Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I have two private ssh keys :
I add those two keys to my ssh-agent with ssh-add.
Now, when I do ssh -A root@jobsrv I would like to forward agent authentication only for my job key (the one I'm using to connect jobsrv).
I want this because anyone having root access to jobsrv can use my agent to authenticate himself to my personnal machines.
Is there a way to achieve this isolation?
In order to force ssh(1) to use a particular key even if ssh-agent(1) offers multiple ones, use the IdentityFile and IdentitiesOnly directive in ~/.ssh/config, e.g.:
Host example.com
IdentityFile ~/.ssh/keys/special.pem
IdentitiesOnly yes
See ssh_config(5) for details.
IdentitiesOnly applies when you try to connect to the remote server. Once you're connected, if -A agent forwarding is enabled, the whole keyring is forwarded.
Unfortunately, I believe it is not possible to achive this easily at the present moment. One could use two agents (one for each key) so that there is no agent holding every keys. But this would be pretty cumbersome to work with.
This is why a bug report (enhancement) has been opened. There is this similar report too.
ssh -A -i myjobkey_rsa root@jobsrvstill allows the jobsrv machine to access my local machine agent and authenticate on my personnal server with the other (personnal) key...