manage many ssh keys via ssh-agent

Question

I use keepassxc (my password manager) to manage my ssh keys. This means the keys are stored within the database (not stored on disk in a traditional way). When I unlock my password database, all keys are added to the agent. However, with a growing list of ssh keys, I get the problem that ssh tries all the keys in the agent, which results in Too many authentication failures if the remote host allows less authentication tries than i have ssh keys (and the particulary ssh key is far back in the list).

Is there a way to tell ssh: "for this host, use the key with fingerprint xyz, fetch it from the agent"? Alternatively pubkey xyz, but I can't use the IdentityFile option (and IdentitiesOnly yes), since I don't want to store my private keys on disk.

Answer 1

but I can't use the IdentityFile option (and IdentitiesOnly yes), since I don't want to store my private keys on disk.

You can. Store the corresponding public key(s) on disk. Use IdentitiesOnly yes and the IdentityFile option and point to the right public key. This solution is not explicitly explained in man 5 ssh_config where it describes IdentityFile, nevertheless it should work. It is mentioned in man 1 ssh where it describes -i [emphasis mine]:

-i identity_file
Selects a file from which the identity (private key) for public key authentication is read. You can also specify a public key file to use the corresponding private key that is loaded in ssh-agent(1) when the private key file is not present locally.