ssh_config "Tag" - really only one?

[Marc Haber]

Hi,

On Sun, Sep 13, 2026 at 05:48:14PM +0100, Brian Candler wrote:
>Match tagged ancientcrypto
>  KexAlgorithms diffie-hellman-group14-sha1
>  HostKeyAlgorithms ssh-rsa
>
>IMO would better be written as
>
>Match tagged ancientcrypto
>  KexAlgorithms +diffie-hellman-group14-sha1
>  HostKeyAlgorithms +ssh-rsa
>
>(as learned from experience: don't disable the new crypto when 
>enabling the old. It will bite you one day)

That is wise advice, thank you. Adopted here.

># IPv4-only hosts (exceptions to explicit IPv6 bind)
>Host dm7080.ka51.zugschlus.de  # ... add more hostnames here.
>  AddressFamily inet
>  BindAddress 0.0.0.0
>
># Bind to ULA
>Host *.internal.customer.example  # ... add more hostnames here
>  AddressFamily inet6
>  BindAddress fd53:cafe:babe::43fa:bc82::1e:100
>
># Bind to global IPv6
>Host *.ka51.zugschlus.de # ... add more hostnames here
>  AddressFamily inet6
>  BindAddress 2a01:db8:43fa:bc82::1e:100
>
>Match Host !0.0.0.0/0,* Localnetwork 2a01:238:43fa:bc82::/64
>  AddressFamily inet6
>  BindAddress 2a01:db8:43fa:bc82::1e:100
>
># Ancient Crypto
>Host thelastbuster.zugschlus.de  # ... add more hostnames here
>  KexAlgorithms +diffie-hellman-group14-sha1
>  HostKeyAlgorithms +ssh-rsa
>
>I think this replicates your intention, and I find it clearer to read 
>than the multi-tag version.

It doesn't scale at all and breaks the modularity of the configuration. 
In reality, I have one directory per fleet (I manage multiple fleets) 
and use a lot of include directives. I'd rather not mix things, and 
doing settings mid-action and undoing them later has the side effect 
that a change in an early-included file might influence configuration in 
later-included files.

I'd love to avoid that, it has hurt me in the past. Having multiple tags 
would really nicely solve that and also would allow to generate ssh 
config from configration management such as foreman and netbox.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421