Put each server’s connection details in ~/.ssh/config, give each destination a clear Host alias, and assign the correct private key with IdentityFile. Add IdentitiesOnly yes when that server must not receive other keys from your ssh-agent. You can then connect with a short command such as ssh production or ssh staging instead of typing -i every time.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The alias is only a local shortcut. HostName remains the real DNS name or address, User sets the login account, and IdentityFile selects the private key used for authentication.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
The basic per-server setup
OpenSSH reads per-user settings from ~/.ssh/config. Create one block for each server or server group. This example keeps production and staging completely separate:
Host production
HostName prod.example.com
User deploy
IdentityFile ~/.ssh/id_ed25519_production
IdentitiesOnly yes
Host staging
HostName staging.example.com
User deploy
IdentityFile ~/.ssh/id_ed25519_staging
IdentitiesOnly yesAfter saving the file, use the aliases:
ssh production
ssh stagingWhen you run ssh production, OpenSSH matches the word production against Host, connects to prod.example.com, logs in as deploy, and uses the production key. The staging command follows the other block and uses the staging key.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
This arrangement moves the decision from an error-prone command line into a reviewable configuration file. It also gives you a single place to change a hostname, account, or key path when a server is migrated.
What each directive controls
Understanding the four directives prevents the most common configuration mistakes.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Host: the name that selects a block
Host is the name you type after ssh. It can be a short alias such as production, an actual hostname, or a pattern that matches several names. The alias does not have to be registered in DNS.
HostName: the real destination
HostName supplies the DNS name or address OpenSSH should contact. Keeping it separate from the alias lets you use a stable command even if the real address changes.
User: the remote account
User sets the login account for that block. If different servers use different accounts, put the account beside the matching key instead of relying on a global default.
IdentityFile: the private key file
IdentityFile names the private key OpenSSH uses for user authentication. Use an explicit path when each server has a distinct trust boundary; the filenames make the intended relationship easy to audit.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11IdentitiesOnly: whether the agent may add other keys
IdentitiesOnly yes tells the client to use only the configured identity and certificate files, even if an authentication agent offers additional identities. This is the setting that turns “use this key” into a strict per-server rule rather than a preference.
Set up the configuration step by step
1. Inventory the keys you intend to use
List the private keys you already maintain and decide which server or server group each one belongs to. Choose names that communicate purpose, such as id_ed25519_production and id_ed25519_staging. Do not put private-key contents in a ticket, chat message, shell history, or configuration paste.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
2. Open the per-user configuration file
Edit ~/.ssh/config in your normal user account. OpenSSH reads this file for connections made by that account. Keep the file organized with one clearly separated block per alias so another administrator can verify the mapping without guessing.
3. Add one complete block per destination
Include the real address, account, private key, and strict identity behavior where needed:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Host production
HostName prod.example.com
User deploy
IdentityFile ~/.ssh/id_ed25519_production
IdentitiesOnly yes
Host staging
HostName staging.example.com
User deploy
IdentityFile ~/.ssh/id_ed25519_staging
IdentitiesOnly yesIndentation is conventionally four spaces, but the important requirement is that each option belongs to the intended Host block. Avoid putting a production key in a broad block that also matches staging names.
4. Connect using the alias
Run ssh production or ssh staging. You no longer need to append -i for routine connections. If you need a one-off override, the command line can still be used, but the configuration remains the repeatable source for normal work.
5. Inspect the effective result before troubleshooting authentication
Use:
ssh -G productionThe command prints the effective configuration that OpenSSH resolved for that alias. Check that the reported hostname, user, identityfile, and identitiesonly values point to the production destination and key. Run the same check for staging when validating a second block. This separates a configuration-selection problem from a server-side authentication problem.
Why IdentitiesOnly yes matters with ssh-agent
An authentication agent can hold several identities at once. Without an explicit restriction, the SSH client may offer agent-held keys in addition to the key named in your configuration. A server can reject a connection after too many incorrect offers, even though the correct key is available later in the sequence.
