Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have two private ssh keys :

  • one to access my personnal machines,
  • one to access servers at my job.

I add those two keys to my ssh-agent with ssh-add.

Now, when I do ssh -A root@jobsrv I would like to forward agent authentication only for my job key (the one I'm using to connect jobsrv).

I want this because anyone having root access to jobsrv can use my agent to authenticate himself to my personnal machines.

Is there a way to achieve this isolation?

share|improve this question
    
did you check the -i option in man page of ssh? –  Upasana Mar 31 '13 at 21:40
1  
@Stillakid yes, ssh -A -i myjobkey_rsa root@jobsrv still allows the jobsrv machine to access my local machine agent and authenticate on my personnal server with the other (personnal) key... –  Totor Mar 31 '13 at 22:02
    
also checked ssh-keysign? –  Upasana Mar 31 '13 at 22:45

2 Answers 2

up vote 1 down vote accepted

Unfortunately, I believe it is not possible to achive this easily at the present moment. One could use two agents (one for each key) so that there is no agent holding every keys. But this would be pretty cumbersome to work with.

This is why a bug report (enhancement) has been opened. There is this similar report too.

share|improve this answer

In order to force ssh(1) to use a particular key even if ssh-agent(1) offers multiple ones, use the IdentityFile and IdentitiesOnly directive in ~/.ssh/config, e.g.:

Host example.com
    IdentityFile ~/.ssh/keys/special.pem
    IdentitiesOnly yes

See ssh_config(5) for details.

share|improve this answer
    
This does not work. IdentitiesOnly applies when you try to connect to the remote server. Once you're connected, if -A agent forwarding is enabled, the whole keyring is forwarded. –  Totor Apr 16 '13 at 20:21
    
The keyring is not forwarded out. It is the auth request that is forwarded in. –  bahamat Apr 17 '13 at 6:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.