Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have multiple private keys that I use to connect to various boxes. Mostly this is for AWS which has me import a key in order to connect to machines - I created a separate key set for this purpose. Instead of constantly doing:

ssh -i ~/.ssh/aws-key.pem ec2-user@aws.ip

What's the best way to add aws-key.pem to my "ssh keychain" so that it checks it by default for all SSH requests in addition to the existing "id_dsa" key?

share|improve this question
BTW, what is your primary client OS, that you are initiating your SSH connection from? – Zoredache May 31 '12 at 23:14
This is tough - both answers below are correct. which do I mark as the right answer? :-) – imaginative May 31 '12 at 23:28
Pick the answer that you think is more correct? Flip a coin? Accept 84104's answer because he could use the rep more. :) – Zoredache May 31 '12 at 23:43
up vote 8 down vote accepted

You have a couple choices.

Use the SSH agent. Simply use ssh-add for all your private keys and let your agent figure out which key to use. I generally prefer using an agent, and always start it when I login to my system, and I add all my keys. It makes everything easy.

Change your ssh configuration

# .ssh/config

# per host example
    User zoredache
    IdentityFile ~/.ssh/username_YYYYMMDD_id_rsa

# global example
Host *
    User zoredache
    IdentityFile ~/.ssh/key1_YYYYMMDD_id_rsa
    IdentityFile ~/.ssh/key2_YYYYMMDD_id_rsa
    IdentityFile ~/.ssh/keyn_YYYYMMDD_id_rsa
share|improve this answer

Use IdentityFile in ~/.ssh/config

If you only want it for a specific hosts, include it under the Host directive.

         Specifies a file from which the user's DSA, ECDSA or DSA authentication identity is read.  The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_dsa,
         ~/.ssh/id_ecdsa and ~/.ssh/id_rsa for protocol version 2.  Additionally, any identities represented by the authentication agent will be used for authentication.  ssh(1) will
         try to load certificate information from the filename obtained by appending to the path of a specified IdentityFile.

         The file name may use the tilde syntax to refer to a user's home directory or one of the following escape characters: ‘%d’ (local user's home directory), ‘%u’ (local user
         name), ‘%l’ (local host name), ‘%h’ (remote host name) or ‘%r’ (remote user name).

         It is possible to have multiple identity files specified in configuration files; all these identities will be tried in sequence.  Multiple IdentityFile directives will add
         to the list of identities tried (this behaviour differs from that of other configuration directives).
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.