如何将命令行中的显式 ssh 密钥优先于 ssh-agent 密钥？

Question

我有一堆 ssh 密钥半永久性地加载到 ssh-agent 中。ssh-add -L列出 6 个键。

我还有其他单独存储的密钥；比方说，在 USB 记忆棒上。我正好不希望妥善保管所有的时间。让我给其中之一打电话square.key。

问题是：在我需要的时候square.key，我可以插入 USB 记忆棒并指定-i /path/to/square.key— 但它不起作用。-v揭示了原因：

debug1: Will attempt key: /home/ulidtko/.ssh/key1 RSA SHA256:<redacted> agent
debug1: Will attempt key: /home/ulidtko/.ssh/key2 RSA SHA256:<redacted> agent
debug1: Will attempt key: key3@localhost ED25519 SHA256:<redacted> agent
debug1: Will attempt key: key4@localhost RSA SHA256:<redacted> agent
debug1: Will attempt key: key5@localhost ed25519 ED25519 SHA256:<redacted> agent
debug1: Will attempt key: key6@localhost ECDSA SHA256:<redacted> agent
debug1: Will attempt key: /path/to/square.key ED25519 SHA256:<redacted> explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: /home/ulidtko/.ssh/key1 RSA SHA256:<redacted> agent
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: /home/ulidtko/.ssh/key2 RSA SHA256:<redacted> agent
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: key3@localhost ED25519 SHA256:<redacted> agent
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: key4@localhost RSA SHA256:<redacted> agent
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: key5@localhost ed25519 ED25519 SHA256:<redacted> agent
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: key6@localhost ECDSA SHA256:<redacted> agent
Received disconnect from 46.101.206.106 port 22:2: Too many authentication failures
Disconnected from 46.101.206.106 port 22

不知何故，我ssh认为在命令行上手动传递ssh-agent之前尝试每个键是一个好主意square.key。所以这会Too many authentication failures在服务器上触发；square.key从来没有提供。

有没有办法覆盖或配置这个顺序？我想继续使用ssh-agent，但ssh要尊重我手动设置的命令行标志，并首先尝试-i“显式”键。

Answer 1

IdentitiesOnly=yes可能是一个合适的选项。也就是说，仅使用指定的身份。

ssh -i /path/to/square.key -o IdentitiesOnly=yes remote.server.net

或者

Host remote.server.net
  IdentityFile /path/to/square.key
  IdentitiesOnly yes

Answer 2

一种解决方法是在同一命令行上传递IdentityAgent=none：

ssh -i /path/to/square.key -o IdentityAgent=none remote.server.net

或等效地，通过~/.ssh/config：

Host remote.server.net
    IdentityFile /path/to/square.key
    IdentityAgent none