.ssh/config How to have Match match multiple hostnames in one line

Question

I am trying to set up my .ssh/config so that it only uses ProxyCommand when it can't reach the server locally. However, I'm struggling to make the Match keyword match multiple hosts, so I have a rather long config file.

For example. I have

Match host="X" !exec "is_reachable X" 
    User me
    ProxyCommand ssh me2@proxy exec netcat %h %p 2> /dev/null
    ForwardAgent yes

Match host="Y" !exec "is_reachable Y" 
    User me
    ProxyCommand ssh me2@proxy exec netcat %h %p 2> /dev/null
    ForwardAgent yes
...

X and Y are on the same network so if one of them is reachable, so is the other one. I don't really need the argument of is_reachable to be changed. Ideally, I'd like to have something like:

Match host="X Y" !exec "is_reachable X" 
    User me
    ProxyCommand ssh me2@proxy exec netcat %h %p 2> /dev/null
    ForwardAgent yes

That matches both X and Y. I have around 15 hostnames and I don't want to have a separate rule for all of them.

I have seen solutions like Only apply Match keyword to single Host in ssh config but they only deal with a single host.

Answer 1

I know this is a two year old question, but I was trying to find this answer today and did. After searching all over, I realized it was pretty clearly stated in the documentation (at least the current version).

The other keywords' criteria must be single entries or comma-separated lists and may use the wildcard and negation operators described in the PATTERNS section.

So I'm using a Match line like this now, and it's working great:

Match host prefix1*,prefix2*,prefix3*
    User root
    ProxyJump bastion-host.example.com
    ForwardAgent yes

Make sure to not separate the host patterns with commas and spaces (only commas).

There's a lot of power in the Match keyword. This can be exhibited by my use case which extends a little further. I needed to execute a "pre-script" to make sure my local environment was set up appropriately for the request, so I combined the criteria keywords originalhost and exec. I just had to make sure my script returned a 0 response code so that hosts matching originalhosts criteria didn't fail the Match due to my exec script.

Match originalhost prefix1*,prefix2*,prefix3* exec ~/.ssh/pre_script
    User root
    ProxyJump bastion-host.example.com
    ForwardAgent yes

I'm writing all this with the following versions (as shown at the top of ssh -v output):

OpenSSH_9.0p1, LibreSSL 3.3.6