[MacOS 10.12.6 host, Ubuntu 14.04 LTS guest]

I have a local VM setup to only accept publickey authentication. Until now, I've been using a key that requires a passphrase to be entered, and the arrangement works fine. However, I now need to setup a script to automatically perform a scp for me.

As I neither want to have the script pause for me to provide the passphrase nor use expect to do that automatically, I've decided to use a second key that does not have a passphrase.

It appears to me that ssh-copy-id is not able to handle this situation as it uses the -i parameter to tell it which key to upload, and therefore I cannot specify which key to login with.

So, my question is, how to get ssh-copy-id accept a second key that would be used to login in the first place? Should I use ssh-add?

(In light of my above hick-up with ssh-copy-id, I've manually copied and added the key to my authorized_keys file.)


ssh-copy-id appends keys to the remote authorized_keys file. To add several specific keys, run it once per key with -i <key-file-name>.


After your comment, I think I got your question wrong.

You want to use one key to authenticate while installing another to your server.

ssh-copy-id does not offer a command line option to choose a key for authenticating during executing ssh-copy-id.

But it passes -o through to ssh. So:

ssh-copy-id -i ~/.ssh/<your-already-existing-id> -o 'IdentityFile ~/.ssh/<your-new-id-to-install>' <servername>

You can also use ssh-agent, in which case you won't have to enter your pass phrase when using ssh, scp, ssh-copy-id, a.s.o. for as long as ssh-agent is running.

  • 1
    The problem is that I need to be able to login before I can upload the key. But, since I have the server configured to only accept public key login, there is a chicken/egg situation. – gone Oct 31 '17 at 11:27
  • i like the ssh-agent solution – datdinhquoc May 16 '19 at 5:00
  • 1
    your order for ssh-copy-id is wrong. it should be the new id in -i and the existing/working one in the IdentityFile region – Climax Dec 18 '20 at 9:06

Using ssh-add to add your key to the agent is definetly an option.
Otherwise I believe you'd have to set up an entry in the .ssh/config file which includes an IdentityFile option, this will tell ssh how to authenticate for that server and allow ssh-copy-id to do its thing.

  • Though I am using config, I haven't tried your suggestion yet. – gone Oct 31 '17 at 11:28

As others said, I think your best option is to use ssh-agent, like this:

  1. Enable ssh-agent

    eval "$(ssh-agent -s)"

    Note the ssh-agent -s command starts the SSH agent and generates environment variables (that's why we feed the output to the eval command).

  2. Load the 1st key (the one you currently use to log into the remote system)

    ssh-add <1st-key>.pub
  3. Run the ssh-copy-id command and pass the new (2nd) key as a parameter

    ssh-copy-id -i <2nd-key>.pub <user>@<host>

    Et voilà... you have your 2nd key copied (ssh-copy-id used the ssh-agent transparently to authenticate with the first key).

  4. [OPTIONAL] You may now shut down the ssh-agent if you wish:

    eval "$(ssh-agent -k)"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.