Setting IdentitiesOnly yes in a server’s block tells OpenSSH to use only the configured identity and certificate files. It prevents unrelated agent identities from being offered for that destination.
Use strict selection when trust boundaries differ
Strict selection is especially useful when production, staging, customer environments, or unrelated organizations use separate keys. It reduces the chance that a connection succeeds with an unintended credential and makes authentication failures easier to interpret.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Do not confuse the option with agent management
IdentitiesOnly yes does not remove keys from the agent and does not change which keys are stored there. It controls what this SSH connection is allowed to offer. Other applications or connections can continue to use the agent according to their own configuration.
Use wildcard patterns for server groups
Host accepts patterns, so one block can cover a group of servers that share an account and key. For example:
Host *.prod.example.com
User deploy
IdentityFile ~/.ssh/id_ed25519_production
IdentitiesOnly yesThis applies to names such as api.prod.example.com and db.prod.example.com when those names are used in the SSH command. The block supplies a common user and production key; each matching name still resolves through its own DNS entry unless another setting changes it.
Pattern syntax
*matches any number of characters.?matches exactly one character.- Comma-separated pattern lists combine alternatives.
- A pattern can be negated by placing
!before it.
A pattern list containing only negated patterns does not produce a positive match. Include at least one positive pattern when you are building an exception rule.
When an explicit alias is safer
Use an explicit alias when you want a stable short command, when the same server is reached through different names, or when the key assignment must be obvious at a glance. Wildcards reduce repetition for genuinely uniform groups; aliases reduce ambiguity when individual systems have different trust boundaries.
Multiple IdentityFile directives are additive
OpenSSH does not treat repeated IdentityFile lines like a simple “last value wins” setting. The manual states: “Multiple IdentityFile directives will add to the list of identities tried.”
For example:
Host legacy
HostName legacy.example.com
User admin
IdentityFile ~/.ssh/id_ed25519_legacy
IdentityFile ~/.ssh/id_rsa_legacy
IdentitiesOnly yesThat block intentionally creates a sequence of two identities. OpenSSH can try them in turn. This is appropriate only when trying a sequence is part of the design, such as a controlled transition between keys.
If the requirement is “use exactly this one key for this server,” configure one IdentityFile and IdentitiesOnly yes. Adding several files when you meant to select one weakens the clarity of the mapping and can cause avoidable authentication attempts.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Parameterized key paths
IdentityFile accepts ~ and documented tokens. Tokens can reduce repetition when your key naming follows a predictable scheme:
| Token | Meaning |
|---|---|
%d |
Local home directory |
%h |
Remote host |
%n |
Original host name supplied by the user |
%p |
Remote port |
%r |
Remote user |
%u |
Local user |
A tokenized path might derive a filename from the host or user, allowing one pattern to cover many systems. That convenience comes with an auditing cost: the final filename is less obvious when someone reads the block. Explicit filenames are easier to review when servers have different trust boundaries or when a mistake would have serious consequences.
Choosing aliases, wildcards, or command-line -i
All three approaches can select a key, but they differ in how repeatable and auditable the result is.
| Approach | How you invoke it | Repeatability | Risk of selecting the wrong key | Auditability | Behavior with ssh-agent | Portability across machines |
|---|---|---|---|---|---|---|
| Explicit alias | ssh production |
High: the same alias resolves to the same block | Low when each block has one key and IdentitiesOnly yes |
High: hostname, user, and key are together | Can be strict with IdentitiesOnly yes |
Requires copying the relevant config and key paths |
| Wildcard group | ssh api.prod.example.com |
High for uniform server groups | Higher if a name matches a broad pattern unintentionally | Good for standardized groups; weaker for exceptions | Can be strict with IdentitiesOnly yes |
Requires the same pattern and key naming scheme |
Command-line -i |
ssh -i ~/.ssh/id_ed25519_production [email protected] |
Low: every command repeats the choices | Depends on what was typed for that connection | Lower: the mapping is scattered through shell history or scripts | Does not by itself prevent other agent identities from being offered | Works wherever the command and path are available |
Use aliases for individually managed servers, wildcards for genuinely uniform groups, and -i for occasional exceptions or temporary tests. For routine work, keeping the mapping in ~/.ssh/config is easier to review than relying on memory.
