I have two private ssh keys :

  • one to access my personnal machines,
  • one to access servers at my job.

I add those two keys to my ssh-agent with ssh-add.

Now, when I do ssh -A root@jobsrv I would like to forward agent authentication only for my job key (the one I'm using to connect jobsrv).

I want this because anyone having root access to jobsrv can use my agent to authenticate himself to my personnal machines.

Is there a way to achieve this isolation?

  • did you check the -i option in man page of ssh? Commented Mar 31, 2013 at 21:40
  • 1
    @Stillakid yes, ssh -A -i myjobkey_rsa root@jobsrv still allows the jobsrv machine to access my local machine agent and authenticate on my personnal server with the other (personnal) key...
    – Totor
    Commented Mar 31, 2013 at 22:02
  • also checked ssh-keysign? Commented Mar 31, 2013 at 22:45

2 Answers 2


In order to force ssh(1) to use a particular key even if ssh-agent(1) offers multiple ones, use the IdentityFile and IdentitiesOnly directive in ~/.ssh/config, e.g.:

Host example.com
    IdentityFile ~/.ssh/keys/special.pem
    IdentitiesOnly yes

See ssh_config(5) for details.

  • This does not work. IdentitiesOnly applies when you try to connect to the remote server. Once you're connected, if -A agent forwarding is enabled, the whole keyring is forwarded.
    – Totor
    Commented Apr 16, 2013 at 20:21
  • The keyring is not forwarded out. It is the auth request that is forwarded in.
    – bahamat
    Commented Apr 17, 2013 at 6:25
  • @bahamat Sure, my mistake. Still, this solution does not work.
    – Totor
    Commented May 19, 2016 at 17:14

Unfortunately, I believe it is not possible to achive this easily at the present moment. One could use two agents (one for each key) so that there is no agent holding every keys. But this would be pretty cumbersome to work with.

This is why a bug report (enhancement) has been opened. There is this similar report too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .