SSH Client Config Workbench

How to use SSH Client Config Workbench

Trace selected SSH client options for supplied original aliases through a bounded, one-file OpenSSH 9.5 first-pass source model. See which Host blocks match, which scalar line wins, which later values are shadowed and which exact identity/certificate path spellings append. Supply explicit scalar overrides to model precedence without opening a key or connecting.

1. Provide one selected-profile ssh config, original host aliases: one per line, optional selected scalar overrides as json.
2. Choose the supported mode and run the tool. Review its assumptions and any reported errors.
3. Copy the result or download a separate output; reset to clear the current form.

Good to know

• One printable ASCII source, at most 200 KB, 2,000 physical lines, 4,096 characters per line, 500 directives, 100 Host blocks and 500 patterns. LF/CRLF, spaces and tabs are accepted; Unicode, form-feed, continuations and bare CR are outside this profile.
• Provide 1–25 distinct literal aliases, each at most 253 ASCII letters/digits/dots/underscores/hyphens. Host patterns use literals, * and ?, with optional leading !; no commas, character classes, escaped patterns or host canonicalization. Case-sensitive matching uses the original alias in the pinned OpenSSH 9.5 first pass, before later hostname normalization.
• Selected scalars: User, HostName, Port, IdentitiesOnly, BatchMode, Compression, ServerAliveInterval, ServerAliveCountMax, ConnectionAttempts, ConnectTimeout, HostKeyAlias and ProxyJump. Boolean values use yes/no; integer/time values use plain unsigned decimal seconds/counts through 2,147,483,647, with Port 1–65,535 and ConnectionAttempts at least 1. Other syntax such as time suffixes is refused.
• Scalar values use the first obtained source value, after optional explicit scalar overrides. IdentityFile and CertificateFile append up to 32 distinct exact source spellings per alias; duplicate spellings are reported. Paths, none, percent tokens, environment variables and home notation remain inert source strings. No defaults or runtime expansions are inferred.
• Match, Include, ProxyCommand, RemoteCommand, LocalCommand, KnownHostsCommand and canonicalization/reparse controls are refused anywhere in the source. CanonicalizeHostname no is accepted. Other unmodeled options are listed without applying their behavior; acceptance is not full SSH syntax validation or a security/trust verdict.
• Quotes and escapes follow the selected OpenSSH 9.5 argument scanner: quotes concatenate within tokens, only documented quote/backslash/unquoted-space escapes are consumed, and # begins a comment at a token boundary. An embedded # remains token data.
• A static 2,000,000-cell wildcard budget is checked before matching. A dedicated Worker has a 10-second preparation deadline and a separate 2-second computation limit. No command, path, agent, user config or network host is opened or executed.
• A separate JSON report is capped at 500,000 formatted characters; reduce the source when that bound is exceeded.
• Inputs are processed on this device and are not automatically saved or uploaded.