Query effective ssh (client) config from the command line

Understanding the ssh -G Flag

The -G option stands for "show parsed config." Unlike -v (verbose) which logs activity during a connection attempt, -G simply parses the configuration files and prints the resulting state. This is particularly useful when debugging why an SSH connection behaves unexpectedly, such as failing key authentication or using the wrong port.

When you run this command, SSH reads the configuration hierarchy in the following order:

• System-wide configuration: Located at /etc/ssh/ssh_config. These settings apply to all users on the machine unless overridden.
• User-specific configuration: Located at ~/.ssh/config. Settings here override system-wide defaults for the current user.
• Command-line options: Any flags passed directly in the terminal take precedence over both file-based configurations.

By running ssh -G example.com, you see the merged result of these layers. This prevents confusion caused by subtle differences between what you think is configured and what is actually active.

Distinguishing Between Client and Server Configs

It is crucial to note that this method queries the client configuration. If you are trying to debug issues related to how the remote server accepts connections, you must look at /etc/ssh/sshd_config on the remote machine. The -G flag only reflects what your local SSH client intends to send. For more advanced scripting needs involving automation, you might also want to check resources like Troubleshooting SSH Nohup Command Not Working as Expected to understand how background processes interact with these settings.

Interpreting the Output

The output of ssh -G is a list of key-value pairs. Each line represents a configuration directive followed by its resolved value. Understanding this format allows you to quickly spot discrepancies.

For example, a typical output snippet might look like this:

user user@hostname
hostname example.com
port 22
addressfamily any
connecttimeout none
batchmode no
compression no
casignaturealgorithms default
hostbasedauthentication no
ignorerhosts yes
...
identityfile ~/.ssh/id_rsa
pubkeyauthentication yes

Key things to look for include:

• IdentityFile: Ensures the correct private key is being offered. A common error is specifying a key path that doesn't exist or has wrong permissions.
• User: Verifies the username being sent. If you have multiple aliases for the same host with different users, this confirms which one applies.
• Port: Confirms the network port. This is vital if you are connecting through non-standard ports or jump hosts.
• ProxyJump: Shows if traffic is being routed through an intermediate host, which can complicate network troubleshooting.

Advanced Querying Techniques

While ssh -G shows everything, sometimes you only need specific values. You can combine it with standard Unix tools like grep to filter results efficiently.

Filtering Specific Parameters

To find just the identity file being used for a host, pipe the output to grep:

ssh -G example.com | grep identityfile

This returns lines containing "identityfile" along with their resolved paths. If you want to extract only the value (removing the key name), you can use awk:

ssh -G example.com | awk '/^identityfile/ {print $2}'

This technique is highly effective for shell scripts where you need to programmatically verify configuration states before executing commands. For developers writing complex automation logic, understanding how to parse these outputs is similar to other script manipulation tasks discussed in How to convert code from test format to if fi format?, where precise control flow depends on accurate data retrieval.

Testing Host Aliases

If you use aliases in your ~/.ssh/config, ensure you query them correctly. For instance, if you have an alias defined as:

Host myserver
    HostName 192.168.1.100
    User admin

You should run ssh -G myserver to see the resolved values. Running ssh -G 192.168.1.100 might yield different results if there are no specific rules matching the IP address directly, potentially falling back to global defaults instead of your alias-specific settings.

Common Pitfalls and Debugging

Even with ssh -G, issues can arise due to syntax errors in configuration files. If the command fails or produces unexpected results, consider the following:

• Syntax Errors: SSH config files are sensitive to indentation and spelling. A typo in a directive name may cause SSH to ignore it silently. Use ssh -G to verify if your intended directives appear in the output.
• Include Directives: Modern OpenSSH versions support the Include directive to split configs into multiple files. Ensure that included files are readable and correctly referenced relative to the main config location.
• Permissions: While sshd_config requires strict permissions (600 for keys), ssh_config is less restrictive but still best kept secure. Incorrect permissions on ~/.ssh/config generally do not prevent parsing but can trigger warnings.

For environments where GUI tools are unavailable, mastering these command-line diagnostics is essential. As noted in guides on Displaying a Browser-Based Interface on a GUI-Less Computer, relying on robust CLI tools ensures consistency across headless servers and local development machines alike.

Frequently Asked Questions

Does ssh -G connect to the server?

No, the -G flag does not establish a network connection. It only parses local configuration files and prints the resolved settings to stdout. This makes it safe to use for auditing purposes without triggering any actions on the remote host.

Why is my IdentityFile not showing up in the output?

If your specified key does not appear in the ssh -G output, it means either the Host block defining it is not matching the target hostname, or there is a syntax error preventing that section from being parsed. Check your Host aliases and ensure the filename matches exactly.

Can I use ssh -G to check server-side settings?

No, ssh -G only reflects the client-side configuration. To check server settings, you must access the remote machine and view /etc/ssh/sshd_config. Client and server configurations are entirely separate systems.

What happens if I omit the hostname?

Running ssh -G without a hostname will typically result in an error or prompt for input because SSH needs a target to resolve against. Configuration directives often depend on Host patterns that match specific names or IPs, so a target is required for meaningful resolution.

How do I handle wildcard hosts in ssh -G?

Wildcard hosts (e.g., Host *.example.com) work seamlessly with ssh -G. When you query a specific subdomain like ssh -G dev.example.com, SSH evaluates all matching patterns and applies the last matching rule according to priority, displaying the final merged result.