10

I have two private ssh keys :

  • one to access my personnal machines,
  • one to access servers at my job.

I add those two keys to my ssh-agent with ssh-add.

Now, when I do ssh -A root@jobsrv I would like to forward agent authentication only for my job key (the one I'm using to connect jobsrv).

I want this because anyone having root access to jobsrv can use my agent to authenticate himself to my personnal machines.

Is there a way to achieve this isolation?

Improve this question
3
  • did you check the -i option in man page of ssh? – A human being Mar 31 '13 at 21:40
  • 1
    @Stillakid yes, ssh -A -i myjobkey_rsa root@jobsrv still allows the jobsrv machine to access my local machine agent and authenticate on my personnal server with the other (personnal) key... – Totor Mar 31 '13 at 22:02
  • also checked ssh-keysign? – A human being Mar 31 '13 at 22:45
2

In order to force ssh(1) to use a particular key even if ssh-agent(1) offers multiple ones, use the IdentityFile and IdentitiesOnly directive in ~/.ssh/config, e.g.:

Host example.com
    IdentityFile ~/.ssh/keys/special.pem
    IdentitiesOnly yes

See ssh_config(5) for details.

Improve this answer
3
  • This does not work. IdentitiesOnly applies when you try to connect to the remote server. Once you're connected, if -A agent forwarding is enabled, the whole keyring is forwarded. – Totor Apr 16 '13 at 20:21
  • The keyring is not forwarded out. It is the auth request that is forwarded in. – bahamat Apr 17 '13 at 6:25
  • @bahamat Sure, my mistake. Still, this solution does not work. – Totor May 19 '16 at 17:14
2

Unfortunately, I believe it is not possible to achive this easily at the present moment. One could use two agents (one for each key) so that there is no agent holding every keys. But this would be pretty cumbersome to work with.

This is why a bug report (enhancement) has been opened. There is this similar report too.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.