{{ summaryTitle }}
{{ summaryValue }}

{{ summaryLine }}

{{ badge.label }} {{ badge.value }}
One host per line. Blank optional cells inherit the defaults below; quoted CSV cells are supported.
Replace every example hostname, alias, and key path before use.
Keep the login explicit so aliases behave consistently across workstations.
Whole TCP port from 1 through 65535.
OpenSSH paths may use a tilde and tokens such as %h and %r.
Limits authentication to configured identities instead of trying every key offered by ssh-agent.
{{ identities_only ? 'Enabled' : 'Disabled' }}
Adds an alias-to-destination comment above each generated block.
{{ include_comments ? 'Enabled' : 'Disabled' }}
Omit preserves client defaults. no weakens host-key checking and is flagged for review.
Omit preserves the client default; ask and confirm keep key use visible.
Use yes only for trusted hosts that genuinely need agent access.
sec
The neutral value 0 omits keepalives.
Whole count from 1 through 20.
Omit leaves connection sharing untouched.
The default keeps an idle master available for 10 minutes.
Keep the socket in a directory that other users cannot write to.
{{ computation.values.config_text }}

The chart renderer is unavailable. The same coverage values remain available in the summary and host review.

HostDestinationRouteIdentityReviewCopy
{{ row.host }}{{ row.destination }}{{ row.route }}{{ row.identity }}{{ row.status }}{{ row.detail }}
Secure Shell (SSH) Key Fingerprint Checker Check an SSH public key locally, compare modern or legacy fingerprints, and review host-key identity warnings before trusting the key.
Interface Description Standard Checker Check network interface descriptions for endpoint evidence and policy gaps, then prioritize duplicates or length issues before cleanup and change review.
Terraform Variable Defaults Checker Review Terraform variable blocks for unsafe defaults and secret-like values, then prioritize type mismatches, version conflicts and fixes.
Hostname Naming Standard Checker Audit hostname inventories against RFC and Kubernetes syntax, organization regex rules and duplicate policy with browser-local evidence.

A saved SSH alias turns a memorable name such as app-prod into a complete connection choice. The alias can point to the real host, select the login account and private key, set a non-default port, or route the connection through a jump host. This keeps repeated commands short and makes the intended route visible before a connection starts.

OpenSSH combines command-line options, the user's SSH configuration, and system-wide configuration. For most options, the first value found wins. Host-specific blocks therefore belong before broad patterns such as Host *; otherwise an earlier general value may prevent a later block from changing the setting.

Host alias
The name typed after ssh. It does not need to match a DNS name.
Destination
The real host name or address, login user, and TCP port used for the final connection.
Identity
The private-key file offered for authentication. IdentitiesOnly yes limits extra keys offered by an agent.
Jump route
One or more intermediate SSH hosts named by ProxyJump before the client reaches the destination.

Convenient settings can also widen trust. StrictHostKeyChecking no weakens host-key verification, while ForwardAgent yes exposes the local agent to use through the remote host. Connection sharing reduces repeated handshakes, but its control socket must identify the host, port, and user so unrelated sessions do not collide.

A generated block is a draft, not proof that the destination exists, that a key matches the remote account, or that a jump host permits forwarding. Review the text in the context of existing SSH configuration, inspect the effective settings, and make a real test connection before relying on the alias.

How to Use This Tool:

Start with the inventory rows, then add only the shared policy settings that every generated host should receive.

  1. Enter one host per line in the order alias, hostname, user, port, proxyjump, identityfile, hostkeyalias. A header row is accepted, as are comments beginning with # and quoted CSV cells.
  2. Set Default user, Default port, and Default identity file for blank cells. Put - in an identity-file cell when that host should not inherit the default.
  3. Choose host-key, agent, keepalive, and connection-sharing policies only when they belong on every block. Selecting ControlMaster requires a ControlPath.
  4. Read Host review before copying the configuration. Resolve duplicate aliases, undefined jump references, missing identities, and security warnings, then test each alias with ssh -G alias and a real connection.

Interpreting Results:

Ready means a host row has no local review flag. Review identifies a condition worth checking, such as an external jump alias or agent fallback; it does not mean OpenSSH has rejected the block. The warning count may also include batch-wide cautions that apply to every generated host.

Check the final configuration text as well as the review row. Then use ssh -G alias to see the values OpenSSH resolves after reading the rest of the user's configuration. A successful parse still does not verify DNS, routing, credentials, server host keys, or remote authorization.

Technical Details:

An SSH Host block is an ordered set of client directives. The alias selects the block; HostName, User, Port, and related directives supply connection values. Because OpenSSH commonly keeps the first obtained value, block placement remains part of the effective rule set.

Transformation Core

Each usable CSV row passes through the same deterministic path before it becomes a block.

StageExact behavior
ReadIgnore blank lines, comment lines, and an optional alias, hostname header. Parse seven CSV cells and honor doubled quotes inside quoted cells.
InheritBlank user, port, and identity cells use their defaults. A dash suppresses an inherited identity; a dash or none suppresses ProxyJump.
ValidateRequire aliases and host names without whitespace, ports from 1 through 65,535, and no more than 100 usable hosts.
SerializeEmit one block per valid row. Values containing spaces, quotation marks, or # are quoted and escaped.
ReviewCompare aliases, jump references, identities, and selected policies to produce per-host status and batch warnings.

Rule Core

Core connection lines are always emitted, while optional policy lines appear only when their controlling value is active. The following rules carry the main safety and interpretation burden.

ChoiceEmission ruleReview meaning
IdentitiesOnlyAdded as yes when selected.Omitting it allows the agent to offer additional identities.
StrictHostKeyCheckingOmitted when left blank; accepted choices are accept-new, yes, ask, and no.no produces a warning because it weakens host-key checking.
ForwardAgentOmitted when blank; otherwise emits yes or no.yes produces a trusted-host warning.
KeepaliveServerAliveInterval of 0 omits both keepalive lines. Values from 1 through 3,600 seconds also emit ServerAliveCountMax, which accepts 1 through 20.The settings detect an unresponsive server; they do not make an application-level operation idempotent.
Connection sharingA selected ControlMaster requires ControlPath. ControlPersist accepts yes, no, 0, or one integer duration such as 10m.The path is flagged unless it contains %C or all of %h, %p, and %r.

A jump target is marked external when its host name, after removing an optional user and port, does not match an alias in the same generated set. That is a review clue rather than an error because the jump host may already be defined elsewhere. Duplicate aliases are also allowed through to the draft but marked for review because later blocks may not override earlier values as expected.

Security Notes:

The browser generates text but does not validate the target network or read local SSH files. Replace sample hosts and paths, keep private keys out of the CSV, and review the surrounding configuration before pasting.

  • Prefer host-key verification that records or requires a trusted key; avoid StrictHostKeyChecking no for ordinary use.
  • Enable agent forwarding only for a trusted route that genuinely needs it.
  • Place connection-sharing sockets in a directory other users cannot modify.
  • Restrict the final user configuration and private-key files with appropriate local permissions.

Worked Examples:

Private host through a bastion

A row for bastion defines the public gateway, followed by a row for db-prod whose proxy cell contains bastion. The second block receives ProxyJump bastion, and its review route reads via bastion. If the gateway row is removed, the block is still generated but the jump reference is marked external so you can confirm that another SSH configuration file defines it.

References: