Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have several users on my server and as such a separate public/private key pair for each.

The problem is that once they're added as identities (Mac OS X 10.8.4 if it makes a difference), when I connect with a user account it goes through all the keys trying to find the right one. This doesn't work so well because of MaxAuthTries.

I'd be fine with increasing my MaxAuthTries to 100 or so but, although it accepts that under a matched host, it doesn't override the original, and I really don't want to give general public 100 auth attempts for my ssh server; configuration:

MaxAuthTries 2

Match host
        MaxAuthTries 100

MaxAuthTries does nothing for my ip; it still limits it to 2.

This solution wouldn't be ideal but would be acceptable if it can be done. When using a key far down the list, it takes some time to check them all and find the right one (especially if my internet connection is lagging)... Plus sending all my keys, encrypted or not, makes me uncomfortable.

Ideally, I need to connect with the correct key file and not bother trying the others. The problem is that I have most of my passcodes saved to my keychain so if I clear my identities I loose all the saved passcodes.

If this isn't possible, I need a way to change my MaxAuthTries to a big number for my IP. I thought of doing it with IPTables but I use Plesk and rather like to be able to actually use the interface to manage my firewall.

Thanks a bunch!!

share|improve this question
up vote 0 down vote accepted

I was just about to start a bounty for this and realized the answer was so simple...

SSH agent data is not encrypted so it can be retrieved via a shell script, and I use bash to select the correct username, server, etc, based on a given domain (which would be a vhost on said server).

I solved this by exporting the public key from my ssh agent to a file, forcing the use only of that key, and then deleting the public key.

Here's my bash script (hopefully it's helpful to others!):

remove_public () { # remove the public key after 2 seconds
  sleep 2
  rm -f $HOME/.ssh/public_key $HOME/.ssh/config

get_public () { # get the public key from ssh-add
  ssh-add -L | grep "$1" > $HOME/.ssh/public_key
  if [ ! -s "$HOME/.ssh/public_key" ] #identity hasn't yet been loaded
    export KEY="$1" #use the private key it'll be added to the agent for next time assuming agent is configured.
    export KEY="$HOME/.ssh/public_key" #use the public key
    ( remove_public & ) >/dev/null 2>&1
  chmod 700 "$KEY"
  echo "IdentitiesOnly=yes" > "$HOME/.ssh/config"
  echo "IdentityFile $KEY" >> "$HOME/.ssh/config"

ssh_connect () {
  chmod -R 700 $HOME/.ssh
  if [[ -z "$1" || -z "$2" ]]
    echo "Username or server not specified!"
    exit 1;
    get_public "$HOME/.ssh/$2"
    ssh "$2@$1" -i "$HOME/.ssh/$2"

WARNING if you actually have an ssh_config file, this WILL delete it. But it's important to remove IdentitiesOnly and IdentityFile; otherwise, ssh will be broken for connections not using this script.


ssh_connect "server" "username"

This is a stripped down version of the shell script I wrote because my keys aren't always in the same directory (in fact they never are, they're sorted by server), I always pass a screen command to the server, etc.

Also note that in the rm command if you're concerned about security of the deleted public key, you can use rm -fP instead of rm -f if you're using Mac OSX to overwrite the file 3 times before deletion. I don't know what other, if any, OSs support it.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .