So, I have a bunch of machines I manage, where I've aliased each of them for ease of access.

This looks like this for each of them in the ssh client config:

Host MACHINE-1075 M1075 m1075 1075
    User service

And also:

Match User service
    IdentityFile ~/.ssh/service_user

Which allows me to simply type ssh 1075 to get into that machine, with the correct identity file and user automatically.

This works just fine for normal accesses. Sometimes, however, I may need to log in as root for certain tasks. I can accomplish this by explicitly specifying the identity file, e.g. ssh root@1075 -i ~/.ssh/root_user.

This is okay, but what I'd really like to do is to configure SSH to figure out the required identity file from the combination of user and host, allowing me to type ssh root@1075 and do the right thing. I know I can match all uses of the root user and link it up to an identity file with:

Match User root
    IdentityFile ~/.ssh/root_user

This doesn't work for my case, however, because there are several groups of machines which may require different credentials for root access, so not all of them should match. Ideally, what I'd like to do is something like:

Match Host && Match User root
    IdentityFile ~/.ssh/root_user

But this doesn't seem to work. As a temporary solution, I've simply aliased the machines with root- as a prefix, so I can do ssh root-1075, which isn't too bad, but it's not quite what I want.

This is on Ubuntu 21.10 running OpenSSH 8.4.

  • 4
    iirc the syntax would just be Match Host User root - no explicit logical operator is required because AND is understood. I can't find this in the documentation though. Commented Feb 18, 2022 at 13:02
  • You are indeed correct. Thanks a lot. Please post an answer so I can accept it.
    – hodahle
    Commented Feb 18, 2022 at 13:25
  • 1
    OK thanks - done Commented Feb 18, 2022 at 13:31

1 Answer 1


It's IMHO not entirely clear in man ssh_config, however the syntax for matching multiple conditions appears to be

Match keyword [pattern|pattern-list] keyword [pattern|pattern-list]

where patterns in pattern-list are comma-separated, but keyword pattern pairs are separated from one another by simple whitespace:

Match Host User root

No explicit logical operator like && is supported because all criteria must be satisfied - logical AND is understood.

  • 1
    A side note for people who found this answer via googling: the parsing rules of ssh_config requires the Match block of overrides to come before the Host block that specifies the rest of that computer's configuration.
    – Ti Strga
    Commented Oct 24, 2023 at 16:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .