Linux Security Cookbook [Electronic resources]

Recipe 6.13 Changing SSH Client Defaults

6.13.1 Problem

You want to change the default behavior of ssh.

6.13.2 Solution

Create a host alias named "*" in ~/.ssh/config:

Host *
        keyword value
        keyword value
        ...

If this is the

first entry in the file, these values will override all others. If the

last entry in the file, they are fallback values, i.e., defaults if nobody else has set them. You can make Host * both the first and last entry to achieve both behaviors.

6.13.3 Discussion

We are just taking advantage of a few facts about host aliases in the configuration file:

• Earlier values take precedence

• The aliases may be patterns, and "*" matches anything

• All matching aliases apply, not just the first one to match your ssh command

So if this is your ~/.ssh/config file:

Host *
User smith
Host server.example.com
User jones
PasswordAuthentication yes
Host *
PasswordAuthentication no

then your remote username will always be smith (even for

server.example.com !), and password authentication will be disabled by default (except for

server.example.com ).

You can still override host aliases using command-line options:

$ ssh -l jane server.example.com         The -l option overrides the User keyword

6.13.4 See Also

ssh_config(5) documents the client configuration keywords.