Is there a way for one SSH config file to include another one?

Question

In case it matters:

OS: Ubuntu 10.04
SSH: OpenSSH_5.3p1 Debian-3ubuntu5

I'd like one SSH config file to include another one. The use case would be to define whatever I want in my default .ssh/config file and then pre-pend a couple of extra things in a separate file (e.g. ~/.ssh/foo.config). I want the second file to incorporate the first one, though, so I don't have to duplicate everything in the first one. Is that doable? Thanks!

Same question on serverfault: http://serverfault.com/questions/375525/can-you-have-more-than-one-ssh-config-file — guettli, Oct 29 '14 at 17:56
For the people coming here for the server version (sshd) rather than the client one: Include directive will be available in upstream version 8.2 (coming in Debian 11 for example). https://bugzilla.mindrot.org/show_bug.cgi?id=2468 — Fanatique, Jul 20 '21 at 11:28

score 313 · Accepted Answer · edited Apr 05 '20 at 16:01

313

From 7.3p1 and up, there is the Include keyword, which allows you to include configuration files.

Include
Include the specified configuration file(s). Multiple pathnames may be specified and each pathname may contain glob(3) wildcards and, for user configurations, shell-like “~” references to user home directories. Files without absolute paths are assumed to be in ~/.ssh if included in a user configuration file or /etc/ssh if included from the system configuration file. Include directive may appear inside a Match or Host block to perform conditional inclusion.
^{Source: ssh_config(5).}

You should put the Include clause on top of the file.

For example you could have in ~/.ssh/config:

Include config.d/home

Host github.com
    HostName github.com
    User git

and in ~/.ssh/config.d/home:

Host laptop
    HostName laptop.lan

From the comments, use the below to include all files in the config.d directory:

Include config.d/*

edited Apr 05 '20 at 16:01

Kouber Saparev

113
4

answered Nov 05 '16 at 20:12

PMaynard

3,246
1
12
5

21

check version with $ ssh -V – Pieter Nov 13 '16 at 01:25
24

Use `Include config.d/*` to include all entries in `config.d`. – Simon Woodside Nov 17 '16 at 05:41
48

Ftr: this has to go in the top of the file and cannot just be appended to the list of `Host` entries. – dtk Feb 21 '17 at 16:47
2

tried on Ubuntu 16.04. Though, it works, but the **autocomplete is broken** which makes it less useful. If you want to upgrade ssh on ubuntu, check this link https://gist.github.com/stefansundin/0fd6e9de172041817d0b8a75f1ede677 – cwhsu Jan 06 '18 at 10:12
4

@dtk another workaround is to put the `Include` inside a `Host *` entry and avoid reordering the config – dfogni Jan 21 '20 at 10:11
@dfogni that does not work for me – SuperSandro2000 Aug 06 '20 at 07:09
Great, for client (ssh) only, not server (sshd) – Marki Dec 23 '20 at 13:23
3

He ain't lyin' about making sure to put it at the top. – Spencer Williams May 06 '21 at 22:38
1

On Ubuntu 22.04 `vim` editor by default recognizes ssh configs (and therefore provides syntax highlighting) for files: `*/.ssh/*.conf`. Thus instead of `Include config.d/*` it's recommended to use `Include ./*.conf`. Auto-completion also works – reddot Aug 23 '22 at 19:50

score 27 · Answer 2 · edited May 21 '12 at 07:03

27

No, to my knowledge this is not possible.

Here are the links to corresponding open feature requests / bug tickets:

https://bugzilla.mindrot.org/show_bug.cgi?id=1585

https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/739495

edited May 21 '12 at 07:03

jhilden

3
2

answered Feb 18 '11 at 17:54

rems

2,008
1
17
9

2

Also this bug on Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631189 – Lluís Jul 03 '14 at 11:50
14

OMG. It is hapening. From 2016-04-15 13:01:08 EST: `Slightly modified patch applied, this will be in openssh-7.3` – oschrenk Jun 18 '16 at 00:15
9

This answer was correct at the time, but is outdated now. – Mark Stosberg Dec 06 '18 at 21:40

estani · Answer 3 · 2022-08-05T08:45:41.333

27

If you want to start a ssh client, you could do this in bash:

#files are .ssh/config and ~/.ssh/foo.config
alias ssh='ssh -F <(cat .ssh/config ~/.ssh/foo.config)'

then you use ssh normally and it will have both files read in that order.

For the server daemon sshd you could do the same, just use -f instead of -F and write this down where you start the daemon directly. you don't need an alias.

A second possibility according to the man page is to put the system wide configuration in /etc/ssh/ssh_config and the user one in ~/.ssh/config.

