentityFile ~/.ssh/id_ed25519_github
  IdentitiesOnly yes

Create the file with safe permissions

touch ~/.ssh/config && chmod 600 ~/.ssh/config

Notes

Create the file if it does not exist. Use any text editor, for example nano ~/.ssh/config.
ssh uses the first value it finds for each setting, reading from the top. Put specific Host blocks above Host *.
Indent the lines under each Host. The indent is optional for ssh but keeps the file readable.
The file must not be writable by others. If ssh complains about "Bad owner or permissions", run chmod 600 ~/.ssh/config.
Without UseKeychain yes, macOS may ask for the passphrase again after a restart even if you ran ssh-add.

ssh-config Name your hosts and choose which key each one uses

Synopsis

Common options

Examples

Notes

See also

`ssh-config` Name your hosts and choose which key each one uses