How to force SSH to ignore the IdentityFile listed in “Host *” for one specific host

opensshsshssh-keys

My SSH config file is set up to use a specific IdentityFile in the Host * section as the default key. For one particular host, I want to offer a different key (and only that key, never the default key).

My ~/.ssh/config file looks like this:

Host specialhost
HostName specialhostname.mydomain.com
IdentityFile %d/.ssh/special-key
LogLevel debug
IdentitiesOnly yes 

Host *
IdentityFile %d/.ssh/regular-key
IdentitiesOnly yes

Regardless of what I do, or regardless of the order of sections in the config file, my SSH client (OS X OpenSSH_6.2p2) offers the 'regular-key' first (which the server accepts, which is not what I wanted).

The ssh_config man page states the following about IdentityFile:

It is possible to have multiple identity files specified in
configuration files; all these identities will be tried in sequence.

The "sequence" it refers to is unclear to me, since the IdentityFile listed in the Host * section is always offered first, even if "specialhost" is listed prior to it (as in the example above). The IdentitiesOnly trick suggested here only seems to be relevant to keys offered by ssh-agent. A few other similar questions have not yielded any answers.

I want to leave the regular-key in the Host * section because I use that key with dozens of other hosts and I don't want to duplicate the IdentityFile in every host entry.

Is there any way to force SSH to offer only the 'special-key' using just the SSH config (and without copying my IdentityFile directives to every other host)? I can see how I might achieve this by taking the keys out of the Host * section, adding them to the agent, and then using IdentitiesOnly yes for specialhost, but I would really prefer to avoid using ssh-agent unless there is no other way.

Best Answer

A Host line can have more than one pattern. And it's not really spelled out in the documentation, but a "!" (exclamation) at the beginning of a pattern means "if a host matches this pattern, then don't apply the section". In other words, you can do this:

Host * !special1 !special2
IdentityFile etc...

And it should match any host except "special1" and "special2".

I don't think the order of the patterns is important. The hostname being checked has to match one non-exclamation pattern, and it has to not match any exclamation patterns.

Related Solutions

Using the IdentityFile directive in ssh_config when AgentForwarding is in use

You can use the public part of a key to to specify which private key you want to use from the forwarded agent. This requires creating an extra file (the public part of the key) on any “intermediate” machines (machines to which you forward your local ssh-agent).

Arrange for the intermediate machine to have a copy of the public part of the desired key in a convenient location (e.g. ~/.ssh/some_other_key.pub).

From any machine that already has the public part of the key:
```
scp some_other_key.pub intermediate:.ssh/
```
or, on the intermediate machine:
```
ssh-add -L | grep something_unique > ~/.ssh/some_other_key.pub
```
You may want to edit the trailing “comment” part of the public key to better identify the key’s origin/owner/purpose (or attempt to hide the same).
Use the pathname to the above public key file with -i or IdentityFile.
You may also need to use IdentitiesOnly yes (in .ssh/config or -o) to keep ssh from trying to offer any additional identities from your forwarded agent.

Have multiple SSH keys for the same host and user

By the looks of it, Bitbucket has a wildcard DNS entry in place; any random subdomain (*.bitbucket.org) will resolve to the same server(s) as bitbucket.org.

$ host bitbucket.org
bitbucket.org has address 207.223.240.182
bitbucket.org has address 207.223.240.181
$ host random.bitbucket.org
bitbucket.org has address 207.223.240.182
bitbucket.org has address 207.223.240.181
$ host clearlynotasubdomain.bitbucket.org
bitbucket.org has address 207.223.240.182
bitbucket.org has address 207.223.240.181

Because of this, you can setup different entries in your ~/.ssh/config with different hostnames:

Host project1.bitbucket.org
  User git
  IdentityFile ~/.ssh/bitbucket/account1

Host project2.bitbucket.org
 User git
 IdenfityFile ~/.ssh/bitbucket/account2

In fact, I'd venture a guess that Bitbucket has this wildcard inplace for this exact purpose.

Best Answer

Related Solutions

Using the IdentityFile directive in ssh_config when AgentForwarding is in use

Have multiple SSH keys for the same host and user

Related Question