~/.ssh/config does not handle multiple hosts correctly

[Maik Hentsche]

Binary package hint: openssh-client

According to the man page multiple hosts in the hosts section should be given as comma separated list, since the host section expects a pattern or pattern list and <cite>A pattern-list is a comma-separated list of patterns</cite>.
Still when I put two hosts as comma separated list into my config file (like <cite>Host bullock,dickstone</cite>) the following config is used for neither one. If instead I provide the host list as space separated (like <cite>Host bullock dickstone</cite>) the following configuration is used for both systems. This is either a bug in the program or a bug in the documentation. Since ssh works as stated in the man page on OpenSuSE 10.3 I doubt the later one.

Further information:
user@host:/> lsb_release -rd
Description: Ubuntu 8.04.1
Release: 8.04

user@host:/> apt-cache policy openssh-client
openssh-client:
  Installed: 1:4.7p1-8ubuntu1.2
  Candidate: 1:4.7p1-8ubuntu1.2

ProblemType: Bug
Architecture: amd64
Date: Tue Dec 9 08:43:55 2008
DistroRelease: Ubuntu 8.04
Package: openssh-client 1:4.7p1-8ubuntu1.2
PackageArchitecture: amd64
ProcEnviron:
 PATH=/home/username/bin:/home/username/perl510/bin:/home/username/bin:/home/username/perl510/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=de_DE.UTF-8
 SHELL=/bin/bash
SourcePackage: openssh
Uname: Linux 2.6.24-16-generic x86_64

[Graham Poulter (grahampo)]

I can confirm this bug:

"man ssh_config" says to format host name lists like:

Host A,B,C
  User someuser

But "ssh A" for example prompts for user name, so its not working. However the following works:

Host A B C
  User someuser

[malheum (maxheise)]

I can confirm this bug on fresh install of Ubuntu 8.04.2, i386

$ dpkg -l openssh-client\*
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Installed/Config-f/Unpacked/Failed-cfg/Half-inst/t-aWait/T-pend
|/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad)
||/ Name Version Beschreibung
+++-======================================-======================================-============================================================================================
ii openssh-client 1:4.7p1-8ubuntu1.2 secure shell client, an rlogin/rsh/rcp replacement

This is a working config, but it does not conform to the man page:
Host 192.168.1.1 rodent
        IdentityFile %d/.ssh/rodent_sysadmin_ssh_key/id_rsa

And this is a non-working config, however it conforms to the man page
Host 192.168.1.1,rodent
        IdentityFile %d/.ssh/rodent_sysadmin_ssh_key/id_rsa

The man page says on this topic:
Host Restricts the following declarations (up to the next Host keyword) to be only for those hosts that match one of the patterns given after the keyword. A single
             ‘*’ as a pattern can be used to provide global defaults for all hosts. The host is the hostname argument given on the command line (i.e. the name is not con‐
             verted to a canonicalized host name before matching).

             See PATTERNS for more information on patterns.

And under PATTERNS:
PATTERNS
     A pattern consists of zero or more non-whitespace characters, ‘*’ (a wildcard that matches zero or more characters), or ‘?’ (a wildcard that matches exactly one charac‐
     ter). For example, to specify a set of declarations for any host in the “.co.uk” set of domains, the following pattern could be used:

           Host *.co.uk

     The following pattern would match any host in the 192.168.0.[0-9] network range:

           Host 192.168.0.?

     A pattern-list is a comma-separated list of patterns. Patterns within pattern-lists may be negated by preceding them with an exclamation mark (‘!’). For example, to
     allow a key to be used from anywhere within an organisation except from the “dialup” pool, the following entry (in authorized_keys) could be used:

           from="!*.dialup.example.com,*.example.com"

[Caldrin (maik-mm-double)]

I submitted a patch that changes the documentation to reflect the behaviour of the program.

[Caspar Clemens Mierau (leitmedium)]

@Caldrin: Thank you for writing the patch. Did you already build a debdiff and filed it or is this your only version of it? Asking as this needs more work before being integrated.

[Oliver Dungey (oliver-dungey)]

I have been experiencing similar problems in pattern lists but only noticed because I could not get the negating function to work - in the man page it says:

"Patterns within pattern-lists may be negated by preceding them with an exclamation mark (`!')"

So I was trying to do this sort of thing:

Host "!20.*.*.*"
    ProxyCommand nc -X connect -x 20.44.34.33:8118 %h %p

This should use the proxy for anything not on my 20 network but it just gets ignored.

When are we likely to see this in a Ubuntu distro? Now that a huge number of people in big corporates are working behind proxy servers and using the Cloud via ssh I would suggest this is a critical issue that will hurt Ubuntu takeup.

[Sergey Trofimov (sarg)]

Seems that negated matches are now supported.
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/readconf.c?rev=1.191;content-type=text%2Fplain

[Sergey Trofimov (sarg)]

Sorry, correct link:
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/readconf.c?rev=1.191

support negated Host matching, e.g.

Host *.example.org !c.example.org
 User mekmitasdigoat

Will match "a.example.org", "b.example.org", but not "c.example.org"

[Vibhav Pant (vibhavp)]

Can this bug be reproduced?

[Ken Sharp (kennybobs)]

This is still very much the case in Precise, not sure about the others, is there any progress on this?

[Simon Déziel (sdeziel)]

In Precise, ssh_config's man page correctly states that multiple hosts (ex: Host A B C) are to be separated by spaces and that multiple from="" (ex: from="example.com,192.2.0.1") in the authorized_keys files are comma-separated.