How to force ssh-copy-id to ignore existing authorized keys?

Question

Edit: There's a bug report for this, doing the equivalent of this answer.

I'm trying to script the copying of public keys to multiple machines. ssh-copy-id checks whether it can log in with the current configuration before copying, but unfortunately this includes any IdentityFile entries in ~/.ssh/config. I would like to completely ignore ~/.ssh/config; is there some way to do that, or to force ssh-copy-id to always add the key? This does not work:

ssh-add "$old_key"
ssh-copy-id -i "$new_key" -o "IdentityFile $new_key" "$login"

This is similar to, but distinct from How can I make ssh ignore .ssh/config?.

Answer 1

After checking the code of ssh-copy-id, it turns out this hack works:

SSH_OPTS='-F /dev/null' ssh-copy-id [...]

Would still be interested in a solution that only relies on documented features, though.

Answer 2

The use of SSH_OPTS may not be future-proof (I think that the script should reset it at the beginning for security reasons: the behavior shouldn't depend on unspecified environment variables, which may have not been cleaned up in some cases). What you could do (possibly via a shell function):

env PATH="/path/to/special_dir:$PATH" ssh-copy-id [...]

where /path/to/special_dir just contains a ssh script, which can execute the real ssh with -F /dev/null. This is a bit ugly, but I don't think that there is any clean way with the current ssh-copy-id script.