I am having trouble logging in to one of my machine using public key authentication, so I want to debug the problem. I have a complex ssh config file, that I want to ignore for the time being until I find the problem. So I am specifying everything on the command line:

ssh -F /dev/null -vvv -i ~/.ssh/mykey -p 12345 myuser@mymachine

But ssh keeps on offering lots of public key files (all of them failing) instead of simply offering the one I force in the command line.

It actually offers all keys that I have in my ~/.ssh directory. It starts offering the one I am forcing, but that fails (I do not yet know why), and then it keeps on offering the rest of pubkeys in the ~/.ssh directory.

Why is that? I would expect that after mykey fails, it should stop trying.

  • What type of key is that? Do you have other keys in ssh-agent? Does IdentitiesOnly=yes option fix it? – Jakuje Feb 14 '17 at 7:49
  • @Jakuje It is an RSA key, but that is not the point: why is it even offering other keys? I am explicitly telling the ssh client to use only mykey. – dangonfast Feb 14 '17 at 7:54

OpenSSH is offering default identities and the identities loaded in the ssh-agent by default (which is usually the thing you want). If you want to prevent this behavior, there is option IdentitiesOnly:


Specifies that ssh(1) should only use the authentication identity and certificate files explicitly configured in the ssh_config files or passed on the ssh(1) command-line, even if ssh-agent(1) or a PKCS11Provider offers more identities. The argument to this keyword must be yes or no (the default). This option is intended for situations where ssh-agent offers many different identities.

  • Thanks, that seems to do the trick. I do not know what is ssh-agent, and why that is used by the ssh client, but it seems to work as you mention. I was under the impression that key selection was done by the ssh client itself, but it seems it is delegating some decisions to other tools. Seems complicated, no idea why this is the case. Are there other tools involved in ssh interactions, apart from the ssh client and ssh-agent? – dangonfast Feb 14 '17 at 8:04
  • No. It is not complicated. Nothing more and nothing less is going on there. – Jakuje Feb 14 '17 at 8:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.