Skip to content
Shell & TerminalHow-To July 12, 2026 2 min readViews unavailable

How to Configure SSH Connection Multiplexing

OpenSSH can reuse one authenticated transport for later sessions. Configure a private control socket, bounded persistence, and explicit cleanup without weakening host checks.

SSH connection multiplexing lets later sessions reuse an existing encrypted and authenticated connection. It reduces repeated key exchange and login latency, which is especially noticeable for Git operations or many short administrative commands.

Configure a safe control path

Host *.example.net
    ControlMaster auto
    ControlPersist 5m
    ControlPath ~/.ssh/control/%C

Create ~/.ssh/control with permissions accessible only to your user. %C expands to a hash of connection parameters, avoiding long Unix-socket paths and collisions better than a handwritten hostname pattern. Confirm token support in the OpenSSH version you deploy.

ControlMaster auto asks the client to use an existing master or create one. ControlPersist 5m allows that master to remain briefly after the initiating client exits. Choose a lifetime based on the workstation’s threat model rather than leaving masters alive indefinitely.

Observe and control the master

ssh -O check host.example.net
ssh -O exit host.example.net

These commands query or terminate the master selected by the same host configuration. Verbose mode, ssh -vv, shows whether a control socket was found and whether a new connection was negotiated.

Understand the security boundary

Anyone who can access the control socket as its owner may be able to open additional channels over the authenticated connection. Protect the socket directory and do not place it in a shared /tmp path without a private subdirectory and strict permissions.

Multiplexing reuses transport; it does not disable host-key verification, bypass server authorization, or forward an authentication agent automatically. Options are resolved from SSH configuration before the control connection is selected, and materially different connection settings may require a distinct control path or a fresh master.

Avoid surprising automation

Long-lived masters can outlast changed credentials, routing, port forwards, or server policy. For reproducible diagnostics, run with ControlMaster=no or an isolated configuration to force a fresh handshake. Use multiplexing as a latency optimization, not as hidden session state that jobs require for correctness.

Sources: