2

I have multiple private keys that I use to connect to various boxes. Mostly this is for AWS which has me import a key in order to connect to machines - I created a separate key set for this purpose. Instead of constantly doing:

ssh -i ~/.ssh/aws-key.pem [email protected]

What's the best way to add aws-key.pem to my "ssh keychain" so that it checks it by default for all SSH requests in addition to the existing "id_dsa" key?

3
  • BTW, what is your primary client OS, that you are initiating your SSH connection from?
    – Zoredache
    May 31, 2012 at 23:14
  • This is tough - both answers below are correct. which do I mark as the right answer? :-) May 31, 2012 at 23:28
  • Pick the answer that you think is more correct? Flip a coin? Accept 84104's answer because he could use the rep more. :)
    – Zoredache
    May 31, 2012 at 23:43

2 Answers 2

8

You have a couple choices.

Use the SSH agent. Simply use ssh-add for all your private keys and let your agent figure out which key to use. I generally prefer using an agent, and always start it when I login to my system, and I add all my keys. It makes everything easy.

Change your ssh configuration

# .ssh/config

# per host example
Host blah.example.com
    User zoredache
    IdentityFile ~/.ssh/username_YYYYMMDD_id_rsa

# global example
Host *
    User zoredache
    IdentityFile ~/.ssh/key1_YYYYMMDD_id_rsa
    IdentityFile ~/.ssh/key2_YYYYMMDD_id_rsa
    IdentityFile ~/.ssh/keyn_YYYYMMDD_id_rsa
5

Use IdentityFile in ~/.ssh/config

If you only want it for a specific hosts, include it under the Host directive.

     IdentityFile
         Specifies a file from which the user's DSA, ECDSA or DSA authentication identity is read.  The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_dsa,
         ~/.ssh/id_ecdsa and ~/.ssh/id_rsa for protocol version 2.  Additionally, any identities represented by the authentication agent will be used for authentication.  ssh(1) will
         try to load certificate information from the filename obtained by appending -cert.pub to the path of a specified IdentityFile.

         The file name may use the tilde syntax to refer to a user's home directory or one of the following escape characters: ‘%d’ (local user's home directory), ‘%u’ (local user
         name), ‘%l’ (local host name), ‘%h’ (remote host name) or ‘%r’ (remote user name).

         It is possible to have multiple identity files specified in configuration files; all these identities will be tried in sequence.  Multiple IdentityFile directives will add
         to the list of identities tried (this behaviour differs from that of other configuration directives).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .