How to specify a key file for sshfs?

Question

I looked at sshfs --help and didn't mention anything about the key file. I have several pubs / private keys (for different servers) on my computer and I want to specify which key to use. How can I do it?

  usage: sshfs [ user@ ]host:[dir] mountpoint [options] general options: -o opt,[opt...] mount options -h --help print help -V --version print version SSHFS options: -p PORT equivalent to '-o port=PORT' -C equivalent to '-o compression=yes' -F ssh_configfile specifies alternative ssh configuration file -1 equivalent to '-o ssh_protocol=1' -o reconnect reconnect to server -o delay_connect delay connection to server -o sshfs_sync synchronous writes -o no_readahead synchronous reads (no speculative readahead) -o sshfs_debug print some debugging information -o cache=BOOL enable caching {yes,no} (default: yes) -o cache_timeout=N sets timeout for caches in seconds (default: 20) -o cache_X_timeout=N sets timeout for {stat,dir,link} cache -o workaround=LIST colon separated list of workarounds none no workarounds enabled all all workarounds enabled [no]rename fix renaming to existing file (default: off) [no]nodelaysrv set nodelay tcp flag in sshd (default: off) [no]truncate fix truncate for old servers (default: off) [no]buflimit fix buffer fillup bug in server (default: on) -o idmap=TYPE user/group ID mapping, possible types are: none no translation of the ID space (default) user only translate UID of connecting user -o ssh_command=CMD execute CMD instead of 'ssh' -o ssh_protocol=N ssh protocol to use (default: 2) -o sftp_server=SERV path to sftp server or subsystem (default: sftp) -o directport=PORT directly connect to PORT bypassing ssh -o transform_symlinks transform absolute symlinks to relative -o follow_symlinks follow symlinks on the server -o no_check_root don't check for existence of 'dir' on server -o password_stdin read password from stdin (only for pam_mount!) -o SSHOPT=VAL ssh options (see man ssh_config) FUSE options: -d -o debug enable debug output (implies -f) -f foreground operation -s disable multi-threaded operation -o allow_other allow access to other users -o allow_root allow access to root -o nonempty allow mounts over non-empty file/dir -o default_permissions enable permission checking by kernel -o fsname=NAME set filesystem name -o subtype=NAME set filesystem type -o large_read issue large read requests (2.4 only) -o max_read=N set maximum size of read requests -o hard_remove immediate removal (don't hide files) -o use_ino let filesystem set inode numbers -o readdir_ino try to fill in d_ino in readdir -o direct_io use direct I/O -o kernel_cache cache files in kernel -o [no]auto_cache enable caching based on modification times (off) -o umask=M set file permissions (octal) -o uid=N set file owner -o gid=N set file group -o entry_timeout=T cache timeout for names (1.0s) -o negative_timeout=T cache timeout for deleted names (0.0s) -o attr_timeout=T cache timeout for attributes (1.0s) -o ac_attr_timeout=T auto cache timeout for attributes (attr_timeout) -o intr allow requests to be interrupted -o intr_signal=NUM signal to send on interrupt (10) -o modules=M1[:M2...] names of modules to push onto filesystem stack -o max_write=N set maximum size of write requests -o max_readahead=N set maximum readahead -o async_read perform reads asynchronously (default) -o sync_read perform reads synchronously -o atomic_o_trunc enable atomic open+truncate support -o big_writes enable larger than 4kB writes -o no_remote_lock disable remote file locking Module options: [subdir] -o subdir=DIR prepend this directory to all paths (mandatory) -o [no]rellinks transform absolute symlinks to relative [iconv] -o from_code=CHARSET original encoding of file names (default: UTF-8) -o to_code=CHARSET new encoding of the file names (default: UTF-8) 

Answer 1

Pay attention to this option:

-o SSHOPT = VAL ssh options (see man ssh_config)

And if you look at man ssh_config , it is possible to set the path to your private key file called IdentityFile so you can do this:

 sshfs -oIdentityFile=/abs/path/to/id_rsa server: path/to/mnt/point 

The path to the authentication file must be an absolute path.

Answer 2

Basically, it works like this (as root or use sudo ): sshfs -o default_permissions,nonempty,IdentityFile=/home/USER/.ssh/id_rsa SRVUSER@SERVER :PATH /mnt/mountpoint

Replace USER with the user located in the authorized_keys file of the server, SERVER with the server name (or IP, like 192.168.0.11), SRVUSER with the user on the server (for example, root, which is not recommended, but is possible and sometimes necessary; for this, configure it correctly /etc/ssh/sshd_config on the server, i.e. the PermitRootLogin and PasswordAuthentication directives). Also replace /mnt/mountpoint accordingly.

The -o nonempty allows -o nonempty to mount / mnt / mountpoint when this directory is not empty. I have to use this since I store the .unmounted file in this directory to see if it is mounted or not, so if test -e /mnt/mountpoint/.unmounted returns successfully (i.e. the .unmounts file exists in / mnt / mountpoint), it is not mounted.

Real example:

• server name "homeserver"
• mount / home directory on the server
• my mount point on the local system is / mnt / homeserver
• user "steve" has a private key

ssh root@homeserver how user Steve worked .

sshfs -o default_permissions,nonempty,IdentityFile=/home/steve/.ssh/id_rsa root@homeserver :/home /mnt/homeserver (as root)

This did not work , I received an error message: read: Connection reset by peer

Solution: Get more verbose output by adding -o debug .

 # sshfs -o default_permissions,nonempty,IdentityFile=/home/steve/.ssh/id_rsa,debug root@homeserver :/home /mnt/homeserver FUSE library version: 2.9.8 nullpath_ok: 0 nopath: 0 utime_omit_ok: 0 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the ECDSA key sent by the remote host is SHA256:aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStT0123 Please contact your system administrator. Add correct host key in /root/.ssh/known_hosts to get rid of this message. Offending ECDSA key in /root/.ssh/known_hosts:2 ECDSA host key for homeserver has changed and you have requested strict checking. Host key verification failed. read: Connection reset by peer 

And suddenly it is much easier to fix. Since sshd keys have been recreated since the last session, but /root/.ssh/known_hosts on the local system still have old keys - it does not work. In my case, the solution was to simply delete the line starting with homeserver from /root/.ssh/known_hosts using an editor (e.g. nano ). Now sshfs installation works. When connecting for the first time, the new key must be confirmed:

 # mount /mnt/homeserver The authenticity of host 'homeserver (192.168.0.11)' can't be established. ECDSA key fingerprint is SHA256:aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsS/1234. Are you sure you want to continue connecting (yes/no)? yes 

By the way, this is the line in /etc/fstab :

 root@homeserver :/home /mnt/homeserver fuse.sshfs noauto,nonempty,default_permissions,IdentityFile=/home/steve/.ssh/id_rsa 0 0 

So even if it's something else, try -o debug first. This will help to find a mistake.