How to show SSH client configuration

Showing the SSH client configuration reveals the exact username, hostname, key file, jump host, and keepalive values the local client will use for a destination. That matters when a short alias in /~/.ssh/config hides the real connection path or when a session behaves differently from the settings you expected.

The OpenSSH client combines command-line options, the per-user file /~/.ssh/config, and the system-wide file /etc/ssh/ssh_config, plus any files loaded through Include directives. Current OpenSSH releases use ssh -G to print the resolved client configuration after Host and Match rules are evaluated, so the final values can be checked without opening a session.

Run the inspection as the same local account that starts the SSH session because another account can have a different /~/.ssh/config, different included files, or no per-user overrides at all. The resolved output can expose usernames, internal hostnames, proxy hops, and identity file paths, so trim or mask sensitive lines before sharing it.

Steps to show SSH client configuration:

Inspect the per-user SSH client configuration file to review host aliases, includes, and per-host overrides.
```
$ cat ~/.ssh/config
Include extra.conf

Host bastion.example.net
  HostName bastion.example.net
  User ops
  IdentityFile ~/.ssh/id_ed25519

Host app.internal.example
  HostName host.example.net
  User deploy
  IdentityFile ~/.ssh/id_ed25519
  ProxyJump bastion.example.net
  ServerAliveInterval 30
```
The per-user file is read before /etc/ssh/ssh_config, so values set here usually override the system-wide defaults for the same destination.

If /~/.ssh/config is missing, the client falls back to /etc/ssh/ssh_config and built-in defaults for that local account.
Inspect the system-wide SSH client defaults and include rules.
```
$ cat /etc/ssh/ssh_config
# This is the ssh client system-wide configuration file.  See
# ssh_config(5) for more information.
##### snipped #####
Include /etc/ssh/ssh_config.d/*.conf

Host *
```
/etc/ssh/ssh_config supplies defaults for values that were not already set in the per-user file, and current Linux packages often load extra defaults from /etc/ssh/ssh_config.d/*.conf.
Print the effective SSH client configuration for the destination you care about.
```
$ ssh -G app.internal.example
host app.internal.example
user deploy
hostname host.example.net
port 22
serveraliveinterval 30
identityfile ~/.ssh/id_ed25519
forwardagent no
proxyjump bastion.example.net
```
ssh -G shows the merged settings after Host and Match evaluation, so it is the quickest way to confirm what ssh will use for that destination.

Add verbose parsing output when the resolved settings look wrong and you need to see where they came from.

$ ssh -vG app.internal.example
OpenSSH_9.6p1 Ubuntu-3ubuntu13.15, OpenSSL 3.0.13 30 Jan 2024
debug1: Reading configuration data /home/user/.ssh/config
debug1: Reading configuration data /home/user/.ssh/extra.conf
debug1: /home/user/.ssh/config line 8: Applying options for app.internal.example
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: Setting implicit ProxyCommand from ProxyJump: ssh -v -W '[%h]:%p' bastion.example.net
##### snipped #####

ssh -vG keeps the resolved configuration output and adds debug lines that show which config files were read, which patterns matched, and which settings were derived implicitly.

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.