Linux Security Cookbook

6.13. Changing SSH Client Defaults

Problem

You want to change the default behavior of ssh.

Solution

Create a host alias named “*” in ~/.ssh/config:

Host *
        keyword value
                       keyword value
                       ...

If this is the first entry in the file, these values will override all others. If the last entry in the file, they are fallback values, i.e., defaults if nobody else has set them. You can make Host * both the first and last entry to achieve both behaviors.

Discussion

We are just taking advantage of a few facts about host aliases in the configuration file:

• Earlier values take precedence

• The aliases may be patterns, and “*” matches anything

• All matching aliases apply, not just the first one to match your ssh command

So if this is your ~/.ssh/config file:

Host *
        User smith
Host server.example.com
        User jones
        PasswordAuthentication yes
Host *
        PasswordAuthentication no

then your remote username will always be smith (even for server.example.com!), and password authentication will be disabled by default (except for server.example.com).

You can still override host aliases using command-line options:

$ ssh -l jane server.example.com         The -l option overrides the User keyword

See Also

ssh_config(5) documents the client configuration keywords.