Matching both user and host simultaneously in SSH config

Question

So, I have a bunch of machines I manage, where I've aliased each of them for ease of access.

This looks like this for each of them in the ssh client config:

Host MACHINE-1075 M1075 m1075 1075
    User service
    HostName 10.0.100.75

And also:

Match User service
    IdentityFile ~/.ssh/service_user

Which allows me to simply type ssh 1075 to get into that machine, with the correct identity file and user automatically.

This works just fine for normal accesses. Sometimes, however, I may need to log in as root for certain tasks. I can accomplish this by explicitly specifying the identity file, e.g. ssh root@1075 -i ~/.ssh/root_user.

This is okay, but what I'd really like to do is to configure SSH to figure out the required identity file from the combination of user and host, allowing me to type ssh root@1075 and do the right thing. I know I can match all uses of the root user and link it up to an identity file with:

Match User root
    IdentityFile ~/.ssh/root_user

This doesn't work for my case, however, because there are several groups of machines which may require different credentials for root access, so not all of them should match. Ideally, what I'd like to do is something like:

Match Host 10.0.100.75 && Match User root
    IdentityFile ~/.ssh/root_user

But this doesn't seem to work. As a temporary solution, I've simply aliased the machines with root- as a prefix, so I can do ssh root-1075, which isn't too bad, but it's not quite what I want.

This is on Ubuntu 21.10 running OpenSSH 8.4.

Answer 1

It's IMHO not entirely clear in man ssh_config, however the syntax for matching multiple conditions appears to be

Match keyword [pattern|pattern-list] keyword [pattern|pattern-list]

where patterns in pattern-list are comma-separated, but keyword pattern pairs are separated from one another by simple whitespace:

Match Host 10.0.100.75 User root

No explicit logical operator like && is supported because all criteria must be satisfied - logical AND is understood.