OK, so, this is what I'm trying to do:
I have my own personal SSH key (with a password) that I use to ssh into any box that I'm authorized to, for shell access (or whatever else)...
I have other keys that I use to do specialized commands, say rsyncing to a box solely for the purpose of backup. These also have passwords, but on the server that's being used, I'll have a command, something like:
command="/home/user/bin/keepass-push" ssh-rsa ... etc.
Then, I have on the client's .ssh/config:
Host user-laptop-keepass-push Hostname laptop.domain User user BatchMode yes IdentityFile /home/user/.ssh/laptop-keepass-push IdentitiesOnly yes
Then, I run:
rsync -avz -e ssh /home/user/.keepass/keepass.kdb user-laptop-keepass-push:/sdcard/keepass/keepass.kdb
/sdcard bit is actually the problem. Here's what seems to happen:
It seems to look for my personal key, which typically is in my agent, and use that in preference to the IdentityFile specified in the config file.
/usr/bin/rsync --server -vlogDtprze.iLsf . /home/user/.keepass/keepass.kdb
"/home/user/bin/keepass-push" script I mentioned above, but because it uses my personal key, it fails, because the
/sdcard bit is for my phone, blah blah blah.
Basically, I don't want the server to care about where the client tells it to put things, only to always put it in
So, the problem seems to be that it first tries my personal ssh key, and then seems to try the keepass one. I've tried reordering the keys in
.ssh/authorized_keys on the server, I have
Host * IdentityFile /home/user/.ssh/user # My personal key
at the bottom of my
.ssh/config file... I'm not sure what the "IdentitiesOnly" tag does then... Is there a way to force a pseudohost to only use a single key?