when I ssh to a server I can use a few options to specify which key is used, for example:

ssh -o identityfile=~/.ssh/cool -o identitiesonly=yes serverA

This prevents too many tries, which could end up denying one access to a server. but if I ssh to one server with forwardagent set. and then try to ssh to another server from there, it has to use the ssh-agent, which tries all the keys that it has until it finds the right one or is denied for having tried too many keys. Can I have the ssh-agent use a specific key in the ssh-agent?


It is not possible in OpenSSH. You should not store too many keys in your agent (why would anyone need more than 1 key? Only legitimate reason is when you are given key by someone else and you cant change it), especially not in the agent you wish to forward to remote hosts.

The agent is offering the keys in the order they were added so you might workaround it by adding the forwarded keys first, but it is the only thing you can do about that.

  • 3
    “You should not store too many keys in your agent” Eh? Why on earth? There's nothing wrong with having multiple keys, and it's quite common when you have access to accounts on different sites or with different privilege levels. – Gilles 'SO- stop being evil' Nov 1 '16 at 22:41
  • @Gilles Well ... of course you can store a lot of keys, but the agent protocol does not have any way to determine on what key to work if it is forwarded. – Jakuje Nov 2 '16 at 8:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.