Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say I have a key for Github, along with other keys. I've added lots of keys to my ssh agent (ssh-add -L returns lots of lines) at my home computer A. In my .ssh/config I have set up which key to use with which host, so e.g.

ssh -T -vvv 2>&1 | grep Offering


debug1: Offering RSA public key: /Users/doxna/.ssh/id_rsa.github

Only one key is offered, as expected. But then ssh-ing to some host B with ForwardAgent yes and repeating the same command, I get

debug1: Offering RSA public key: /Users/doxna/.ssh/id_rsa.linode2
debug1: Offering RSA public key: /Users/doxna/.ssh/id_rsa.helium
debug1: Offering RSA public key: /Users/doxna/.ssh/id_rsa.github

meaning it tries all my keys. This is problematic since only a limited number of keys can be tried before servers return Too many authentication failures. So I tried editing .ssh/config on host B to include

  IdentityFile /Users/doxna/.ssh/id_rsa.github
  IdentitiesOnly yes

but then I get no key offerings, but rather

debug2: key: /Users/doxna/.ssh/id_rsa.github ((nil))

which I guess means that the key was not found(?) And after all, the key is located at my home computer A, not host B, so the question is how to refer to it at host B? Hope I managed to explain the question.

share|improve this question
up vote 7 down vote accepted

You got the right idea. The only part you are missing is that the file pointed to by IdentityFile must exist. It does not need to contain a private key, having just the public key available is sufficient.

On host B you can extract the public key from the agent by typing ssh-add -L | grep /Users/doxna/.ssh/id_rsa.github > ~/.ssh/ and then point to that file from ~/.ssh/config

share|improve this answer

Nice answer from @Kasperd, but note also that if Host B is compromised, or if you don't trust all those with root privileges there, then you're still exposing all of your keys to abuse for as long as you're logged in on that host.

So a better approach might be to forward only the keys you need. Maybe try ssh-agent-filter which is in debian / Ubuntu repositories, or from github.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.