1189

I am working with multiple SSH private keys to connect to different servers or services (e.g., system administration, Git usage) on the same machine. Currently, I am using the -i option like so:

Apparently a straightforward way to do this is to use the command

ssh -i <path_to_private_key> [email protected]

However, managing connections this way feels cumbersome, especially when switching between different keys for different servers.

Is there a more efficient way to manage and use multiple SSH private keys without specifying the -i flag each time? I am looking for a configuration or tool-based approach that allows me to streamline this process.

What I've tried: Stacking the keys in the id_rsa file, which didn't work. Manually specifying the private key file with the -i flag, but this approach isn't very scalable.

Desired outcome: I'd like to set up my SSH configuration so that the correct private key is automatically used for the corresponding server or service.

1
  • 8
    I wrote this article that goes in depth on various configurations and their strength/shortcomings.
    – Raffi
    Commented May 2, 2020 at 10:46

21 Answers 21

1614

From my .ssh/config:

Host myshortname realname.example.com
    HostName realname.example.com
    IdentityFile ~/.ssh/realname_rsa # private key for realname
    User remoteusername

Host myother realname2.example.org
    HostName realname2.example.org
    IdentityFile ~/.ssh/realname2_rsa  # different private key for realname2
    User remoteusername

Then you can use the following to connect:

ssh myshortname

ssh myother

And so on.

15
  • 7
    This was a great help (in addition to stackoverflow.com/a/3828682/169153). If you want to use putty keys follow this document here: blog.padraigkitterick.com/2007/09/16/…
    – Urda
    Commented Mar 14, 2012 at 23:14
  • 99
    Note that you can also specify multiple IdentityFile entries for the same Host, which are then tried in order when connecting.
    – sschuberth
    Commented Oct 2, 2013 at 9:28
  • 2
    Adding the comment # private key for realname can cause error garbage at end of line; "#". Commented May 18, 2015 at 9:17
  • 2
    This saved me a ton of hassle on my Windows box. Thanks! ssh-agent can suck it
    – Derek
    Commented Aug 23, 2015 at 1:59
  • 21
    Use IdentitiesOnly yes to prevent ~/.ssh/id_rsa or any other identities. (This was originally an edit) Commented Nov 2, 2015 at 17:30
614
+100

You can instruct ssh to try multiple keys in succession when connecting. Here's how:

$ cat ~/.ssh/config
IdentityFile ~/.ssh/id_rsa
IdentityFile ~/.ssh/id_rsa_old
IdentityFile ~/.ssh/id_ed25519
# ... and so on

$ ssh server.example.com -v
....
debug1: Next authentication method: publickey
debug1: Trying private key: /home/example/.ssh/id_rsa
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/example/.ssh/id_rsa_old
debug1: read PEM private key done: type RSA
....
[server ~]$

This way you don't have to specify what key works with which server. It'll just use the first working key.

Also you would only enter a passphrase if a given server is willing to accept the key. As seen above ssh didn't try to ask for a password for .ssh/id_rsa even if it had one.

Surely it doesn't outbeat a per-server configuration as in other answers, but at least you won't have to add a configuration for all and every server you connect to!

9
  • 21
    This is a fantastic solution for the question asked, but didn't quite meet the needs that the asker intended. For me, it was exactly the right solution and it perfectly meets the need for the "Best way to use multiple SSH private keys on one client".
    – Wade
    Commented Aug 8, 2016 at 17:28
  • 4
    This does not seem to work under the Host declaration in config file Commented Apr 12, 2017 at 13:17
  • 67
    This doesn't work well with git, as if you have two github deploy keys, the first one in the list is valid and will work, but then github will complain that the repository doesn't match.
    – Adam Reis
    Commented Sep 12, 2017 at 4:38
  • 3
    If the SFTP/target server has security policies that lock the account (say after 3 multiple failed connection attempts), would this not end up locking the account. A connection is attempted, but with a 'wrong key' file Commented Nov 2, 2018 at 18:07
  • 15
    Be aware if you have something like fail2ban on those servers. You might end up in one of those jails... because of the failed attempts generated by the other keys...
    – Piccolo
    Commented Apr 18, 2019 at 9:21
325

The previous answers have properly explained the way to create a configuration file to manage multiple ssh keys. I think, the important thing that also needs to be explained is the replacement of a host name with an alias name while cloning the repository.

