עב
עב

SSH config generator and key helper

Describe each server once, then connect with ssh and a short name: the right user, port and key, a jump through a bastion, and SSH tunnels to services that listen only on the server. Make the key with ssh-keygen on your computer, or, if you choose, in this browser. Nothing leaves this page.

Servers
Server 1
The short name you type after ssh, for example app.
The server's public address, or its private one when you jump through a bastion.
The account you log in as, for example deploy. Empty: your local user name.
Your private key on this computer. ssh then offers only this key (IdentitiesOnly).
Another alias, or user@host:port. For several hops, separate them with commas.
Written as a comment above the block.
A message every 60 seconds inside the encrypted channel keeps idle sessions open through NAT and firewalls; ssh gives up after 3 go unanswered.
SSH tunnels (LocalForward)

Reach a service that listens only on the server, such as an app the Compose Generator published on 127.0.0.1 in local mode: while ssh -N <alias> runs, open http://localhost:<local port>.

The key

Make the key on your own computer with ssh-keygen: the private key then never exists anywhere else, and ssh-keygen asks for a passphrase that protects it. Ed25519 keys are short, fast and supported by every current OpenSSH.

Where ssh-keygen writes the private key; the public key gets .pub next to it.
Goes into the public key so you can tell keys apart in authorized_keys, for example you@laptop.
make-ssh-key.sh
ssh-keygen -t ed25519 -a 100 -f ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_ed25519
  1. Run the commands in a terminal on your computer (macOS, Linux, or Windows with OpenSSH). ssh-keygen asks for a passphrase: set one.
  2. ssh-copy-id adds ~/.ssh/id_ed25519.pub to ~/.ssh/authorized_keys on the first server above, using the password or access you have now. Without it, paste the .pub line there yourself, or give it to the cloud-init Generator.
  3. The private key ~/.ssh/id_ed25519 stays on your computer. Do not send it or paste it anywhere.

Or make the key in this browser (optional)

For when ssh-keygen is not at hand. Your browser's WebCrypto makes the key on this device: it is not sent anywhere, not saved, not put in the link and not measured.

What it does

It writes Host blocks for the SSH configuration file on your computer, so that ssh and a short name connect with the right address, user, port and key, through a bastion when needed, with keep-alives, and with SSH tunnels to services that are not open to the internet. It also gives the ssh-keygen command for an Ed25519 key and, only if you ask, makes the key in this browser.

How it works

  1. Each server becomes one Host block, written by the same engine as our other Linux tools. Values are checked for form: an alias with a space or a wildcard, a host name that is not one, or a key path with .. is refused, so a field cannot add options of its own.
  2. Our tests read every sample file back with ssh -G and compare each option, and load keys made by this page's own code with ssh-keygen -y.
  3. Nothing is sent anywhere, and nothing is kept in the link or in browser storage.

What each option does

HostName
The real address. The alias is only a name on your computer.
IdentityFile and IdentitiesOnly
The private key to offer. IdentitiesOnly stops ssh from trying every key in your agent first, which ends in 'Too many authentication failures' on servers with a low MaxAuthTries.
ProxyJump
Reaches the server through another one (a bastion), encrypted end to end: the bastion never sees your key. Needs OpenSSH 7.3 or newer.
LocalForward
While the connection is open, a port on your computer (on localhost only) leads to an address and port as the server sees them.
ServerAliveInterval and ServerAliveCountMax
A message every 60 seconds inside the encrypted channel keeps idle sessions open through NAT, and ssh disconnects after 3 unanswered ones instead of hanging.

Example

A bastion at 203.0.113.10 and an app server at 10.0.0.5 behind it, with a tunnel to n8n on port 5678:

~/.ssh/config
config
# SSH client configuration (ssh_config(5)). ssh keeps the first value it finds for each
# option, so put these blocks above any "Host *" block. Keep this file mode 0600.
# Generated by @anaroq/linux 1.0.0 (ANAROQ). Check with: ssh -G <alias>

# Bastion
Host bastion
  HostName 203.0.113.10
  User deploy
  Port 22
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes
  ServerAliveInterval 60
  ServerAliveCountMax 3

# App server, through the bastion
Host app
  HostName 10.0.0.5
  User deploy
  Port 22
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes
  ProxyJump bastion
  LocalForward 5678 127.0.0.1:5678
  ServerAliveInterval 60
  ServerAliveCountMax 3
The key, made on your computer and installed on the bastion:
make-ssh-key.sh
ssh-keygen -t ed25519 -a 100 -f ~/.ssh/id_ed25519 -C you@laptop
ssh-copy-id -i ~/.ssh/id_ed25519.pub [email protected]

Limits

  • Client configuration only: it does not change the server or its sshd settings.
  • Ed25519 only. RSA keys are not made in the browser; if an old server needs RSA, use ssh-keygen -t rsa -b 4096.
  • A key made in the browser has no passphrase until you add one with ssh-keygen -p.
  • Host patterns (* and ?), Match blocks and options other than those above are not written; add them by hand below these blocks.
  • It cannot check that a server is reachable or that its host key is the one you expect: compare the fingerprint the first time you connect.

Methodology: how the numbers are worked out

Sources

  1. OpenSSH manual: ssh_config(5)
  2. OpenSSH manual: ssh-keygen(1)
  3. OpenSSH 7.3 release notes (ProxyJump)
  4. OpenSSH: PROTOCOL.key, the private key format
  5. RFC 8709: Ed25519 public key algorithms for SSH
  6. MDN: SubtleCrypto.generateKey() (Ed25519)

Updated

Next step

cloud-init Generator for Ubuntu 24.04

A free public tool by ANAROQ, a company building compute infrastructure. What ANAROQ is building