Why order changes the answer
OpenSSH normally uses the first value it obtains for a client option. That means a specific host block belongs before broad defaults: a later matching Host * can fill unset options, but it does not override values already selected. This page keeps that ordered evidence visible instead of displaying only the last apparent assignment.
Some directives deliberately accumulate. This simulator treats IdentityFile, CertificateFile, LocalForward, RemoteForward, DynamicForward, and SendEnv as multi-value options and lists each source in evaluation order.
Supported behavior
The parser supports comments, quoted arguments, whitespace or equals separators, case-insensitive directive names, Host wildcard lists with negation, and Match host, originalhost, user, localuser, and all. Virtual Include files may use *, ?, and bracket globs, are processed lexically, and may nest with cycle and depth checks. Common %h, %n, %p, %r, %u, %d, %l, %L, and %% tokens are expanded only for options documented to accept runtime tokens.
Analysis boundary and authoritative check
This is an analysis aid, not an OpenSSH implementation or security decision. It performs one user-config-style pass over supplied text. It never runs Match exec, looks at network interfaces, resolves or canonicalizes DNS, reads the real filesystem, evaluates tags/commands/client versions, loads system configuration, validates every option value, talks to an agent, or opens an SSH connection. Those conditions remain visible and unresolved rather than being guessed.
Confirm important results with the same OpenSSH binary and files that will make the connection. A typical local check is ssh -G -F ~/.ssh/config target-alias; review the result and the client version before relying on it for access or routing.
Reference behavior
The current OpenBSD OpenSSH ssh_config(5) manual documents configuration-source order, first-specified-value behavior, Host negation, Match criteria, lexical Include expansion, accumulating IdentityFile entries, and per-option token support. The Linux manual rendering is useful for checking the installed-family syntax, but target-host behavior still depends on the actual client version and platform.
Frequently asked questions
Why did a later User or Port not override an earlier one?
For ordinary client directives, the first matching value wins. Put narrow aliases and Match blocks before broad defaults. The trace identifies the earlier source that shadowed the later line.
Why does Target B say an option is not set?
The simulator lists only values selected from the supplied user configuration plus its explicit HostName, User, and Port fallbacks. It does not invent the many compiled or system-config defaults an installed OpenSSH client may add.
Why is Match exec unresolved?
Executing pasted commands would be unsafe and environment-dependent. The simulator never invokes a shell; use ssh -G in the intended environment to evaluate such conditions.
Does this prove that ProxyJump or forwarding will work?
No. It shows which raw setting is selected and expands common tokens. It does not recursively resolve jump-host configuration, test sockets, check reachability, authenticate, or validate server policy.
Browse system and forensic tools · Audit CODEOWNERS precedence · Audit kubeconfig merging