Use a specified key from ssh-agent

githubsshssh-agent

Along the lines of How to tell git which private key to use?
I would like to use a specific ssh key in a given situation.

My problem is that even when I specify '-i something' ssh uses the keys from my ssh-agent in the order they are added.

My specific situation:

I have two github users, each with their own key
I would like to – for example via a ssh-config – for each clone specify which key to use:

   Host USER1.git
     Hostname github.com
     User git
     IdentityFile ~/.ssh/USER1.id_rsa

ssh -vt USER1.git will still use USER2.id_rsa if that is the key first added to ssh-agent.

Best Answer

I finally got it to work:

Host USER1.git
  User git
  HostName github.com
  IdentityFile ~/.ssh/USER1.id_rsa

Host USER2.git
  User git
  HostName github.com
  IdentityFile ~/.ssh/USER2.id_rsa

Indentation counts.
Do ssh-add -l and make sure both of your keys have been added.
- Copy/paste each path from ssh-add -l into the appropriate line in ~/.ssh/config to avoid typos. If there is a ~/.ssh/config identityfile path typo for USER1, then the wrong key (USER2's key) will be used instead.

I got the instructions over at BitBucket. They should work for GitHub since the only difference is HostName: http://confluence.atlassian.com/pages/viewpage.action?pageId=271943168#ConfiguringMultipleSSHIdentitiesforGitBashMacOSXLinux-CreateaSSHconfigfile

To get this to work on a remote server using agent forwarding, try @stijn-hoop's suggestion below (in the comments section of this answer).

Related Solutions

Using the IdentityFile directive in ssh_config when AgentForwarding is in use

You can use the public part of a key to to specify which private key you want to use from the forwarded agent. This requires creating an extra file (the public part of the key) on any “intermediate” machines (machines to which you forward your local ssh-agent).

Arrange for the intermediate machine to have a copy of the public part of the desired key in a convenient location (e.g. ~/.ssh/some_other_key.pub).

From any machine that already has the public part of the key:
```
scp some_other_key.pub intermediate:.ssh/
```
or, on the intermediate machine:
```
ssh-add -L | grep something_unique > ~/.ssh/some_other_key.pub
```
You may want to edit the trailing “comment” part of the public key to better identify the key’s origin/owner/purpose (or attempt to hide the same).
Use the pathname to the above public key file with -i or IdentityFile.
You may also need to use IdentitiesOnly yes (in .ssh/config or -o) to keep ssh from trying to offer any additional identities from your forwarded agent.

How to undo an ssh-add on a forwarded identity to access github

You could kill ssh-agent, but that would prevent you from reloading production-infrastructure.pem (since you don't seem to have it locally available) after you're done.

As an alternative, you can use the $GIT_SSH environment variable to specify the program that git should use for ssh. You need to create a new shell script with the following two lines:

#!/bin/bash
ssh -i /home/vagrant/.ssh/id_rsa $*

I would save this as ~/bin/githubssh with mode 555. (This is unfortunately necessary because git does not do argument parsing in the GIT_SSH environment variable, it tries to stuff the entire thing into argv[0] when it goes to execute the SSH program.)

Then, when it's time to do the checkout:

$ GIT_SSH=~/bin/githubssh git clone git@github.com:v6/myrepo.git

This will set the GIT_SSH environment variable only for that git command.

Best Answer

Related Solutions

Using the IdentityFile directive in ssh_config when AgentForwarding is in use

How to undo an ssh-add on a forwarded identity to access github

Related Question