Suppose, your company's GitHub account's username is abc1234. And suppose your personal GitHub account's username is jack1234

And, suppose you have created two RSA keys, namely id_rsa_company and id_rsa_personal. So, your configuration file will look like below:

# Company account
Host company
HostName github.com
PreferredAuthentications publickey
IdentityFile ~/.ssh/id_rsa_company

# Personal account
Host personal
HostName github.com
PreferredAuthentications publickey
IdentityFile ~/.ssh/id_rsa_personal

Now, when you are cloning the repository (named demo) from the company's GitHub account, the repository URL will be something like:

Repo URL: [email protected]:abc1234/demo.git

Now, while doing git clone, you should modify the above repository URL as:

git@company:abc1234/demo.git

Notice how github.com is now replaced with the alias "company" as we have defined in the configuration file.

Similary, you have to modify the clone URL of the repository in the personal account depending upon the alias provided in the configuration file.

10
  • 31
    I wish I could upvote this answer more than once... this is the correct way to approach the issue, and it's safer and faster than other options. More scalable too (allows for defining different keys for the same hostname)
    – Guy
    Commented Mar 28, 2018 at 8:03
  • 2
    Great explanation! Works perfect for me. And if you forgot to clone the repo with the alias you can often edit the remote url of origin afterwards.
    – tkahn
    Commented Jan 22, 2019 at 14:10
  • 2
    only pay attencion because config file must be (chmod 600) Commented Sep 5, 2019 at 15:00
  • 5
    It's not stated explicitly, but this works around a major gotcha when trying to use multiple keys with GitHub: since you always log into GitHub as the same user git, any key that's saved on any GitHub account will allow for SSH login. But after the SSH login GitHub will then check if the key used is authorized for the specific action you're trying (e.g. checking out a repo), and that will fail if you have the wrong key. But the SSH part succeeded, so SSH will not try another key. This solution works around that by introducing host name aliases. Brilliant!
    – ntc2
    Commented Jan 26, 2020 at 1:55
  • 12
    It's also worth mentioning that if you use ssh-agent, then you should also add the IdentitiesOnly yes option to you config, otherwise ssh-agent will attempt connecting to a given alias with a key for a different alias if their hostnames match. Commented Mar 2, 2020 at 8:13
277

The answer from Randal Schwartz almost helped me all the way. I have a different username on the server, so I had to add the User keyword to my file:

Host           friendly-name
HostName       long.and.cumbersome.server.name
IdentityFile   ~/.ssh/private_ssh_file
User           username-on-remote-machine

Now you can connect using the friendly-name:

ssh friendly-name

More keywords can be found on the OpenSSH man page. NOTE: Some of the keywords listed might already be present in your /etc/ssh/ssh_config file.

2
  • If I am not mistaken the user you usually specify directly in the url when connecting with user@host
    – a1an
    Commented Jun 18, 2013 at 11:07
  • 5
    I prefer to use the 'Port' keyword also. Another interesting keyword is 'StrictHostKeyChecking'.
    – Ethan
    Commented Sep 24, 2013 at 23:00
118
ssh-add ~/.ssh/xxx_id_rsa

Make sure you test it before adding with:

ssh -i ~/.ssh/xxx_id_rsa [email protected]

If you have any problems with errors sometimes changing the security of the file helps:

chmod 0600 ~/.ssh/xxx_id_rsa
7
  • 4
    This is the most succinct and elegant solution in my opinion. Worked like a charm!
    – artur
    Commented Oct 1, 2010 at 1:17
  • @Bobo can you put it in your bashrc or bash_profile (or whatever is the mac equivalent)?
    – T0xicCode
    Commented Mar 13, 2013 at 16:48
  • 6
    +1 for chmod 0600 - permissions issues were preventing me from connecting
    – amacy
    Commented May 16, 2013 at 4:31
  • Worked like a charm for me (and don't forget about 0600 perms). Commented May 30, 2013 at 16:47
  • 1
    Came from ubuntu on mac and this was exactly what I needed. Commented Apr 15, 2016 at 5:44
108
  1. Generate an SSH key:

     $ ssh-keygen -t rsa -C <[email protected]>
    
  2. Generate another SSH key:

     $ ssh-keygen -t rsa -f ~/.ssh/accountB -C <[email protected]>
    

    Now, two public keys (id_rsa.pub, accountB.pub) should be exists in the ~/.ssh/ directory.

