Multiple Keys

~15 min · multiple-keys, identityfile, identitiesonly, github

Level 0Pinger

0 XP0/101 lessons0/12 achievements

0/150 XP to next level150 XP to go0% complete

One key per purpose

Sooner or later you'll have separate keys for separate purposes — personal vs work, GitHub vs cloud provider, a dedicated key for backups, and so on. ~/.ssh/config picks the right key per host.

The IdentitiesOnly trap

By default, when ssh-agent has multiple keys loaded, SSH offers them all in turn. If a server has a low MaxAuthTries (default: 6), you can burn through allowed attempts on wrong keys before the right one is tried — and get "Too many authentication failures." That's the symptom. The fix is IdentitiesOnly yes: "only offer the IdentityFile listed for this host, ignore everything else in the agent."

Code

Different keys for different hosts·ssh-config

# Personal home fleet — default key
Host office server music
    User you_username
    IdentityFile ~/.ssh/id_ed25519

# Work hosts — separate work key
Host *.work.com
    User you_username.kim
    IdentityFile ~/.ssh/id_ed25519_work

# GitHub — dedicated key
Host github.com
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519_github

# Always force only the IdentityFile, never auto-try other keys
Host *
    IdentitiesOnly yes
    AddKeysToAgent yes
    UseKeychain yes

External links

ssh_config — IdentitiesOnly

Exercise

Run ssh-add -l to see how many keys are loaded in your agent. If more than 2, you're a candidate for IdentitiesOnly yes problems. Add it to Host * in your config and ensure each Host block has an explicit IdentityFile. Test that your most important connections still work.