How do I configure SSH so it dosen't try all the identity files automatically?

Question

I have been putting my ssh identity files inside my ~/.ssh/ folder. I have probably about 30 files in there.

When I connect to servers, i will specify the identity file to use, with something like

ssh -i ~/.ssh/client1-identity client1@10.1.1.10

However, if I do not specify an identity file, and just use something like this:

ssh user123@example.com

I get the error

Too many authentication failures for user123

I understand that is because if no identity file is specified, and ssh can find identity files, then it will try all of them.

I also understand that I can edit the ~/.ssh/config file and specify something like:

Host example.com
PreferredAuthentications keyboard-interactive,password

in order to prevent that connection from trying known identity files.

So, I guess I could move my identity files outside of the ~/.ssh/ directory, or I could specify each host that I want to disable identity-file authentication for in the config file, but is there any way to tell SSH to buy default not search for identity files? Or to specify the ones it will search for?

Answer 1

You can use the IdentitiesOnly=yes option along with IdentityFile (see ssh_config man page). That way, you can specify which file(s) it should look for.

Answer 2

You had the answer all along (almost):

Host *
PreferredAuthentications keyboard-interactive,password

Worked for me.