     $ ls -l ~/.ssh     # see the files of '~/.ssh/' directory
    
  3. Create configuration file ~/.ssh/config with the following contents:

     $ nano ~/.ssh/config
    
     Host bitbucket.org
         User git
         Hostname bitbucket.org
         PreferredAuthentications publickey
         IdentityFile ~/.ssh/id_rsa
    
     Host bitbucket-accountB
         User git
         Hostname bitbucket.org
         PreferredAuthentications publickey
         IdentitiesOnly yes
         IdentityFile ~/.ssh/accountB
    
  4. Clone from default account.

     $ git clone [email protected]:username/project.git
    
  5. Clone from the accountB account.

     $ git clone git@bitbucket-accountB:username/project.git
    

Note: Because of the User git directive, you can omit the git@ portion of the repo URL, shortening your clone command like so:

    $ git clone bitbucket-accountB:username/project.git

This is the only purpose of that directive. If you don't need it (e.g. you always copy-paste the git clone command from the website), you can leave it out of the config.

See More Here

1
29

I would agree with Tuomas about using ssh-agent. I also wanted to add a second private key for work and this tutorial worked like a charm for me.

Steps are as below:

  1. $ ssh-agent bash
  2. $ ssh-add /path.to/private/key e.g ssh-add ~/.ssh/id_rsa
  3. Verify by $ ssh-add -l
  4. Test it with $ssh -v <host url> e.g ssh -v [email protected]
3
  • 4
    Having used ssh-agent for years, I've recently switched to using Gnome's gnome-keyring within my i3 wm. The reason is simple: Gnome's Keyring manager automagically handles adding and removing ssh keys without me having to remember to ssh-add. In addition providing me with a single password to unlock them (and timeout on a specified time, for security). To each his own. Since I use gnome settings on Arch, it was plug n play with my setup. If you are anti-gnome, ignore this comment.
    – eduncan911
    Commented May 26, 2015 at 17:01
  • @eduncan911, I agree that gnome-keyring can be helpful, but it doesn't really handle ed25519 keys, so that for me is a non-starter. Update: I see from wiki.archlinux.org/index.php/GNOME/… that it now uses the system's ssh-agent so that's no longer a problem. Commented Aug 20, 2018 at 18:03
  • ssh-agent bash starts subsession. Also you can just evaluate the output of ssh-agent -s like eval `ssh-agent -s` . After that use ssh-add
    – Piroxiljin
    Commented Mar 23, 2022 at 6:10
27

For me on MacOs, the only working solution was to simply add this in file ~/.ssh/config:

Host *
  IdentityFile ~/.ssh/your_ssh_key
  IdentityFile ~/.ssh/your_ssh_key2
  IdentityFile ~/.ssh/your_ssh_key3
  AddKeysToAgent yes

your_ssh_key is without any extension. Don't use .pub.

3
  • Works but loads says "load pubkey "path/.ssh/key": invalid format" Commented Jul 20, 2020 at 16:16
  • This is something that has working for me and it's –a little bit– similar to yours: $ eval "$(ssh-agent -s)" $ ssh-add ~/.ssh/{private_key} $ git clone git@{alias}:{github_user}/{repo}.git then on ~/.ssh/config Host github.com-{alias} HostName github.com PreferredAuthentications publickey IdentityFile ~/.ssh/{private_key} and on {repo}/.git/config [remote "origin"] url = [email protected]{alias}:{github_user}/{repo}.git fetch = +refs/heads/*:refs/remotes/origin/*. gist
    – vcamargo
    Commented Jan 13, 2021 at 19:33
  • great! works for me in mac os
    – Mukundhan
    Commented Nov 10, 2021 at 11:51
24

Now, with the recent version of Git, we can specify sshCommand in the repository-specific Git configuration file:

  [core]
      repositoryformatversion = 0
      filemode = true
      bare = false
      logallrefupdates = true
      sshCommand = ssh -i ~/.ssh/id_rsa_user
   [remote "origin"]
      url = [email protected]:user/repo.git
      fetch = +refs/heads/*:refs/remotes/origin/*
2
  • 5
    This is the most correct way to do it. If you don't want to fiddle in the file just run git config --local core.sshCommand "ssh -i ~/.ssh/your_other_rsa_file" in your git repository
    – Canis
    Commented Aug 3, 2021 at 20:02
  • Also consider this way as the most convenient one so far. Btw, @Canis, --local parameter is not really needed, it is default scope. Commented Sep 20, 2023 at 5:55
17

I had run into this issue a while back, when I had two Bitbucket accounts and wanted to had to store separate SSH keys for both. This is what worked for me.

