Configure Advanced SSH Client Settings for Optimal Performance and Security

Establishing a secure connection is often the first step in remote system administration, usually with a simple ssh user@host command. When you manage several servers, SSH client settings in ~/.ssh/config keep those connections stable, repeatable, and less error-prone.

You can use one file to define host aliases, identity files, keepalive behavior, ciphers, compression, and bastion routing without retyping long command lines.

Understanding the SSH Configuration File

The primary control center for client-side SSH behavior is the configuration file located at ~/.ssh/config. If this file does not exist, you can safely create it. This file allows you to define Host-specific settings, meaning you can have one configuration for your production server and a different one for your testing environment.

Configuration File Structure

Configurations are structured using directives applied globally (at the top) or specifically to a Host block. Settings within a Host block override global settings.

# Global settings applied to all connections unless overridden
Host *
    ServerAliveInterval 60

# Specific settings for a development server
Host devserver
    HostName 192.168.1.100
    User developer_user
    Port 2222
    IdentityFile ~/.ssh/id_rsa_dev

Optimizing Connection Persistence and Timeouts

Frequent disconnection, especially over unstable networks or VPNs, can severely hamper productivity. SSH clients use mechanisms to keep the connection alive.

KeepAlive Mechanisms

To prevent idle connections from timing out due to firewall or router inactivity settings, you can configure the client to send periodic "null packets."

ServerAliveInterval: Specifies a timeout in seconds after which the client sends a message to the server to keep the connection active if no data has been received. A value of 60 is common.
ServerAliveCountMax: Specifies the number of client re-tries without hearing from the server before giving up and disconnecting.

Example Configuration for Stability:

Host stable-server
    HostName production.example.com
    User sysadmin
    ServerAliveInterval 30
    ServerAliveCountMax 3

This configuration will send a null packet every 30 seconds. If it sends this packet 3 times without a response, the client will disconnect.

Connection Timeout

If a connection attempt hangs indefinitely when a server is down or unreachable, you can set a timeout for the initial connection phase:

ConnectTimeout: Defines the maximum time (in seconds) the SSH client will wait for a connection to be established before aborting the attempt.

Enhancing Security Through Client Hardening

While server configuration dictates much of the security posture, the client can enforce security preferences and streamline complex authentication.

Enforcing Key-Based Authentication

For critical servers, you should always enforce key-based authentication and disable password prompts. The PreferredAuthentications directive controls the order and type of authentication methods the client attempts.

To prioritize public key authentication:

Host critical-db
    HostName db.internal.net
    PreferredAuthentications publickey
    PubkeyAuthentication yes
    PasswordAuthentication no

Specifying Identity Files

If you use multiple key pairs (one for work, one for personal projects, etc.), you can map specific keys to specific hosts using IdentityFile.

Host gitlab.work.com
    IdentityFile ~/.ssh/id_rsa_gitlab_work

Host github.com
    IdentityFile ~/.ssh/id_rsa_personal

Security Best Practice: Ensure your private keys have restrictive permissions (e.g., chmod 600 ~/.ssh/id_rsa).

Optimizing Performance: Ciphers and Compression

SSH performance can be affected by the cryptographic algorithms used for encryption and the overhead of data compression.

Cipher Selection

Modern SSH clients support a wide array of ciphers. You can specify a preferred list using Ciphers to ensure you use strong, fast algorithms supported by both client and server, or to enforce older standards if legacy hardware requires it.

Modern, preferred ciphers often include AES-GCM implementations.

Host fast-connection
    HostName remote.fastlane.io
    Ciphers [email protected],[email protected],[email protected]

Compression

Data compression (Compression) can speed up sessions over very slow links, but it adds CPU overhead to both ends. It is generally disabled on fast networks.

Compression no: (Default) No compression.
Compression yes: Enables compression using the ZLIB algorithm.

Host slow-wan-link
    Compression yes

Streamlining Connections with Aliases and ProxyJumps

One of the most powerful features of ~/.ssh/config is simplifying complex connection paths, such as jumping through a bastion host (a "jumpbox").

Host Aliases

Instead of typing the full server name and user every time, you can create a simple alias:

Host web
    HostName 172.16.0.50
    User alice

You can now connect simply using: ssh web.

ProxyJump for Bastion Hosts

The ProxyJump directive (or its older equivalent, ProxyCommand) allows the client to automatically tunnel through an intermediate server before reaching the final destination. This avoids needing separate ssh calls or nc (netcat) configurations.

To connect to database via the jumpbox:

Host jumpbox
    HostName 203.0.113.5
    User bastion_user

Host database
    HostName 10.0.0.5
    User db_user
    ProxyJump jumpbox

Now, the command ssh database automatically connects to jumpbox first, and then forwards the session to the database server.

Takeaway

The ~/.ssh/config file is where you turn repeated SSH commands into clear, named profiles. Start with aliases, User, HostName, IdentityFile, and ServerAliveInterval; then add ProxyJump, cipher preferences, or compression only where your environment needs them. Before enforcing a strict option globally, test it against your older hosts so you do not lock yourself out of a server that supports a narrower SSH feature set.