I configured ssh to use GPG as my ssh-agent and if I remove the ~/.ssh folder, I can ssh into my server fine using my gpg key. However, my ~/.ssh folder has over a dozen different ssh keys in it, and if I try to ssh when it is there, I get a permission denied error because my ssh client is offering every single private key in the directory before trying the keys in the gpg ssh-agent.

With regular ssh-keys, I just use the IdentityFile config in my ~/.ssh/config file, but I can't do that because my identity is a gpg cardno. I am confused by why ssh is preferring the key files over the agent. Is there any way to force ssh to use the agent instead of the files? Or even better, is there any way to specify in the ~/.ssh/config file that the gpg key must be used for a given server?

I have confirmed that ssh-agent is not running and that gpg-agent is running and ssh-add -L shows my gpg key to be present, along with a single other ssh-style private key.


man ssh_config says about IdentityFile:

Additionally, any identities represented by the authentication agent will be used for authentication.

So it you set IdentityFile /dev/null, that one authentication will fail, then ssh will proceed to trying keys in your agent.

  • I thought this had worked but then when I tried a second time, I got the message Load key "/dev/null": invalid format followed by the same permission denied error. It looks like the issue may be the IdentitiesOnly setting in my ~/.ssh/config, when I remove that it works. – Mike Dacre Apr 10 '18 at 14:22
  • The man page has this really unclear statement: "IdentityFile may be used in conjunction with IdentitiesOnly to select which identities in an agent are offered during authentication." No idea how that's supposed to work. – Andrew Schulman Apr 10 '18 at 15:51

If your key is stored on some sort of pkcs11 capable hardware such as a smart card you can use ssh directly to access it.


 -I pkcs11
         Specify the PKCS#11 shared library ssh should use to communicate with a PKCS#11 token providing the user's private RSA key.

So you can use use ssh -I /path/to/opensc-pkcs11.so where opensc-pkcs11.so is your smart card library.


If you want to use a ssh-agent you can also add smart card backed keys to it using ssh-add -s /path/to/opensc-pkcs11.so


And finally if you want to use the config file so specify a PKCS11 device you can use PKCS11Provider

         Specifies which PKCS#11 provider to use.  The argument to this keyword is the PKCS#11 shared library ssh(1) should use to communi-
         cate with a PKCS#11 token providing the user's private RSA key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.