0

I need ssh to only use keys provided by ssh-agent, and ignore any identity files in ~/.ssh. What's the best way to do that?

Background: I need to authenticate against a Git server via SSH. I have a ~/.ssh/id_rsa which authenticates properly, but its associated Git user does not have the correct repository access permissions. So I need to use a different key, which I can only provide via ssh-agent, to authenticate as the correct Git user. However, as SSH seems to give local identity files precedence over agent-provided ones, I always end up being authenticated as the wrong user.

0

There's no option to do exactly that (aside from renaming id_rsa to id_whatever).

But the real question seems to be "how do I make ssh prefer a specific agent-only key". This is a bit easier to answer, actually – you can do that using the same IdentityFile (-i) option as always.

First use ssh-add -L to extract the public key from the agent to a file; then point IdentityFile to the extracted public key. ssh will accept it even without the private part, and will automatically use ssh-agent for authentication.

  • Interesting that -i also accepts public keys (if the matching private key is provided by the agent). I did not see this documented somewhere, can you provide a link? But more importantly, my agent manages multiples keys, and I'd really prefer SSH to pick the matching one from these automatically instead of me manually extracting the public key for the correct one. – sschuberth Oct 17 '16 at 6:55
  • And how exactly is SSH supposed to "pick the matching key" automatically, if you refuse to tell it which key to pick? It can't get that information from the server – all it can do is try all keys it has and see if the server accepts one of them. – grawity Oct 17 '16 at 7:11
  • Exactly, SSH should try them all, but only the ones provided by the agent. – sschuberth Oct 17 '16 at 7:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.