OpenSSH Config Pitfall: Why Host * Blocks Should Come Last, Not First
A developer discovered a common SSH configuration mistake while preparing a guide on setting up SSH keys and server hardening. In OpenSSH's client config, the first matching value for any parameter wins, meaning a broad 'Host *' block placed at the top can silently override settings in more specific host blocks below it. This behavior differs from CSS, where later rules take precedence, and can cause incorrect users, ports, or identities to be applied without any visible error. The command 'ssh -G <alias>' reveals the effective configuration OpenSSH will actually use, helping catch such mismatches before they cause problems. The recommended fix is to place specific host blocks before the broad 'Host *' defaults in any SSH config file.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in