Bug 1759421

Summary: Include directive in ssh_config doesn't work properly
Product: Red Hat Enterprise Linux 8 Reporter: Renaud Métrich <rmetrich>
Component: opensshAssignee: Jakub Jelen <jjelen>
Status: CLOSED NOTABUG QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: low Docs Contact:
Priority: low    
Version: 8.1CC: tmraz
Target Milestone: rc   
Target Release: 8.0   
Hardware: All   
OS: All   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-10-08 10:56:05 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Renaud Métrich 2019-10-08 06:44:31 UTC
Description of problem:

When specifying the Include directive in ~/.ssh/config to include other files, the Host definitions in the included file are not processed if the file is included after some other Host directive in the main ~/.ssh/config file.


Version-Release number of selected component (if applicable):

All openssh versions (RHEL7, 8)


How reproducible:

Always


Steps to Reproduce:
1. Create 2 files to be included

$ cat > ~/.ssh/after.config << EOF
Host foo-after
    Hostname localhost
EOF

$ cat > ~/.ssh/before.config << EOF
Host foo-before
    Hostname localhost
EOF

$ cat > ~/.ssh/config << EOF
Include before.config
Host foo-config
    Hostname localhost
Include after.config
EOF

2. Try connecting to foo-before or foo-config (works)

$ ssh foo-before true
$ ssh foo-config true

3. Try connecting to foo-after (fails)

$ ssh foo-after true

Actual results:

ssh: Could not resolve hostname foo-after: Name or service not known

Expected results:

works


Additional info:

When connecting, the ~/.ssh/after.config file is not really included, but only parsed (from debug logs, see "parse only"):

# ssh -vvv foo-after true
OpenSSH_7.8p1, OpenSSL 1.1.1 FIPS  11 Sep 2018
debug1: Reading configuration data /root/.ssh/config
debug3: /root/.ssh/config line 1: Including file /root/.ssh/before.config depth 0
debug1: Reading configuration data /root/.ssh/before.config
debug3: /root/.ssh/config line 6: Including file /root/.ssh/after.config depth 0 (parse only)
debug1: Reading configuration data /root/.ssh/after.config
...

Comment 1 Jakub Jelen 2019-10-08 10:56:05 UTC
This is expected behavior. See the manual page for ssh_config:

>  Include directive may appear inside a Match or Host block to perform conditional inclusion.

There is a simple solution for that -- use "Match all" before the unconditional include.