How to use multiple SSH keys for the same host?

Question

To a large extent, I want to be able to use multiple SSH keys on the same server for different users. I have a server that I use for both web hosting and SSH tunnel. I have an account that does not have a login shell for SSH tunneling. I use the root user to manage the rest of the system.

I have 2 SSH keys, one with a password for the root user and one without a password for the SSH tunnel. How to do this, when I connect as a tunnel user, it uses the tunnel key, and when I connect as the root user, it uses the root key?

Answer 1

If you have one key configured for your root user, another for your tunnel user (via authorized_keys on the server / remote machine), the right key is automatically selected.

This is based on the assumption that you have uploaded the keys to ssh-agent and that they are available to the ssh utility.

Otherwise, you can manually specify the key using ssh -i <identity file> .

Alternatively, you can configure aliases in your ssh_config (~ / .ssh / config or / etc / ssh / ssh _config):

 Host server-root User root IdentityFile <path to your key> Hostname <real hostname> Host server-tunnel User tunnel-user IdentityFile <path to your key> Hostname <real hostname> 

Then you use either ssh server-root or ssh server-tunnel .

But I would say that working with ssh-agent can be the easiest setup.

If you need automatic selection of the right key without ssh-agent, you can specify both keys with -i .

To quote from the openssh man page:

  -i identity_file Selects a file from which the identity (private key) for public key authentication is read. The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/id_rsa for protocol version 2. Identity files may also be specified on a per-host basis in the configuration file. It is possible to have multiple -i options (and multiple identities specified in configuration files). ssh will also try to load certificate information from the filename obtained by appending -cert.pub to identity filenames.