I was trying to debug an ssh problem Too many authentication failures, and find with ssh -vv that ssh is presenting lots of keys before falling back to try a password.

On investigation I find that these keys are added somehow with ssh-agent running from startx when X11 is started.

I have a lot of keys in my ~/.ssh directory for different machines, transferred through many system updates over the years. I had not even realized that ssh-agent was running.

I thought that ssh-add, per the manpage, would add by default just id_dsa, id_rsa and identity. But somehow it is adding BillBrewer.pub, JanStewer.pub, PeterGurney.pub, PeterDavy.pub, DanlWhiddon, HarryHawke.pub, OldUncleTomCobley.pub as well, and presenting the whole lot on every login session when I expect to give a password. So sshd on the server decides that enough is enough and disconnects.

How can I control this behaviour ? Apart from removing my extra public keys from my .ssh directory and just keeping the private ones I need, but that's always been a convenient place to keep them in the past.

For that matter, how can I stop ssh-agent running if I want to ?

Is this a security issue ( sending keys to servers that are not supposed to get them) ?

I realize that I can override it on a per-session basis with -o PreferredAuthentications=password but I'd prefer a systemic fix.

  • more strangeness: I tried using ssh-add -D to remove all identities, or ssh-add -d *.pub, but when I use ssh-add -l, they are all still there.

CentOS release 6.5, OpenSSH_5.3p1, openssh-clients-5.3p1

1 Answer 1


Well first off, keys are supposed to identify the client, not the remote server. Thus you should only have a very small number of keys (such as 1).

The official ssh-agent utility itself will only look for a few predefined names when looking for your keys (~/.ssh/id_rsa ~/.ssh/id_dsa ~/.ssh/id_ecdsa and ~/.ssh/identity).
However there are other ssh key agents other than ssh-agent. You likely have a keyring daemon running (such as gnome-keyring-daemon). The keyring daemon is likely started by your desktop environment by default. Go poking around in your desktop environment session settings to turn it off.

You can also put IdentitiesOnly=yes in your ~/.ssh/config file, but I wouldn't consider this the "right" answer.

In regards to sending extra keys to the server. No, this is not any sort of security risk.

  • Just found q72644 and thence dtek blog. Apr 7, 2014 at 5:33
  • Thanks @Patrick. Can't keep editing the above comment it seems. Yes, gnome-keyring is running and seems to add all keys without asking. Killing it fixes my problem. Apr 7, 2014 at 5:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.