Does ssh autoload everything in `.ssh`?

Question

According to the following post, it seems when you ssh into a box, by default it will load all keys (public and private) in ~/.ssh for authenticating on the server I am connecting to.

Is this true? Or do you have to configure your ~/.ssh/config file and map IdentifyFiles to servers?

I am trying to understand how authentication works with multiple private keys on your local machine.

Answer 1

I assume you mean you want to use multiple private keys on a client, not on a server. By default, the ssh client loads:

for protocol version 1

~/.ssh/identity 

for protocol version 2:

~/.ssh/id_dsa
~/.ssh/id_ecdsa
~/.ssh/id_ed25519
~/.ssh/id_rsa 

It will try all those keys (until the first succeeds).

If you want to add other keys you have two options:

1. add a per host selection via ~/.ssh/config

You have already mentioned this, so I assume you are familiar with it. In short it looks like this:

Host host1
    HostName host1.example.com
    IdentityFile ~/.ssh/id_rsa_host1

Host host2
    HostName host2.example.com
    IdentityFile ~/.ssh/id_rsa_host2

2. use the ssh-agent

Configure the ssh-agent (lots of docs on google, eg. http://mah.everybody.org/docs/ssh ), it comes by default with OpenSSH. You can add via

ssh-add -i $KEY_FILE

each private key.

3. do it manually

start the ssh client with the -i option to select which key you want to use.

ssh -i $KEY_FILE

I would suggest to use option 2 (ssh-agent), it gives you several benefits in addition, but it all depends on what your situation is.

Answer 2

According to the manual:

 ~/.ssh/identity
 ~/.ssh/id_dsa
 ~/.ssh/id_ecdsa
 ~/.ssh/id_ed25519
 ~/.ssh/id_rsa
         Contains the private key for authentication.  These files contain
         sensitive data and should be readable by the user but not acces‐
         sible by others (read/write/execute).  ssh will simply ignore a
         private key file if it is accessible by others.  It is possible
         to specify a passphrase when generating the key which will be
         used to encrypt the sensitive part of this file using 3DES.

So yes, ssh will load all these keys. If you have a server to which you need a specific key to connect, you should indeed configure that host in ~/.ssh/config

Note that it is not needed to have more than one key pair. Your public key is public and can safely be appended to the ~/.ssh/authorized_keys file in all the servers you connect to. Nobody can do anything with it without your private key.

The only situation where you may need a different key for one server is if you don't have access to your authorized_keys file (because it's an sftp or scp or rsync only server) and you want to reuse your already configured key pair.