HostKeyAlias is not a user-key selector
HostKeyAlias controls the name OpenSSH uses for host-key lookup and storage. The manual describes it as useful for tunneling or for multiple servers running on one host.
It affects host-key database naming and validation. It does not choose the private key used for user authentication. If a connection is offering the wrong user key, change IdentityFile or IdentitiesOnly; changing HostKeyAlias addresses a different part of the SSH trust process.
Free tools Windows power users keep installed
One-click scans. No signup required.
Troubleshoot the common failure modes
The alias connects to the wrong machine
Run ssh -G alias and inspect hostname. If it is wrong, correct HostName in the matching block. Remember that the alias after Host is not automatically the DNS destination.
The login account is wrong
Inspect the resolved user value with ssh -G alias. Add or correct User in that alias’s block rather than changing the key file. A valid private key for the wrong account will still fail authorization.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
The intended key is listed, but another key is offered first
Check the resolved identitiesonly value. Set IdentitiesOnly yes in the relevant block and make sure the block is the one selected by the alias or pattern. This limits the connection to the configured identity and certificate files instead of allowing additional agent identities.
The connection tries several configured keys
Look for repeated IdentityFile directives. They are additive, so every listed file joins the sequence of identities tried. Remove the extras when one key is intended, or keep them only when an ordered fallback is deliberate.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →A wildcard applies to more names than intended
Review the pattern character by character. * can match many characters, while ? matches one. Add a more specific alias for an exception, or use a negated pattern together with a positive pattern list. A list made only of negated patterns cannot create a positive match.
The key path works on one computer but not another
Check whether the configuration uses an absolute path, ~, or a token such as %d or %h. The same config requires the corresponding private-key files to exist at the resolved paths on each machine. Explicit filenames are often easier to migrate and audit than tokenized paths.
Host-key warnings appear after using aliases
Host-key validation is separate from user-key selection. If several servers share an address or a tunnel requires a different lookup name, review whether HostKeyAlias is appropriate. Do not use it as a substitute for correcting IdentityFile.
Security and maintenance checklist
- Keep each private key protected with restrictive filesystem permissions.
- Never paste private-key contents into tickets, chat, shell history, or configuration examples.
- Use descriptive key filenames that show the environment or trust boundary.
- Put
IdentitiesOnly yeson blocks where unrelated agent identities must not be offered. - Review wildcard patterns whenever a new hostname is added, because a broad match can inherit the wrong key.
- Run
ssh -G aliasafter changing a block and verifyhostname,user,identityfile, andidentitiesonly. - Keep explicit aliases for exceptional systems instead of forcing them into a broad group pattern.
- Use multiple
IdentityFilelines only when trying a sequence is intentional and documented.
A practical layout for a growing fleet
Start with explicit aliases for servers that have different ownership, environments, or credentials. A block should answer four questions without opening another file: where is the server, which account is used, which private key is intended, and whether agent identities are restricted.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhen several hosts share all four answers, replace repetitive blocks with a wildcard group. Keep exceptions explicit so a special server does not silently inherit a group’s key. If the same machine is reached through two names, give each operational context its own alias and set the shared destination with HostName; this preserves short, meaningful commands while keeping the key choice visible.
As the fleet changes, treat ~/.ssh/config as an auditable map rather than a collection of ad hoc command-line fragments. The most important review is not whether the file is short; it is whether every alias or pattern resolves to the intended host, account, and identity.
Quick Recap
What to remember
Hostselects the configuration block and the alias you type.HostNamesupplies the real DNS name or address.Usersets the remote login account.IdentityFilenames the private key for authentication.- Repeated
IdentityFiledirectives add identities to the sequence tried. IdentitiesOnly yesprevents unrelated keys held byssh-agentfrom being offered.- Wildcard and negated patterns let you define server groups and exceptions.
HostKeyAliaschanges host-key lookup naming, not user-key authentication.ssh -G aliasshows the effective values before you investigate the remote server.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
