Filtering which identities are forwarded by ssh-agent to a given host

[Alon Bar-Lev]

On Sun, Feb 1, 2015 at 2:52 PM, Bill Nugent <whn at lopi.com> wrote:
>
> Howdy,
>
> I'm looking for a way to restrict which ssh keys are forwarded to a
> given remote host because we have several ssh domains.  That is, I have
> two keys which I use throughout the day:
>   .ssh/network-a-2014-10-12
>   .ssh/network-b-2014-11-22

I think best is to run two agents, load keys of each network to each
agent and at that context use ssh.

>
> I need to forward my network A key to the ssh gateway host for Network A
> to allow me to log into hosts on the other side of the gateway but I
> can't have the key for Network B to be forwarded.  Similar thing for
> Network B.  Deleting and adding is painful at best.  I've experimented
> with IdentiesOnly=yes and IdentityFiles but on the network A gateway I
> still see all of my loaded keys including Network B.  Is there a way to
> do this already?  If not, would a Buzilla enhancement request be
> welcome?  Perhaps requesting something along the lines of:
>
> Host network-a-gateway.example.com
>         ForwardIdentity      .ssh/network-a-2014-10-12
> and allow additional ForwardIndenty to allow additional keys.

Maybe a simpler and more secure alternative can be having
AgentEnvironmentKey or something similar to enable ssh to use multiple
agents based on the Host's ssh_config, so you actually refer to agent
and not specific keys that are shared within single agent.

>
>         Thank you,
>         Bill
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev