ssh_config "Tag" - really only one?

[Marc Haber]

On Wed, Sep 09, 2026 at 09:11:02PM +0100, Brian Candler wrote:
>On 09/09/2026 17:05, Marc Haber wrote:
>>This is not always behaving as I intend it to do.
>
>(an actual config which demonstrates the issue would be helpful)

Now you can explain to me that I am holding it wrong, sure.

My intended config, for example would be (prose, not tested since it 
doesnt work anyway):

match host dm7080.ka51.zugschlus.de
   tag ipv4only

match host *.ka51.zugschlus.de
   tag bindaddressneeded

match host *.internal.customer.example
   tag ulaadresssneeded

match host thelastbuster.zugschlus.de
   tag ancientcrypto

Match !tagged ipv4only Host !0.0.0.0/0,* Localnetwork 2a01:238:43fa:bc82::/64
   Tag bindaddressneeded

Match tagged bindaddressneeded !tagged ipv4only
   AddressFamily inet6
   BindAddress 2a01:db8:43fa:bc82::1e:100

Match tagged ulaaddressneeded !tagged ipv4only
   AddressFamily inet6
   BindAddress fd53:cafe:babe::43fa:bc82::1e:100

Match tagged ancientcrypto
   KexAlgorithms diffie-hellman-group14-sha1
   HostKeyAlgorithms ssh-rsa

Imagine more than just one clause where bindaddressneeded, 
ulaaadressneeded, ipv4only, and ancientcrypto are set, in arbitrary 
combinations.

>First tag specified with -P wins; any subsequent -P is silently ignored.
>
>That's clearly the intended behaviour in the source (ssh.c):
>
>                case 'P':
>                        if (options.tag == NULL)
>                                options.tag = xstrdup(optarg);
>                        break;
>
>i.e. only one user-supplied tag is kept, and anything after the first 
>is ignored.

That is not well documented either.

>The best I can think of is to define tags for each of the combinations:
>
>Match Tagged A
>  Include A.conf
>
>Match Tagged B
>  Include B.conf
>
>Match Tagged AB
>  Include A.conf
>  Include B.conf

Yes, but that's an ugly kludge, especially when I am already working 
with one or two layers if includes.

I'd like a future version of OpenSSH to simply maintain a list of tags 
that people can add to and remove from, and match on membership. That 
does not necessarily even need to break backwards compatibility.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421