1

I like to work with some personal Github repos from my work computer (Windows 7) occasionally so after spending way more time than I bargained for learning about how SSH works I created a different set of keys registered to my personal account and make a custom host in my .ssh/config file to use them with github. It looks like this:

Host github.com
    HostName github.com
    User git
    IdentityFile ~/.ssh/github_rsa
    IdentitiesOnly yes

Host github-personal
    HostName github.com
    User git
    IdentityFile ~/.ssh/{personal-username}_github_rsa
    IdentitiesOnly yes

Host *
    IdentitiesOnly yes

A while ago I managed to set up a personal repo on my work computer with the remotes looking like

git@github-personal:{personal-username}/{repo}

which worked fine. Recently though I tried to set up another and it seems like it keeps trying to offer my ~/ssh/github_rsa identity file instead. Running ssh -v git@github-personal I get:

debug1: Reading configuration data /c/Users/Admin/.ssh/config
debug1: /c/Users/Admin/.ssh/config line 7: Applying options for github-personal
debug1: /c/Users/Admin/.ssh/config line 13: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 1: Applying options for *
debug1: Hostname has changed; re-reading configuration
debug1: Reading configuration data /c/Users/Admin/.ssh/config
debug1: /c/Users/Admin/.ssh/config line 1: Applying options for github.com
debug1: /c/Users/Admin/.ssh/config line 13: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 1: Applying options for *
debug1: /etc/ssh/ssh_config line 5: Applying options for github.com
debug1: Connecting to github.com [192.30.252.129] port 22.
debug1: Connection established.
debug1: identity file /c/Users/Admin/.ssh/{personal-username}_github_rsa type 1
debug1: identity file /c/Users/Admin/.ssh/{personal-username}_github_rsa-cert type -1
debug1: identity file /c/Users/Admin/.ssh/github_rsa type 1
debug1: identity file /c/Users/Admin/.ssh/github_rsa-cert type -1
debug1: identity file /c/Users/Admin/.ssh/github_rsa type 1
debug1: identity file /c/Users/Admin/.ssh/github_rsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1
debug1: Remote protocol version 2.0, remote software version libssh-0.7.0
debug1: no match: libssh-0.7.0
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-sha1 none
debug1: kex: client->server aes128-ctr hmac-sha1 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: RSA 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48
Warning: Permanently added 'github.com,192.30.252.129' (RSA) to the list of known hosts.
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /c/Users/Admin/.ssh/github_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: Authentication succeeded (publickey).
Authenticated to github.com ([192.30.252.129]:22).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
PTY allocation request failed on channel 0
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
Hi {work-username}! You've successfully authenticated, but GitHub does not provide shell access.
debug1: channel 0: free: client-session, nchannels 1
Connection to github.com closed.
Transferred: sent 3568, received 1800 bytes, in 0.2 seconds
Bytes per second: sent 20744.2, received 10465.1
debug1: Exit status 1

Looking at these two lines:

debug1: Offering RSA public key: /c/Users/Admin/.ssh/github_rsa
...
Hi {work-username}! You've successfully authenticated, but GitHub does not provide shell access.

it's clearly offering my standard work key. It looks to me the problem is somewhere around here:

debug1: /c/Users/Admin/.ssh/config line 7: Applying options for github-personal
...
debug1: Hostname has changed; re-reading configuration
...
debug1: /c/Users/Admin/.ssh/config line 1: Applying options for github.com

Where it initially reads the correct host configuration, but then changes its mind and reads the default github host instead. I remember having a similar problem last time and adding IdentitiesOnly yes was the answer but I already have that.

2 Answers 2

3

Openssh browses through the config and and is not forced to accept only one match block. The problem with your setup is that your alias github-personal also resolves to hostname github.com (the HostName line below) and after ssh gets to know this, it parses the config once more with this new knowledge about hostname. Also IdentityFile option is not exclusive and openssh can store more keys.

If you want to have it running this way, you will probably have to change the work-account to something different than then just github.com, for example github-work. This should prevent openssh to fallback to your other key. Downside is of course that you will have to reconfigure your repositories, but it should not hurt much.

3
  • Thanks Jakuje. So it seems like the host configuration is recursive, in that if I have HostName github.com under Host github-personal it will re-parse the file and then match Host github.com? I guess I can see why that's useful but is there no way to override it? This would work but I'd have to change all my remotes elsewhere as well, which is a bit annoying.
    – JaredL
    Nov 4, 2015 at 20:29
  • Yes. As your last code block shows, it is recursive. I can think of ugly workaround, putting github-personal.com (for example) into your hosts file (%SystemRoot%\System32\drivers\etc\hosts) to point to original github IP without letting the openssh know.
    – Jakuje
    Nov 4, 2015 at 20:32
  • The hosts file workaround actually might have been more attractive, but I realized I'm using https by default on all my other repos so using the github-work host for ssh seems to work just fine. I also had to remove the github.com host entry in ~/AppData/Local/GitHub/PortableGit.../etc/ssh/ssh_config. Thanks, this is the best solution.
    – JaredL
    Nov 4, 2015 at 20:43
0

There is an easier solution here: https://serverfault.com/a/450807/147786

Basically just add:

Host *
IdentitiesOnly yes

to the end of you .ssh/config

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .