ssh config: alternatives for ProxyCommand?

Question

With the help of ProxyCommand I set up some ssh favorites for ease of use:

host some_server
    hostname some_server
    port 22
    user some_user
    IdentityFile /home/user/.ssh/id_rsa
    ProxyCommand ssh frontserver1 -W %h:%p

host frontserver1
    hostname frontserver1.url.tld
    port 22
    user some_user
    IdentityFile /home/user/.ssh/id_rsa

Today frontserver1 has a long downtime, but I could also connect via frontserver2 or frontserver3. However, I would have to set up everything again like some_server_via_front2 and so on. This would result in n-entries for each intranet server (there are a lot) I want to reach, where n is the number of front servers.

Is there an easier way?

Can I setup alternatives for ProxyCommand?

Something like: if ProxyCommand ssh frontserver1 -W %h:%p is not reachable, then go for ProxyCommand ssh frontserver2 -W %h:%p, then frontserver3, ...

Answer 1

Given what the ssh_config manual says:

 ProxyCommand
         Specifies the command to use to connect to the server.  The com-
         mand string extends to the end of the line, and is executed using
         the user's shell `exec' directive to avoid a lingering shell
         process.

You should be able to use the shell's logical OR operator, thusly:

host some_server
    hostname some_server
    port 22
    user some_user
    IdentityFile /home/user/.ssh/id_rsa
    ProxyCommand ssh frontserver1 -W %h:%p || ssh frontserver2 -W %h:%p || ssh frontserver3 -W %h:%p

host frontserver1
    hostname frontserver1.url.tld
    port 22
    user some_user
    IdentityFile /home/user/.ssh/id_rsa
    ConnectTimeout 5

host frontserver2
    hostname frontserver1.url.tld
    port 22
    user some_user
    IdentityFile /home/user/.ssh/id_rsa
    ConnectTimeout 5

host frontserver3
    hostname frontserver1.url.tld
    port 22
    user some_user
    IdentityFile /home/user/.ssh/id_rsa
    ConnectTimeout 5

I have taken the liberty of adding a ConnectTimeout directive to each of the proxy hosts so that it will take at most fifteen seconds to ultimately fail all the way past the third host on the list, rather than n times the number of hosts times whatever the default TCP timeout setting on your host happens to be.