2

I use an Ubuntu 14.10 distribution, and two private keys, one encrypted (~/.ssh/E.key), and one not encrypted (~/.ssh/NE.key), which I use for accessing two github repositories, respectively, repoE and repoNE.

I use the common trick of aliasing gitbhub.com to two different domains, which are mapped to the respective ssh keys.

Content (only relevant) of ~/.ssh/config:

Host github.com-E
  Hostname github.com
  IdentityFile ~/.ssh/E.key

Host github.com-NE
  Hostname github.com
  IdentityFile ~/.ssh/NE.key

Content (only relevant) of local repository configurations:

# /path/to/repoE/.git/config:

[remote "origin"]
  url = [email protected]:organizationE/repoE.git

# /path/to/repoNE/.git/config:

[remote "origin"]
  url = [email protected]:organizationNE/repoNE.git

I use ssh-add, so that I don't need to type the passphrase for any access to repoE.

The problem is that apparently, only the first key I add is used (I can see the offer from the ssh client log).

This is for example a sample run:

$ ssh-add ~/.ssh/E.key

# I can now access repoE, but not repoNE

$ ssh-add ~/.ssh/NE.key

# Still the same (I can access repoE, but not repoNE)

$ ssh-add -D

$ ssh-add ~/.ssh/NE.key

# I can now access repoNE, but not repoE

$ ssh-add ~/.ssh/E.key

# Still the same (I can access repoNE, but not repoE)
Marcus
  • 869
  • 2
  • 8
  • 22

1 Answers1

1

gpg-agent and most probably ssh-agent, too, doesn't care what the keys belong to. The keys are identified by their keygrip (the fingerprint of the pure key material whereas e.g. an OpenPGP fingerprint is over the key material and some additional data like the creation date).

You can enable / increase the logging in the config file ~/.gnupg/gpg-agent.conf. Relevant options are

  • --debug-level
  • --log-file

To activate this change gpg-agent either needs a SIGHUP (for changes of certain already given options, see the "SIGHUP" section in the man page) or must be restarted.

You may also enable logging in the ssh config file to see what exactly git push does with ssh. strace -f -e trace=execve git push might help, too. Relevant options are:

  • log_file
  • LogLevel
Hauke Laging
  • 88,146
  • 18
  • 125
  • 174
  • 1
    I've tried the debug log, and what happens is that the ssh-agent only offers the first key added (so that only one of the two works at a time); not clear why this happens. – Marcus Jan 12 '15 at 19:53