5

So, I have a bunch of machines I manage, where I've aliased each of them for ease of access.

This looks like this for each of them in the ssh client config:

Host MACHINE-1075 M1075 m1075 1075
    User service
    HostName 10.0.100.75

And also:

Match User service
    IdentityFile ~/.ssh/service_user

Which allows me to simply type ssh 1075 to get into that machine, with the correct identity file and user automatically.

This works just fine for normal accesses. Sometimes, however, I may need to log in as root for certain tasks. I can accomplish this by explicitly specifying the identity file, e.g. ssh root@1075 -i ~/.ssh/root_user.

This is okay, but what I'd really like to do is to configure SSH to figure out the required identity file from the combination of user and host, allowing me to type ssh root@1075 and do the right thing. I know I can match all uses of the root user and link it up to an identity file with:

Match User root
    IdentityFile ~/.ssh/root_user

This doesn't work for my case, however, because there are several groups of machines which may require different credentials for root access, so not all of them should match. Ideally, what I'd like to do is something like:

Match Host 10.0.100.75 && Match User root
    IdentityFile ~/.ssh/root_user

But this doesn't seem to work. As a temporary solution, I've simply aliased the machines with root- as a prefix, so I can do ssh root-1075, which isn't too bad, but it's not quite what I want.

This is on Ubuntu 21.10 running OpenSSH 8.4.

3
  • 2
    iirc the syntax would just be Match Host 10.0.100.75 User root - no explicit logical operator is required because AND is understood. I can't find this in the documentation though. Feb 18 at 13:02
  • You are indeed correct. Thanks a lot. Please post an answer so I can accept it.
    – hodahle
    Feb 18 at 13:25
  • 1
    OK thanks - done Feb 18 at 13:31

1 Answer 1

7

It's IMHO not entirely clear in man ssh_config, however the syntax for matching multiple conditions appears to be

Match keyword [pattern|pattern-list] keyword [pattern|pattern-list]

where patterns in pattern-list are comma-separated, but keyword pattern pairs are separated from one another by simple whitespace:

Match Host 10.0.100.75 User root

No explicit logical operator like && is supported because all criteria must be satisfied - logical AND is understood.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.