I created two separate ssh configurations as follows.

Host personal.bitbucket.org
    HostName bitbucket.org
    User git
    IdentityFile /Users/username/.ssh/personal
Host work.bitbucket.org
    HostName bitbucket.org
    User git
    IdentityFile /Users/username/.ssh/work

Now when I had to clone a repository from my work account - the command was as follows.

git clone [email protected]:teamname/project.git

I had to modify this command to:

git clone git@**work**.bitbucket.org:teamname/project.git

Similarly the clone command from my personal account had to be modified to

git clone git@personal.bitbucket.org:name/personalproject.git

Refer this link for more information.

10

Here is the solution that I used inspired from the answer of sajib-khan. The default configuration is not set; it's my personal account on GitLab and the other specified is my company account. Here is what I did:

Generate the SSH key

ssh-keygen -t rsa -f ~/.ssh/company -C "[email protected]"

Edit the SSH configuration

nano ~/.ssh/config
    Host company.gitlab.com
    HostName gitlab.com
    PreferredAuthentications publickey
    IdentityFile ~/.ssh/company

Delete the cached SSH key(s)

ssh-add -D

Test it!

ssh -T [email protected]

Welcome to GitLab, @hugo.sohm!

ssh -T [email protected]

Welcome to GitLab, @HugoSohm!

Use it!

Company account

git clone [email protected]:group/project.git

Personal/default account

git clone [email protected]:username/project.git

Here is the source that I used.

7

Use ssh-agent for your keys.

1
3

You can create a configuration file named config in your ~/.ssh folder. It can contain:

Host aws
    HostName *yourip*
    User *youruser*
    IdentityFile *idFile*

This will allow you to connect to machines like this

 ssh aws
1
  • What form does idFile take? An absolute path. Can you provide an example Commented Jun 5, 2020 at 20:27
3

For those who are working with I would highly recommend working with EC2 Instance Connect.

Amazon EC2 Instance Connect provides a simple and secure way to connect to your instances using Secure Shell (SSH).

With EC2 Instance Connect, you use AWS Identity and Access Management (IAM) policies and principles to control SSH access to your instances, removing the need to share and manage SSH keys.

After installing the relevant packages (pip install ec2instanceconnectcli or cloning the repo directly) you can connect very easy to multiple EC2 instances by just changing the instance id:

enter image description here


What is happening behind the scenes?

When you connect to an instance using EC2 Instance Connect, the Instance Connect API pushes a one-time-use SSH public key to the instance metadata where it remains for 60 seconds. An IAM policy attached to your IAM user authorizes your IAM user to push the public key to the instance metadata.

The SSH daemon uses AuthorizedKeysCommand and AuthorizedKeysCommandUser, which are configured when Instance Connect is installed, to look up the public key from the instance metadata for authentication, and connects you to the instance.

(*) Amazon Linux 2 2.0.20190618 or later and Ubuntu 20.04 or later comes preconfigured with EC2 Instance Connect. For other supported Linux distributions, you must set up Instance Connect for every instance that will support using Instance Connect. This is a one-time requirement for each instance.


Links:

Set up EC2 Instance Connect
Connect using EC2 Instance Connect
Securing your bastion hosts with Amazon EC2 Instance Connect


3

On Ubuntu 18.04 (Bionic Beaver) there is nothing to do. Perhaps the same holds for newer version of Ubuntu or Debian systems.

After having created an second SSH key successfully the system will try to find a matching SSH key for each connection.

