I was previously able to connect to my a server with ssh agent forwarding:

ssh -A my.server

And from there connect to another host on the server's network that had my public key in the authorized_keys file:

server:~# ssh another.host

This worked fine until I created a public/private key pair on the server, ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub

Now when I try and connect I get: Permission denied (publickey).

I believe what's happening is that the server's key ~/.ssh/id_rsa is being attempted and failing before the forwarded agent's key is being attempted.

There's probably way to turn up the number of allowed attempts on my.server, but I was hoping there would be another configuration option to prioritize trying the key that is forwarded from the agent - similar to how IdentitiesOnly IdentityFile can be used to control which keys are tried for a particular server - or an option to disable the default ~/.ssh/id_rsa key from being attempted for a particular host - without having to rename it and specify it for all other hosts ( allowing it to remain a real default )

Also, I don't want to add the public key from my.server to another.host - I only want that connection to happen when I'm logged into my.server with agent forwarding.


It is a little bit more complicated than that. The client offers all keys that are available and after several of them fails, it fails completely.

You can see that from the verbose log if you add -vvv to the command line. Using -o IdentitiesOnly=yes can help.

Also it can help to reduce the amount of the keys you have in your local ssh-agent.

The last thing I can think of is to move that id_rsa from default location (client is reading the files in default location always and it can't be turned off) and configure in ~/.ssh/config that it will be used on the hosts where you need it only.

  • Thanks! How can I check to see what keys are available via forwarding? – cwd Apr 4 '17 at 17:16
  • ssh-add -l and ssh-add -L will list all the keys in the agent. All of them are used in the listed order. – Jakuje Apr 4 '17 at 17:17
  • After I ssh into my.server both of those give me The agent has no identities. which I don't think it accurate... – cwd Apr 4 '17 at 17:23
  • So in that case, the problem will be somewhere else (the keys are most probably not added to the agent and used directly from ssh in the first connection). – Jakuje Apr 4 '17 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.