[MacOS 10.12.6 host, Ubuntu 14.04 LTS guest]

I have a local VM setup to only accept publickey authentication. Until now, I've been using a key that requires a passphrase to be entered, and the arrangement works fine. However, I now need to setup a script to automatically perform a scp for me.

As I neither want to have the script pause for me to provide the passphrase nor use expect to do that automatically, I've decided to use a second key that does not have a passphrase.

It appears to me that ssh-copy-id is not able to handle this situation as it uses the -i parameter to tell it which key to upload, and therefore I cannot specify which key to login with.

So, my question is, how to get ssh-copy-id accept a second key that would be used to login in the first place? Should I use ssh-add?

(In light of my above hick-up with ssh-copy-id, I've manually copied and added the key to my authorized_keys file.)

3 Answers 3


ssh-copy-id appends keys to the remote authorized_keys file. To add several specific keys, run it once per key with -I <key-file-name>.


After your comment, I think I got your question wrong.

You want to use one key to authenticate while installing another on your server.

ssh-copy-id does not offer a command-line option to choose a key for authenticating while executing ssh-copy-id.

But it passes -o through to ssh. So:

ssh-copy-id -i ~/.ssh/<your-new-id-to-install> -o 'IdentityFile ~/.ssh/<your-already-existing-id>' <servername>

You can also use ssh-agent, in which case you won't have to enter your passphrase when using ssh, scp, ssh-copy-id, a.s.o. for as long as ssh-agent is running.

  • 2
    The problem is that I need to be able to login before I can upload the key. But, since I have the server configured to only accept public key login, there is a chicken/egg situation.
    – gone
    Oct 31, 2017 at 11:27
  • i like the ssh-agent solution
    – Dee
    May 16, 2019 at 5:00
  • 2
    your order for ssh-copy-id is wrong. it should be the new id in -i and the existing/working one in the IdentityFile region
    – Climax
    Dec 18, 2020 at 9:06
  • 1
    not sure why but this didn't work for me. It kept submitting the ~/.ssh/<your-already-existing-id> to the server rather than the identity I wanted to submit
    – Andrew
    Jul 12, 2021 at 17:51
  • This didn't work. In my scenario, I have ssh password access blocked, and I have ssh access with one user. But I'm trying to copy the public ssh key of ANOTHER USER, so I can't log in to that account and transfer its public key Oct 29, 2021 at 18:52

Using ssh-add to add your key to the agent is definetly an option.
Otherwise I believe you'd have to set up an entry in the .ssh/config file which includes an IdentityFile option, this will tell ssh how to authenticate for that server and allow ssh-copy-id to do its thing.

  • Though I am using config, I haven't tried your suggestion yet.
    – gone
    Oct 31, 2017 at 11:28

As others said, I think your best option is to use ssh-agent, like this:

  1. Enable ssh-agent

    eval "$(ssh-agent -s)"

    Note the ssh-agent -s command starts the SSH agent and generates environment variables (that's why we feed the output to the eval command).

  2. Load the 1st key (the one you currently use to log into the remote system)

    ssh-add <1st-key>.pub
  3. Run the ssh-copy-id command and pass the new (2nd) key as a parameter

    ssh-copy-id -i <2nd-key>.pub <user>@<host>

    Et voilà... you have your 2nd key copied (ssh-copy-id used the ssh-agent transparently to authenticate with the first key).

  4. [OPTIONAL] You may now shut down the ssh-agent if you wish:

    eval "$(ssh-agent -k)"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.