Just to be clear you can create a new key with these commands:

# Generate key make sure you give it a new name (id_rsa_server2)
ssh-keygen

# Make sure ssh agent is running
eval `ssh-agent`

# Add the new key
ssh-add ~/.ssh/id_rsa_server2

# Get the public key to add it to a remote system for authentication
cat ~/.ssh/id_rsa_server2.pub
2

As mentioned on a Atlassian blog page, generate a config file within the .ssh folder, including the following text:

#user1 account
 Host bitbucket.org-user1
     HostName bitbucket.org
     User git
     IdentityFile ~/.ssh/user1
     IdentitiesOnly yes

 #user2 account
 Host bitbucket.org-user2
     HostName bitbucket.org
     User git
     IdentityFile ~/.ssh/user2
     IdentitiesOnly yes

Then you can simply checkout with the suffix domain and within the projects you can configure the author names, etc. locally.

1
  • I used the same for GitHub without the IdentitiesOnly yes lines. It works. Commented May 16, 2021 at 13:55
2

Multiple key pairs on GitHub

1.0 SSH configuration file

1.1 Create ~/.ssh/config

1.2 chmod 600 ~/.ssh/config (must)

1.3 Input the following into the file:

Host pizza

HostName github.com

PreferredAuthentications publickey # optional

IdentityFile ~/.ssh/privatekey1

Case A: Fresh new Git clone

Use this command to Git clone:

$ git clone git@pizza:yourgitusername/pizzahut_repo.git

Note: If you want to change the host name “pizza” of .ssh/config in the future, go into the Git cloned folder, edit .git/config file URL line (see case B)

Case B: Already have Git clone folder

2.1 Go to the cloned folder, and then go into the .git folder

2.2 Edit configuration file

2.3 Update the URL from *old to new:

(Old) URL = [email protected]:yourgitusername/pizzahut_repo.git

(New) URL = git@pizza:yourgitusername/pizzahut_repo.git

0
1

IMPORTANT: You must start ssh-agent

You must start ssh-agent (if it is not running already) before using ssh-add as follows:

eval `ssh-agent -s` # start the agent

ssh-add id_rsa_2 # Where id_rsa_2 is your new private key file

Note that the eval command starts the agent on Git Bash on Windows. Other environments may use a variant to start the SSH agent.

1

I love the approach to set the following in file ~/.ssh/config:

# Configuration for GitHub to support multiple GitHub  keys
Host  github.com
  HostName github.com
  User git

# UseKeychain adds each keys passphrase to the keychain so you
# don't have to enter the passphrase each time.
  UseKeychain yes

# AddKeysToAgent would add the key to the agent whenever it is
# used, which might lead to debugging confusion since then
# sometimes the one repository works and sometimes the
# other depending on which key is used first.
#  AddKeysToAgent yes

# I only use my private id file so all private
# repositories don't need the environment variable
# `GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa"` to be set.
  IdentityFile ~/.ssh/id_rsa

Then in your repository you can create a .env file which contains the ssh command to be used:

GIT_SSH_COMMAND="ssh -i ~/.ssh/your_ssh_key"

If you then use e.g. dotenv the environment environment variable is exported automatically and whoop whoop, you can specify the key you want per project/directory. The passphrase is asked for only once since it is added to the keychain.

This solution works perfectly with Git and is designed to work on a Mac (due to UseKeychain).

1
  • 1
    Works on windows as well. OpenSSH! Commented Jan 12, 2021 at 19:31
0

On CentOS 6.5 running OpenSSH_5.3p1 and OpenSSL 1.0.1e-fips, I solved the problem by renaming my key files so that none of them had the default name.

My .ssh directory contains id_rsa_foo and id_rsa_bar, but no id_rsa, etc.

3
  • 1
    And how does the keys get used? Is there any auto-detection?
    – robsch
    Commented May 22, 2017 at 6:44
  • See Randal Schwartz's answer for a way to select the correct key for a given host stackoverflow.com/questions/2419566/… Commented May 23, 2017 at 16:35
  • Yes, that makes it more explicit. Even using the -i option might result in something like no such identity: /home/embo/.ssh/id_rsa: No such file or directory. Commented Jun 5, 2020 at 20:41
-1

You can try this sshmulti npm package for maintaining multiple SSH keys.

1
  • 1
    I'd strongly recommend not using npm for anything like this. It had a cascade of dependencies, which, on brief inspection, include a range of lone-wolf developers, several year old packages. The sshmulti npm page itself declares that it is untested.
    – Jack Wasey
    Commented May 2, 2020 at 10:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.