Update Apparently there is a problem with some bash versions and how the devices are created. (see http://bugs.alpinelinux.org/issues/1465)

This is a workaround (though in my opinion ugly):

mkfifo /tmp/ssh_fifo
cat ~/.ssh/config ~/.ssh/foo.config >/tmp/ssh_fifo & 
ssh -F /tmp/ssh_fifo myserver
rm /tmp/ssh_fifo

so if you want, you may create a function out of it (or a script):

ssh() {
    tmp_fifo=$(mktemp -u --suffix=_ssh_fifo)
    mkfifo "$tmp_fifo" 
    cat ~/.ssh/config ~/.ssh/foo.config >"$tmp_fifo" 2>/dev/null & 
    /usr/bin/ssh -F "$tmp_fifo" "$@"
    rm "$tmp_fifo"
}

edited Aug 05 '22 at 08:45

answered Apr 19 '12 at 10:51

estani

806
1
8
12

1

Sadly this doesn't work on OSX's ssh: Can't open user config file /dev/fd/63: Bad file descriptor – Ash Berlin-Taylor Aug 23 '12 at 13:10
It does not work for me also on (Ubuntu 11.10) Linux giving the same error as @AshBerlin posted above. – Szymon Jeż Nov 27 '12 at 15:13
@AshBerlin you may try it too, this should work also for OSX, until the bug gets fixed – estani Nov 27 '12 at 19:32
Given ssh checks three places, 1. command line, 2. `~/.ssh/config`, 3. `/etc/ssh/ssh_config`, you shouldn't need to pass `~/.ssh/config` on the command line as well. Just `alias ssh='ssh -F ~/.ssh/foo.config'` and `~/.ssh/config` should get picked up after that. As long as you don't mind `foo.config` being loaded first that should be cleaner than the above workaround. – jim Feb 05 '13 at 03:27
1

@jim no it doesn't work like that. The first one found is used. Have you tried it? from the man page "-F configfile: Specifies an *alternative* per-user configuration file. If a configuration file is given on the command line, the system-wide configuration file (/etc/ssh/ssh_config) will be ignored." – estani Feb 06 '13 at 10:52
Oh. That's disappointing. I was going off the man page for `ssh_config`: `ssh(1) obtains configuration data from the following sources in the following order: 1. command-line options 2. user's configuration file (~/.ssh/config) 3. system-wide configuration file (/etc/ssh/ssh_config)` – jim Feb 08 '13 at 00:50
@jim Indeed... I read that man page again and the first line after that reads: "For each parameter, the first obtained value will be used." Exactly the opposite as what I've seen... have you tried it? It looks as if that was changed with some version and the ssh_config wasn't updated (or the help was written before the code :-) – estani Feb 08 '13 at 09:25
@estani: no, I haven't tried it. So you're probably right. – jim Feb 09 '13 at 20:24

Christian Hudon · Answer 4 · 2016-09-06T14:32:15.367

Starting with ssh 7.3 (released on August 1st, 2016), an Include directive is available.

Include: Include the specified configuration file(s). Multiple path names may be specified and each pathname may contain glob wildcards and shell-like "~" references to user home directories. Files without absolute paths are assumed to be in ~/.ssh. An Include directive may appear inside a Match or Host block to perform conditional inclusion.

(Here is the link to the resolved bug report, that also includes tha patch: https://bugzilla.mindrot.org/show_bug.cgi?id=1585#c24)

score 14 · Answer 5 · answered Feb 21 '13 at 09:02

14

Similarly to the other 'ugly' here's mine one-liner:

alias ssh="cat ~/.ssh/config.d/* > ~/.ssh/config; ssh"

answered Feb 21 '13 at 09:02

Aleksandr Makov

263
4
8

Note that `sftp` command will not trigger config recalculation. – VasyaNovikov Mar 13 '15 at 22:44
2

(I still like the answer because it uses "config.d/" and is very simple.) – VasyaNovikov Mar 13 '15 at 22:49
2

simple, elegant, yet hacky – code_monk May 29 '16 at 14:31
beware: will overwrite any existing ~/.ssh/config file – mhansen Feb 23 '20 at 06:47

score 7 · Answer 6 · answered Nov 20 '12 at 19:26

Well, I kinda cheat to do this. In my bash .profile-ish files I have a block that replaces various pieces of my home directory on login, so I just generate a new one each time. Example:

rm ~/.ssh/config
cat ~/conf/myservers.sshconfig >> ~/.ssh/config

[ -f ~/conf/workservers.sshconfig ] && cat ~/conf/workservers.sshconfig >> ~/.ssh/config
(or something like this:)
for i in `ls ~/conf/sshconfigs` ; do
    cat $i >> ~/.ssh/config
done

chmod 600 ~/.ssh/config

This also lets me do things like add config blocks to the ssh config file only if i'm on host A or B, but not on my home systems.

Now I know, someone will gripe that if you log in a lot this could cause excessive slowdown, but in practice I've never actually noticed it. And I'm sure you could put this in a script and fire it via cron too.

