Skip to the content.

I have too many SSH public keys...

First, let me say, SSH with public keys is awesome. Especially with a ssh-agent. You type in a passphase for your key the first time you want to use it and then it persists throughout a session. No more typing in your password 20 times every time you wish to do a `svn up` on a svn+ssh repository. And even better, your passphase is never sent over the network. I love public keys, and use them all the time.
Unfortunately it seems I might love them a bit too much. When trying to log into some boxes recently, I’ve started to get the following error:

dcoles@krikkit:~$ ssh damogran.local
Received disconnect from 192.168.1.10: 2: Too many authentication failures for dcoles
 
Turns out the problem is that sshd has a limit on the number of authentication attempts that can be made (see MaxAuthTries of sshd_config(5) ) and each public key attempted counts as an attempt. Since I can’t really change this setting on every remote host I have access to I’ve had to get a bit smarter with keys.
The solution was to edit ~/.ssh/config to only sent public keys when required:

# Server 1
Host server.example.com
    User dcoles
    PubkeyAuthentication yes
    IdentityFile ~/.ssh/id_rsa # Public key for this server

# Don’t send PublicKeys to other hosts – I have too many
Host *
    PubkeyAuthentication no
 
The IdentityFile clause is pretty powerful. You can use the escape characters in the filename to choose a public key file based on host or username of the server (see ssh_config(5) ).