Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I store 2 different private SSH keys for the same host? I have tried 2 entries in /etc/ssh/ssh_config for the same host with the different keys, and I've also tried to put both keys in the same file and referencing it from one hosts setting, however both do not work.

More detail: I'm running Ubuntu server (12.04) and I want to connect to GitHub via SSH to download the latest source for my projects. There are multiple projects running on the same server and each project has a GitHub repo with it's own unique deloyment key-pair. So the host is always the same (github.com) but the keys need to be different depending on which repo I'm using.

Different /etc/ssh/ssh_config versions I have tried:

Host github.com
    IdentityFile /etc/ssh/my_project_1_github_deploy_key
    StrictHostKeyChecking no
Host github.com
    IdentityFile /etc/ssh/my_project_2_github_deploy_key
    StrictHostKeyChecking no

and this with both keys in the same file:

Host github.com
    IdentityFile /etc/ssh/my_project_github_deploy_keys
    StrictHostKeyChecking no

I've had no luck with either. Any help would be greatly appreciated!

share|improve this question

2 Answers 2

up vote 4 down vote accepted

I would do it like this:

Host project_1
    HostName github.com
    IdentityFile /etc/ssh/my_project_1_github_deploy_key

Host project_2
    HostName github.com
    IdentityFile /etc/ssh/my_project_2_github_deploy_key

and then use project_1 or project_2 as the host to access the repository.

share|improve this answer
    
Disabling host key checking is a terrible idea (security wise) and unrelated to the solution you propose. Other than that, it's a good answer. –  gertvdijk Dec 19 '12 at 17:02
    
@gertvdijk you are of course correct, edited my answer. –  faker Dec 19 '12 at 17:09
    
I've disabled strict host key checking myself because my scripts are automated and it avoids the prompts that occur the first time you connect. Can you recommend a more secure alternative @gertvdijk? –  Sencha Dec 19 '12 at 17:10
    
@Sencha add the host key to the known_hosts file, that file can also be specified via UserKnownHostsFile in ssh_config –  faker Dec 19 '12 at 17:13
    
@faker Ah great, would it be okay to store it in /etc/known_hosts? I'd like to keep everything system wide and not locked down to a particular user. –  Sencha Dec 19 '12 at 17:24

You can provide multiple identity files that SSH will attempt in sequence until one works or they all fail.

Host github.com
    IdentityFile /etc/ssh/my_project_1_github_deploy_key
    IdentityFile /etc/ssh/my_project_2_github_deploy_key
    StrictHostKeyChecking no
share|improve this answer
    
MaxAuthTries must not be set too low serverside (default value is 6 so problem are likely to appear when your reach my_project_6). –  coincoin Dec 19 '12 at 16:59
    
I've just tried this but it's not working. Whatever is the first identify file works, but when trying to connect with one of the additional identities it fails. –  Sencha Dec 19 '12 at 16:59
1  
@Sencha Please provide the relevant output of ssh -vvv when connecting. Relevant as in what keys are offered and why it is refused. –  gertvdijk Dec 19 '12 at 17:04
    
I'm actually doing the commands through git, so perhaps that's why it's failing? Perhaps git isn't doing the relevant re-attempts? –  Sencha Dec 19 '12 at 17:08
1  
@Sencha Git just uses the SSH client under water. That's why I suggest running ssh yourself in order to check at what point it fails. –  gertvdijk Dec 20 '12 at 23:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.