Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two private ssh keys :

  • one to access my personnal machines,
  • one to access servers at my job.

I add those two keys to my ssh-agent with ssh-add.

Now, when I do ssh -A root@jobsrv I would like to forward agent authentication only for my job key (the one I'm using to connect jobsrv).

I want this because anyone having root access to jobsrv can use my agent to authenticate himself to my personnal machines.

Is there a way to achieve this isolation?

share|improve this question
did you check the -i option in man page of ssh? – Upasana Mar 31 '13 at 21:40
@Stillakid yes, ssh -A -i myjobkey_rsa root@jobsrv still allows the jobsrv machine to access my local machine agent and authenticate on my personnal server with the other (personnal) key... – Totor Mar 31 '13 at 22:02
also checked ssh-keysign? – Upasana Mar 31 '13 at 22:45
up vote 2 down vote accepted

Unfortunately, I believe it is not possible to achive this easily at the present moment. One could use two agents (one for each key) so that there is no agent holding every keys. But this would be pretty cumbersome to work with.

This is why a bug report (enhancement) has been opened. There is this similar report too.

share|improve this answer

In order to force ssh(1) to use a particular key even if ssh-agent(1) offers multiple ones, use the IdentityFile and IdentitiesOnly directive in ~/.ssh/config, e.g.:

Host example.com
    IdentityFile ~/.ssh/keys/special.pem
    IdentitiesOnly yes

See ssh_config(5) for details.

share|improve this answer
This does not work. IdentitiesOnly applies when you try to connect to the remote server. Once you're connected, if -A agent forwarding is enabled, the whole keyring is forwarded. – Totor Apr 16 '13 at 20:21
The keyring is not forwarded out. It is the auth request that is forwarded in. – bahamat Apr 17 '13 at 6:25
@bahamat Sure, my mistake. Still, this solution does not work. – Totor May 19 at 17:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.