5

Edit: There's a bug report for this, doing the equivalent of this answer.

I'm trying to script the copying of public keys to multiple machines. ssh-copy-id checks whether it can log in with the current configuration before copying, but unfortunately this includes any IdentityFile entries in ~/.ssh/config. I would like to completely ignore ~/.ssh/config; is there some way to do that, or to force ssh-copy-id to always add the key? This does not work:

ssh-add "$old_key"
ssh-copy-id -i "$new_key" -o "IdentityFile $new_key" "$login"

This is similar to, but distinct from How can I make ssh ignore .ssh/config?.

  • 2
    ssh-copy-id is itself a shell script. You can try editing it. – muru Feb 11 '15 at 10:14
6

After checking the code of ssh-copy-id, it turns out this hack works:

SSH_OPTS='-F /dev/null' ssh-copy-id [...]

Would still be interested in a solution that only relies on documented features, though.

  • If there is such a feature, would you not have encountered it while checking the code ;-) – Anthon Feb 11 '15 at 10:28
  • I guess you could consider my answer a hint that this should be a supported feature :) – l0b0 Feb 11 '15 at 13:06
  • File a wishlist bug? – Faheem Mitha Feb 11 '15 at 15:00
  • @FaheemMitha I'd be happy to, but I have no idea where it's maintained. There's bug reports all over the place, and no reference in the file itself. Any idea? – l0b0 Feb 11 '15 at 18:29
  • 1
    ssh-copy-id is part of OpenSSH, which is is maintained by the OpenBSD people. Looks like they use Bugzilla. See openssh.com/report.html. Some copy-id bugs have been reported recently. See bugzilla.mindrot.org/… – Faheem Mitha Feb 11 '15 at 21:00
2

The use of SSH_OPTS may not be future-proof (I think that the script should reset it at the beginning for security reasons: the behavior shouldn't depend on unspecified environment variables, which may have not been cleaned up in some cases). What you could do (possibly via a shell function):

env PATH="/path/to/special_dir:$PATH" ssh-copy-id [...]

where /path/to/special_dir just contains a ssh script, which can execute the real ssh with -F /dev/null. This is a bit ugly, but I don't think that there is any clean way with the current ssh-copy-id script.

  • This relies on ssh-copy-id using PATH to resolve ssh, which may also change (Unlikely, but still). +1 for a clever hack. – l0b0 Feb 11 '15 at 13:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.