A

41

1801

A rather unusual situation perhaps, but I want to specify a private SSH-key to use when executing a shell (git) command from the local computer.

Basically like this:

git clone [email protected]:TheUser/TheProject.git -key "/home/christoffer/ssh_keys/theuser"

Or even better (in Ruby):

with_key("/home/christoffer/ssh_keys/theuser") do
  sh("git clone [email protected]:TheUser/TheProject.git")
end

I have seen examples of connecting to a remote server with Net::SSH that uses a specified private key, but this is a local command. Is it possible?

Ay answered 30/12, 2010 at 19:42 Comment(7)

See this question in SuperUser as well. – Octosyllabic 8/5, 2015 at 9:45

I'm wondering why this is so unusual that Git doesn't have an -i option like ssh does. – Urethra 18/4, 2016 at 10:55

With git 2.10 (Q3 2016), you also have a new config: git config core.sshCommand 'ssh -i private_key_file'. See my answer below – Scaremonger 20/7, 2016 at 6:48

Is it really for one-time use ? If not one should associate host aliases and keys in ~/.ssh/config first. Details here – Barehanded 12/2, 2021 at 11:2

gist.github.com/Tamal/1cc77f88ef3e900aeae65f0e5e504794 here you can find a script with the solution – Glossology 10/7, 2021 at 10:31

This is documented already: git-scm.com/docs/gitfaq#Documentation/… – Kurdish 21/9, 2021 at 23:27

I had to purge everything from my ssh agent before it would work because for some reason it kept picking up the old one no matter what. A reboot may also fix this I guess. – Slavophile 30/5, 2023 at 14:5

N

1132

Something like this should work (suggested by orip):

ssh-agent bash -c 'ssh-add /somewhere/yourkey; git clone [email protected]:user/project.git'

if you prefer subshells, you could try the following (though it is more fragile):

ssh-agent $(ssh-add /somewhere/yourkey; git clone [email protected]:user/project.git)

Git will invoke SSH which will find its agent by environment variable; this will, in turn, have the key loaded.

Alternatively, setting HOME may also do the trick, provided you are willing to setup a directory that contains only a .ssh directory as HOME; this may either contain an identity.pub, or a config file setting IdentityFile.

Nikianikita answered 30/12, 2010 at 19:48 Comment(14)

But this will add the key permanently as an accepted SSH-key, right? I want to avoid that so that theuser2 can't mess with theuser's projects. It's for a web application so it's not practical to use different OS-users, which would have been the best option. – Ay 30/12, 2010 at 19:55

No, when git completes, ssh-agent terminates, and the key is forgotten. – Eveevection 30/12, 2010 at 19:56

this command does'not work on windows git bash. It says syntax error near unexpected token 'ssh-add' – Cutpurse 19/9, 2011 at 19:2

Fixed command line (for windows or linux) would be something like: ssh-agent bash -c 'ssh-add sshkey; git clone url' – Interested 10/11, 2011 at 0:0

This works fine on my desktop *nix machines, but fails on several servers that are virgin installs of current Debian. @HeyWatchThis's answer seems to work everywhere (although it's permanent where this one is temporary) – Guam 5/5, 2013 at 20:18

bash crashes on windows for me (using git bash environment variables). Is there a workaround for windows. – Augury 11/12, 2014 at 13:47

I've fixed the syntax of the first command line: it should be $( ... ) to launch a subshell. – Pacer 28/10, 2015 at 16:48

The ssh-agent $(..) syntax isn't working for me and I'm not sure how this is suppose to work: (ba)sh should execute the commands inside $(..) first, then run ssh-agent with the output as parameter. – Distribute 28/12, 2015 at 11:55

Unfortunately instead of removing the key, it left it there. You should add a ssh-add -d /path/to/key at the end. – Microbe 21/9, 2017 at 18:54

The $(..) syntax probably doesn't do what you expect: it runs the commands inside first and sends their output to ssh-agent. This might happen to work anyway if another ssh-agent happens to be already running, but then the new key will be left in the agent (unless you add ssh-add -d to take it out) and the answer becomes ssh-add /somewhere/yourkey && git clone [email protected]:user/project.git ; ssh-add -d /somewhere/yourkey (and we assume ssh-agent is already running, and note the use of && rather than ;). But that's moot because the bash -c version is correct. – Lianeliang 7/3, 2018 at 11:20

