Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to specify forwarded keys using the IdentityFile directive in .ssh/config?

I ran into this quirk when trying to deploy some code via Capistrano/GIT on our production server. Both my personal and my work GIT keys are always loaded in my SSH agent and it just so happened that my personal key was added to the agent first. I use agent forwarding when deploying with Capistrano so when the host tried to authenticate the `git pull` operation it failed with the following error:

ERROR: Permission to `some repo` denied to `your user`.

because it attempted to authenticate using my personal git key before trying the appropriate key (which came later in the ssh agent) and assumed that I was accessing a foreign repo which I don't have permission to access. I can potentially just give my personal user access to every work repo but on my local machine I can get around this problem by defining custom domains in .ssh/config like so:

User git
IdentityFile ~/.ssh/some_key

User git
IdentityFile ~/.ssh/some_other_key

and this way git never gets confused. Is it possible to create .ssh/config rules for forwarded keys on my production boxes so they always know which key to use when pulling in new code? Basically I want to be able to do:

User git
IdentityFile some_forwarded_key


share|improve this question
up vote 15 down vote accepted

You can use the public part of a key to to specify which private key you want to use from the forwarded agent. This requires creating an extra file (the public part of the key) on any “intermediate” machines (machines to which you forward your local ssh-agent).

  1. Arrange for the intermediate machine to have a copy of the public part of the desired key in a convenient location (e.g. ~/.ssh/

    From any machine that already has the public part of the key:

    scp intermediate:.ssh/

    or, on the intermediate machine:

    ssh-add -L | grep something_unique > ~/.ssh/

    You may want to edit the trailing “comment” part of the public key to better identify the key’s origin/owner/purpose (or attempt to hide the same).

  2. Use the pathname to the above public key file with -i or IdentityFile.

  3. You may also need to use IdentitiesOnly yes (in .ssh/config or -o) to keep ssh from trying to offer any additional identities from your forwarded agent.

share|improve this answer
Perfect, thanks! – skryl Apr 20 '11 at 17:13
This is the only thing that has worked for me from 10 other solutions. – Tracy Fu Aug 21 '15 at 4:38
Playing with this I realized that if you put the public key associated with the private key you wish to use in ~/.ssh/ on the intermediate machine, it will be used by default, no need for any configuration in ~/.ssh/config. – bschlueter Jan 7 at 0:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .