A host is a name and an address. Everything else is optional: a port, a user,
a key, a jump host, a credential, a group and any number of tags. n adds a
host, e edits the one highlighted and d deletes it; with the group list
focused, the same keys work on groups.
Groups nest, and a host fills anything it leaves empty from the nearest group above it that sets it. Three things are inherited — the user, the key and the jump host — and a credential counts as setting whatever it carries. The nearest thing that sets a value wins, which, most specific first, means:
The detail pane says where each inherited value came from: ← Production
beside a user the Production group supplied, ← Prod deploy beside one a
credential did. A host connecting as someone unexpected says why on the screen
you are already looking at.
The address and the port are never inherited. They are what makes a host that host.
A group holds the hosts beneath it as well as its own, so selecting one lists everything in it, and the number beside it counts the same. Nesting is how machines usually get grouped, and a group whose machines all live in its children would otherwise look empty.
/ searches every host at once, fuzzily, by name, address and tag; esc
clears it.
In a form, ↓ offers what you already use: the jump hosts, groups and tags
for a host, and the parents and jump hosts for a group. Tags are a set —
space toggles one, ✓ marks those chosen and ↵ finishes. The jump host
and group fields stay free text: any ssh destination works as a jump host, and
a group name that does not exist yet is created.
Every connection Omassh makes — a full-screen session, the pane, SFTP, a tunnel, a snippet run — is built in one place from the host’s resolved settings. A host that connects in a session connects the same way everywhere else: through the same jump host, as the same user, with the same key.
A key is a path, which becomes ssh -i. The key itself stays where it is, and
its passphrase is ssh-agent’s business: ssh-add it, or set
AddKeysToAgent yes in ~/.ssh/config. Omassh never asks for one.
Whatever Omassh does not set is left to OpenSSH, which reads your
~/.ssh/config as it always does — Match blocks, certificates,
IdentityAgent, known_hosts and the rest.
ssh decides which Host blocks of ~/.ssh/config apply by the name it is
handed. So when your config names one of your hosts — the same name, reaching
the same address and port — Omassh hands ssh that name and pins the address
beside it:
ssh -o HostName=10.0.0.5 deploy@prod-web
Everything under Host prod-web then applies, as it does to ssh prod-web:
ForwardAgent, IdentitiesOnly, SetEnv, the HostKeyAlgorithms an old
switch needs before it will talk at all. Handed the address instead, ssh would
pass over the whole block. The address is still Omassh’s, so the name decides
which settings apply and never which machine is reached, and the user, port
and jump host Omassh sets still win: ssh keeps the first value it is given,
and the command line comes first.
The machine has to be the same, not only the name. A Host web in the file
that points somewhere else is a different machine that happens to share a
name, and its settings — a forwarded agent among them — are not this host’s to
take. The detail pane says which it is: config Host prod-web ←
~/.ssh/config when the block is in use, and where the file puts that name
when it is not. An address changed in one place and not the other is the
usual reason.
Hosts your config does not name are handed to ssh by their address, so a block
written for an address or a domain — Host *.corp.example.com — still applies
to them. Handing ssh every host’s name would trade those blocks for these.
The file is read for the names it gives machines and for what it sends them
through, which reachability needs, and nothing else — along
with whatever it Includes, every time the list is read, so after an edit,
r. Omassh’s own block from
export-ssh-config does
not count, since everything in it came from Omassh in the first place. A file
that cannot be read says so in the status bar, and until it reads, every host
is reached by its address.
A jump host is named by picking one of your hosts, and the connection to it is
spelled out as a ProxyCommand carrying that host’s own port, user and key.
ssh -J would hand the hop only -l, -p and -v, so the jump host’s key
would be silently ignored; Omassh writes the command ssh would otherwise build
internally, with nothing left out. A jump host Omassh does not know —
ops@edge.example.com — is passed through as a plain -J, since ssh already
understands it.
Chains work: a jump host may sit behind another, and each hop is told the
address of the next rather than being left to work it out. ssh expands %h
and %p across a whole ProxyCommand, nested levels included, so writing
them would hand every hop the final destination, and the hosts in between
would never be contacted. Omassh knows every address in the chain, so it
writes each one.
p probes the hosts in the selected group: ● up, ✖ down. A probe is a TCP
connection to the host’s port, opened and closed. That is what makes it quick
enough to sweep a whole group at once, and it is why a probe says a port is
answering and nothing about whether ssh would let you in. It waits
probe_timeout for an answer — two seconds, unless the
config says otherwise.
Hosts behind a jump host show ◌ and are skipped rather than guessed at:
their address means something only from the far side of the jump, so dialling
it from here would report on a different machine entirely. That includes a
host your ~/.ssh/config sends through one — a ProxyJump, or a
ProxyCommand such as an aws ssm session, whose host is an instance id
rather than an address at all. The file is read as ssh reads it for the name
it is handed: the host’s name where the file gives it one, and its address
otherwise, which is what patterns such as Host 10.0.1.* match. The first
ProxyJump or ProxyCommand met decides, none included, and the detail
pane shows it on the via line with ← ~/.ssh/config beside it. A jump host
Omassh gives the host goes on ssh’s command line, ahead of the file, so that
is the one ssh takes and the one shown.
A route set under a Match that holds only at the moment of connecting —
exec, user and the rest — is still out of Omassh’s sight, so a host that
relies on one is dialled directly like any other.