openssh unix dev - Jun 2005 - OpenSSH Feature Requests

Dear OpenSSH-Team,

after looking through your website (Bug Reports, FAQ, etc.) this is the
best email-address I could find for submitting a feature idea/request.

Please excuse if this is not the correct address and kindly forward.

When working with OpenSSH in larger networks I often had to use
different keys for different hosts (with or without passphrases) to gain
proper access. The major difference was between keys used for "real
users" and keys used for scriting (scp, rsync).

I would therefore like to propose a "server related key" feature.

Let me explain this feature on a small example:

I have two host
1.) backup.mynet.local
2.) devel.mynet.local

For the first host I have a keyset with no password for automated use by
rsync to backup files.
For the second host I have a keyset with a strong password to login
manually.

With the "server related key" I would save the according keys as
~/.ssh/id_dsa.backup.mynet.local
~/.ssh/id_dsa.pub.backup.mynet.local
~/.ssh/id_dsa.devel.mynet.local
~/.ssh/id_dsa.pub.devel.mynet.local

The ssh client would then first try the key including the hostname
provided before trying the default key (id_dsa).

Of course I know, that you can specify the key to use on the command
line but I think that this would more convenient then to have everybody
write their own wrappers to accomplish this.

Let me know what you think about this and thanks for reading :-)

Best regards,
Steve

Steve Meier wrote:
> When working with OpenSSH in larger networks I often had to use
> different keys for different hosts (with or without passphrases) to gain
> proper access. The major difference was between keys used for "real
You can specify these in .ssh/config using the IdentityFile option. ssh
will try keys in the order in which they are listed there (even if the
keys reside in the agent). E.g.

Host foo
	IdentityFile ~/.ssh/id_rsa_foo

Host bar
	IdentityFile ~/.ssh/id_rsa_bar

It might be worthwhile to add %h expansion IdentityFile so you could
template this in the config file, see:

http://bugzilla.mindrot.org/show_bug.cgi?id=95

-d