ssh_config "Tag" - really only one?

[Brian Candler]

On 09/09/2026 17:05, Marc Haber wrote:
> This is not always behaving as I intend it to do.

(an actual config which demonstrates the issue would be helpful)

>
> Is it possible that ssh will only allow ONE SINGLE tag to be applied 
> to a connection?

Indeed it appears so:

% ssh -V
OpenSSH_10.5p1, OpenSSL 3.6.4 25 Aug 2026
% cat foo.conf
Match Tagged a
    User wombat
Match Tagged b
    Hostname example.com
% ssh -F foo.conf -G anywhere | egrep -i '^user |^hostname '
user brian
hostname anywhere
% ssh -F foo.conf -G anywhere -P a | egrep -i '^user |^hostname '
user wombat
hostname anywhere
% ssh -F foo.conf -G anywhere -P a -P b | egrep -i '^user |^hostname '
user wombat
hostname anywhere
% ssh -F foo.conf -G anywhere -P b -P a | egrep -i '^user |^hostname '
user brian
hostname example.com

First tag specified with -P wins; any subsequent -P is silently ignored.

That's clearly the intended behaviour in the source (ssh.c):

                 case 'P':
                         if (options.tag == NULL)
                                 options.tag = xstrdup(optarg);
                         break;

i.e. only one user-supplied tag is kept, and anything after the first is 
ignored.

That seems confusing, and I would have thought it would be better to 
abort with an error message if -P is supplied more than once. The 
current behaviour doesn't seem very useful, except perhaps as

ssh "$@" -P my_default_tag

The best I can think of is to define tags for each of the combinations:

Match Tagged A
   Include A.conf

Match Tagged B
   Include B.conf

Match Tagged AB
   Include A.conf
   Include B.conf