Szymon Jeż · Answer 7 · 2012-11-28T10:10:00.187

I personally use those commands to compile the ssh config:

alias compile-ssh-config='echo -n > ~/.ssh/config && cat ~/.ssh/*.config > ~/.ssh/config'
alias ssh='compile-ssh-config && ssh'
# (This will get used by other programs depending on the ~/.ssh/config)
# (If you need you can run the compile-ssh-config command via cron etc.)

or:

alias compile-ssh-config='echo -n > ~/.ssh/config-compilation && cat ~/.ssh/*.config > ~/.ssh/config-compilation'
alias ssh='compile-ssh-config && ssh -F ~/.ssh/config-compilation'
# (This is saver and won't over write an existing ~/.ssh/config file)

because:

alias ssh='ssh -F <(cat .ssh/*.config)'

does not work for me, returning:

ssh: Can't open user config file /dev/fd/63: Bad file descriptor

Hope this will be of any help.

You could go a step further and combine this with fswatch, for automated compilation on file change — cavalcade, Feb 28 '15 at 06:34

amontero · Answer 8 · 2013-07-07T13:12:29.797

3

Another, FUSE-based solution (not tested myself):

https://github.com/markhellewell/sshconfigfs

"Rather than having to continue managing one big file, [...] instead build a config "file" dynamically from many smaller logical chunks."

I've also found an article doing this via FIFOs: http://www.linuxsysadmintutorials.com/multiple-ssh-client-configuration-files/

edited Jul 07 '13 at 13:12

answered Jun 10 '13 at 17:54

amontero

31
2

1

I find the comment content to be descriptive enough - it says "FUSE" (Perhaps expanding the acronym would be better); The link is just to an implementation. – aviv Jun 23 '13 at 20:20
1

Wasn't aware of short answers problem, answer expanded. Looks like I will have to check back the site for my answers from time to time, in absence of email notifications :) Learnt to use favs, by now. Thanks for the comments. – amontero Jul 07 '13 at 14:17
Related: the answer by @Benjam who does it using a Makefile triggered by a shell alias. https://superuser.com/a/1349574/53308 – dolmen Jan 03 '23 at 15:58

score 2 · Answer 9 · answered May 19 '15 at 09:45

None of these alias solutions work for git or other programs other than ssh.

I've slapped together a quick-and-dirty, but you might want to improve on it.

Add this to your ~/.bashrc

mkdir -p ~/.ssh/config.d/
[ -e ~/.ssh/config ] && mv ~/.ssh/config ~/.ssh/config.bak.$(date -Ins)
cat ~/.ssh/config.d/* > ~/.ssh/config

Each time you start a session, it'll merge together all the files in ~/.ssh/config.d. (line 3)

The downside with this version is that if you change ~/.ssh/config next session you open your changes would be lost, so to prevent that I move the existing file to a .bak file. (line 2) The problem there is you're gonna have a whole lot of .bak files after a while.

Excellent with adding some `is_anything_changed` condition – vp_arth Jul 04 '15 at 04:57 — vp_arth, Jul 04 '15 at 04:57

panticz · Answer 10 · 2021-10-05T13:32:49.080

You can easily upgrade SSH version on Ubuntu to v7.3 (tested on Ubuntu Xenial 16.04) by installing packages from Yakkety:

echo "deb http://old-releases.ubuntu.com/ubuntu yakkety main" > /etc/apt/sources.list.d/yakkety.list
apt-get update
apt-get install -y ssh
rm /etc/apt/sources.list.d/yakkety.list
apt-get update

Check SSH version

ssh -V
OpenSSH_7.3p1 Ubuntu-1, OpenSSL 1.0.2g 1 Mar 2016

Configure SSH to use includes from ~/.ssh/config.d directory

mkdir ~/.ssh/config.d
sed -i '1iInclude config.d/*' ~/.ssh/config

score 1 · Answer 11 · answered Aug 16 '18 at 10:51

I cannot upgrade SSH on my machine neither.

I used GNU make to generate the ssh config file only when needed:

# Concatenates all the .config files.
aInput  = *.config
aOutput = ~/.ssh/config

aCurrentMakefile = $(lastword $(MAKEFILE_LIST))

$(aOutput): $(shell ls $(aInput)) $(aCurrentMakefile)
    @echo "Generating $(aOutput)"
    @echo "# File generated by $(aCurrentMakefile) on $(shell date +'%F %T.%6N')" > $(aOutput)
    @cat $(aInput) >> $(aOutput)

Then ssh is aliased to

alias ssh='make -s -f ~/Tools/config.d/makefile -C ~/Tools/config.d && ssh'

It works like a charm.

Good trick. However it might be faster to rebuild every time instead of triggering `make` which will trigger much more I/O. At least we now have `Include`. — dolmen, Jan 03 '23 at 15:55

score 0 · Answer 12 · answered May 06 '18 at 16:38

My dumb answer :

Tried to install OpenSSH > 7.3 on Xenial (16.04)
Didn't like the mess it made

So I settled for this :

Keep your separate OpenSSH config files in ~/.ssh/config.d/
When you change one, do cat ~/.ssh/config.d/* > ~/.ssh/config
On the glorious day you upgrade to a distro version that has OpenSSH 7.3p1 or newer, you can instead create a file that contains

Include config.d/*

Is there a way for one SSH config file to include another one?

12 Answers12

Linked