2

Background

I use a 4096-bit RSA key-pair for authorizing access to my server. By ssh_config files I am referring to ~/.ssh/config and /etc/ssh/ssh_config.

Here's what my ~/.ssh/config looks like:

Host gg-root
    HostName 172.47.95.122

Host ss-root
    HostName 172.47.95.123

# Common for my servers
Host gg-root ss-root
    User root
    Port 32001
    IdentitiesOnly yes
    IdentityFile ~/.ssh/id_rsa_bull

# Common for all
Host *
    AddKeysToAgent yes

Now, I can simply connect to my server via SSH with the following (without any further configuration):

ssh gg-root
ssh ss-root

Thing is, I need to add the private key ~/.ssh/id_rsa_bull to the system's SSH agent to make it easily available to other apps like FileZilla which I use for SFTP. (Esp. because I don't like that FileZilla needs an unencrypted private key as .ppk.)

So, I either run this command each time:

ssh-add ~/.ssh/id_rsa_pepper

Or have this in my ~/.profile:

ssh-add ~/.ssh/id_rsa_pepper > /dev/null 2>&1

Question

When I add the key to the system's SSH agent using ssh-add, does it honor the declarations I've made in ssh_config file(s)? Specifically, does it make sure that ~/.ssh/id_rsa_pepper is only used for 172.47.95.{122,123}?

Based on how I interpreted what I read, I believe it should. If I am wrong, please enlighten me as to how I should go about adding a private key to the system's SSH agent where the said private key is only used for stated hosts?


EDIT: Based on Answer

This is what my ~/.ssh/config looks like now:

Host gg-root
    HostName 172.47.95.122

Host ss-root
    HostName 172.47.95.123

# Common for my servers
Host gg-root ss-root
    User root
    Port 32001
    IdentityFile ~/.ssh/id_rsa_bull

# Common for all
Host *
    AddKeysToAgent yes
    IdentitiesOnly yes
  • I must be missing something. Why would it matter if it tries to use that key on other servers? It won’t work, so it will go on to the next key, right? – Wildcard Sep 11 '19 at 9:06
  • @Wildcard So as not to trigger fail2ban & other security mechanisms (because they are considered login attempts). Also because that's not optimal. – its_me Sep 11 '19 at 11:02
2

ssh-add does not honour the configuration file. It just adds the key to the agent.

The ssh client would try to use the key ~/.ssh/id_rsa_bull when connecting to either of gg-root or ss-root (due to the IdentityFile configuration). If that key is available in the agent, then it will be used from there, otherwise the key will be used from file (and a password may have to be provided if the key has one associated with it).

The keys in the agent would also be used when connecting to any other host not configured with a specific IdentityFile in ~/.ssh/config. This means that the configuration restricts the keys used for authenticating with particular hosts, but the shown configuration does not stop the "bull key" from being used with other hosts.

| improve this answer | |
  • So, that means it would be a good idea to add IdentitiesOnly yes under Host * so that key files aren't used unless IdentityFile is specifically declared. That means, in other cases, SSH/SSH agent will look for normal password authentication. Am I getting this right? – its_me Sep 11 '19 at 7:04
  • @its_me Ah, yes, that is correct. And that should probably go last in the the configuration file. – Kusalananda Sep 11 '19 at 7:06
  • Just came across this, and it seems to negate my understanding? unix.stackexchange.com/a/72677/9610 – its_me Sep 11 '19 at 10:55
  • @its_me The user that wrote the accepted answer there does not seem to know about IdentitiesOnly. The other answerer does. Note also that that question is regarding the identities that are provided through agent forwarding to the remote host (a slightly different question from yours). – Kusalananda Sep 11 '19 at 10:58
  • Same as what you said, but note to self: stackoverflow.com/a/36363402 – its_me Sep 12 '19 at 1:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.