ssh_config "Tag" - really only one?

[Brian Candler]

On 13/09/2026 16:50, Marc Haber wrote:
> I'd like a future version of OpenSSH to simply maintain a list of tags 
> that people can add to and remove from, and match on membership. That 
> does not necessarily even need to break backwards compatibility. 

Could be useful. Minor note:

Match tagged ancientcrypto
   KexAlgorithms diffie-hellman-group14-sha1
   HostKeyAlgorithms ssh-rsa

IMO would better be written as

Match tagged ancientcrypto
   KexAlgorithms +diffie-hellman-group14-sha1
   HostKeyAlgorithms +ssh-rsa

(as learned from experience: don't disable the new crypto when enabling 
the old. It will bite you one day)

Anyway, using today's SSH, I'd turn what you wrote around: write blocks 
for each set of config to apply, and then list the host(s) which each 
block applies to. This is like each group listing its members, rather 
than each item listing the groups it is a member of.  A matching block 
still carries on to match other blocks, but the first value found of any 
particular setting is the one which is used, so exceptions go higher in 
the file.

# IPv4-only hosts (exceptions to explicit IPv6 bind)
Host dm7080.ka51.zugschlus.de  # ... add more hostnames here.
   AddressFamily inet
   BindAddress 0.0.0.0

# Bind to ULA
Host *.internal.customer.example  # ... add more hostnames here
   AddressFamily inet6
   BindAddress fd53:cafe:babe::43fa:bc82::1e:100

# Bind to global IPv6
Host *.ka51.zugschlus.de # ... add more hostnames here
   AddressFamily inet6
   BindAddress 2a01:db8:43fa:bc82::1e:100

Match Host !0.0.0.0/0,* Localnetwork 2a01:238:43fa:bc82::/64
   AddressFamily inet6
   BindAddress 2a01:db8:43fa:bc82::1e:100

# Ancient Crypto
Host thelastbuster.zugschlus.de  # ... add more hostnames here
   KexAlgorithms +diffie-hellman-group14-sha1
   HostKeyAlgorithms +ssh-rsa

I think this replicates your intention, and I find it clearer to read 
than the multi-tag version.

Regards,

Brian.