Best way to use multiple SSH private keys on one c

问题:

I want to use multiple private keys to connect to different servers or different portions of the same server (my uses are system administration of server, administration of Git, and normal Git usage within the same server). I tried simply stacking the keys in the id_rsa files to no avail.

Apparently a straightforward way to do this is to use the command

ssh -i <key location> [e-mail] 

That is quite cumbersome.

Any suggestions as to how to go about doing this a bit easier?

回答1:

From my .ssh/config:

Host myshortname realname.example.com
    HostName realname.example.com
    IdentityFile ~/.ssh/realname_rsa # private key for realname
    User remoteusername

Host myother realname2.example.org
    HostName realname2.example.org
    IdentityFile ~/.ssh/realname2_rsa  # different private key for realname2
    User remoteusername

And so on.

回答2:

The answer from Randal Schwartz almost helped me all the way. I have a different username on the server, so I had to add the User keyword to my file:

Host           friendly-name
HostName       long.and.cumbersome.server.name
IdentityFile   ~/.ssh/private_ssh_file
User           username-on-remote-machine

Now you can connect using the friendly-name:

ssh friendly-name

More keywords can be found on the OpenSSH man page. NOTE: Some of the keywords listed might already be present in your /etc/ssh/ssh_config file.

回答3:

You can instruct ssh to try multiple keys in succession when connecting. Here\'s how:

$ cat ~/.ssh/config
IdentityFile ~/.ssh/id_rsa
IdentityFile ~/.ssh/id_rsa_old
IdentityFile ~/.ssh/id_ed25519
# ... and so on

$ ssh server.example.com -v
....
debug1: Next authentication method: publickey
debug1: Trying private key: /home/example/.ssh/id_rsa
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/example/.ssh/id_rsa_old
debug1: read PEM private key done: type RSA
....
[server ~]$

This way you don\'t have to specify what key works with which server. It\'ll just use the first working key.

Also you would only enter a passphrase if a given server is willing to accept the key. As seen above ssh didn\'t try to ask for a password for .ssh/id_rsa even if it had one.

Surely it doesn\'t outbeat a per-server configuration as in other answers, but at least you won\'t have to add a configuration for all and every server you connect to!

回答4:

foo:~$ssh-add ~/.ssh/xxx_id_rsa

Make sure you test it before adding with:

ssh -i ~/.ssh/xxx_id_rsa [e-mail]

If you have any problems with errors sometimes changing the security of the file helps:

chmod 0600 ~/.ssh/xxx_id_rsa

回答5:

The previous answers have properly explained the way to create a configuration file to manage multiple ssh keys. I think, the important thing that also needs to be explained is the replacement of a host name with an alias name while cloning the repository.

Suppose, your company\'s GitHub account\'s username is abc1234. And suppose your personal GitHub account\'s username is jack1234

And, suppose you have created two RSA keys, namely id_rsa_company and id_rsa_personal. So, your configuration file will look like below:

# Company account
Host company
HostName github.com
PreferredAuthentications publickey
IdentityFile ~/.ssh/id_rsa_company

# Personal account
Host personal
HostName github.com
PreferredAuthentications publickey
IdentityFile ~/.ssh/id_rsa_personal

Now, when you are cloning the repository (named demo) from the company\'s GitHub account, the repository URL will be something like:

Repo URL: [e-mail]:abc1234/demo.git

Now, while doing git clone, you should modify the above repository URL as:

git@company:abc1234/demo.git

Notice how github.com is now replaced with the alias \"company\" as we have defined in the configuration file.

Similary, you have to modify the clone URL of the repository in the personal account depending upon the alias provided in the configuration file.

回答6:

I would agree with Tuomas about using ssh-agent. I also wanted to add a second private key for work and this tutorial worked like a charm for me.

Steps are as below:

1. $ ssh-agent bash
2. $ ssh-add /path.to/private/key e.g ssh-add ~/.ssh/id_rsa
3. Verify by $ ssh-add -l
4. Test it with $ssh -v <host url> e.g ssh -v [e-mail]

回答7:

1. Generate SSH key:

   $ ssh-keygen -t rsa -C <[e-mail]>
   

2. Generate another SSH key:

   $ ssh-keygen -t rsa -f ~/.ssh/accountB -C <[e-mail]>
   

   Now, two public keys (id_rsa.pub, accountB.pub) should be exists in the ~/.ssh/ directory.

   $ ls -l ~/.ssh     # see the files of \'~/.ssh/\' directory 
   

3. Create config file ~/.ssh/config with the following contents:

   $ nano ~/.ssh/config
   
   Host bitbucket.org  
       User git  
       Hostname bitbucket.org
       PreferredAuthentications publickey  
       IdentityFile ~/.ssh/id_rsa  
   
   Host bitbucket-accountB  
       User git  
       Hostname bitbucket.org  
       PreferredAuthentications publickey  
       IdentitiesOnly yes  
       IdentityFile ~/.ssh/accountB  
   

4. Clone from default account.

   $ git clone [e-mail]:username/project.git
   

5. Clone from accountB account.

   $ git clone git@bitbucket-accountB:username/project.git
   

See More Here

回答8:

Use ssh-agent for your keys.

回答9:

I had run into this issue a while back, when I had two Bitbucket accounts and wanted to had to store separate SSH keys for both. This is what worked for me.

I created two separate ssh configurations as follows.

Host personal.bitbucket.org
    HostName bitbucket.org
    User git
    IdentityFile /Users/username/.ssh/personal
Host work.bitbucket.org
    HostName bitbucket.org
    User git
    IdentityFile /Users/username/.ssh/work

Now when I had to clone a repository from my work account - the command was as follows.

git clone [e-mail]:teamname/project.git

I had to modify this command to:

git clone git@**work**.bitbucket.org:teamname/project.git

Similarly the clone command from my personal account had to be modified to

git clone [e-mail]:name/personalproject.git

Refer this link for more information.

回答10:

Now, with recent version of git, we can specify sshCommand in repository specific git config file.

  [core]
      repositoryformatversion = 0
      filemode = true
      bare = false
      logallrefupdates = true
      sshCommand = ssh -i ~/.ssh/id_rsa_user   
   [remote \"origin\"]
      url = [e-mail]:user/repo.git
      fetch = +refs/heads/*:refs/remotes/origin/*

回答11:

IMPORTANT: You must start ssh-agent

You must start ssh-agent (if it is not running already) before using ssh-add as follows:

eval `ssh-agent -s` # start the agent

ssh-add id_rsa_2 # where id_rsa_2 is your new private key file

Note that the eval command starts the agent on GIT bash on windows. Other environments may use a variant to start the SSH agent.

回答12:

You can create a configuration file named config in your ~/.ssh folder. It can contain:

Host aws
    HostName *yourip*
    User *youruser*
    IdentityFile *idFile*

This will allow you to connect to machines like this

 ssh aws

回答13:

On Centos 6.5 running OpenSSH_5.3p1, OpenSSL 1.0.1e-fips, I solved the problem by renaming my key files so that none of them had the default name. My .ssh directory contains id_rsa_foo and id_rsa_bar but no id_rsa, etc.