This solution stopped working for me for some reason after I upgraded from OpenSUSE 42.3 to 15.0. I switched to https://mcmap.net/q/14116/-how-to-specify-the-private-ssh-key-to-use-when-executing-shell-command-on-git, which is working well. – Exosmosis 28/12, 2018 at 18:16

You also accomplish this with ssh-add -t 60; git clone [email protected]:user/project.git. That will just expire the key after 60 seconds. – Almonry 8/1, 2019 at 19:45

This worked for me on Windows 10 for quite some time, but in the past week it's stopped working and I can't seem to pinpoint the change. Infact it fails to work on two separate systems. The ssh-agent service despite running, reports nothing though running with -d generates a cannot create agent root reg key, ERROR:5 error. – Instal 25/5, 2021 at 6:14

And then do git config core.sshCommand "ssh -i /path/to/key" so that it remembers your key every time you do a git fetch / git pull – Mineralogist 29/7, 2021 at 14:54

T

1674

None of these solutions worked for me.

Instead, I elaborate on @Martin v. Löwis 's mention of setting a config file for SSH.

SSH will look for the user's ~/.ssh/config file. I have mine setup as:

Host gitserv
    Hostname remote.server.com
    IdentityFile ~/.ssh/id_rsa.github
    IdentitiesOnly yes # see NOTES below
    AddKeysToAgent yes

And I add a remote git repository:

git remote add origin git@gitserv:myrepo.git

(or clone a fresh copy of the repo with git@gitserv:myrepo.git as address)

And then git commands work normally for me.

git push -v origin master

If you have submodules, you can also execute the following in the repo directory, to force the submodules to use the same key:

git config url.git@gitserv:.insteadOf https://remote.server.com

NOTES

The IdentitiesOnly yes is required to prevent the SSH default behavior of sending the identity file matching the default filename for each protocol. If you have a file named ~/.ssh/id_rsa that will get tried BEFORE your ~/.ssh/id_rsa.github without this option.
AddKeysToAgent yes lets you avoid reentering the key passphrase every time.
You can also add User git to avoid writing git@ every time.

References

Terrence answered 28/6, 2012 at 19:44 Comment(17)

I found that when you specify multiple keys using .ssh/config, you need to use host friend name in line "Host" as part of "git remote add" command. If line is "Host stg", then you need to use git remote add <someName> user@stg:/path_to_git_repo.git ". If you use exact server name like [email protected]:/path_to_git_repo.git, the config file is not picked by git. Hence, it is not picking private key file correctly. I tried this by pushing same content to github and heroku and works only when you give friendly name in "git remote add" – Collateral 15/7, 2013 at 23:46

I wasn't sure about the Host for github. I found this link: gist.github.com/jexchan/2351996. – Ionone 15/7, 2014 at 9:40

@JonnyReeves edits introduced mismatched hostnames. Pushing to gitserv will not match the ssh config Host entry for remote or remote.server.com. Therefore the intended IdentityFile will not be used. I'm going to edit this answer. – Amundson 29/7, 2014 at 16:29

Take a look here if you want to have few key files for few git repositories – Lankester 9/9, 2014 at 14:37

I don't understand why IdentitiesOnly is necessary. As I understand it, by adding this host to the config file, it will add this ssh key to a list of keys that it will try, i.e. it will first try ~/.ssh/identity, ~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/id_rsa and then it will try ~/.ssh/id_rsa.github. Is there anything wrong with it trying id_rsa before id_rsa.github, as long as it eventually tries id_rsa.github? – Simmer 31/8, 2015 at 14:40

Umm this doesn't work for me. When I do a git pull from my private repo, git ignores my .ssh/config file completely and tries id_rsa instead, which is the wrong key. – Essequibo 25/4, 2016 at 9:55

I had all of this except for IdentitiesOnly and it worked for a while but then one day stopped working and was trying to use my default key in id_rsa. IdentifiesOnly does seem to be important. – Stem 22/5, 2016 at 19:51

You could use Host remote.server.com and keep using the original URL – Cereus 9/8, 2016 at 13:3

For some reason, this worked for me, but I add to SSH-login to the Git server first for the identifyFile to be used (Probably has to do with the known_hosts not being populated). So, after doing that, and before running your git clone ... command, run: ssh {hostname} – Flower 27/12, 2016 at 10:19

Also User may be required in the config entry – Compute 21/5, 2018 at 5:24

This worked for me after two changes. If the config file is new, don't forget to do chmod 600 ~/.ssh/config (see here). And if you are using GitHub, replace Host gitserv with Host github.com, omit Hostname remote.server.com, and add remote with git remote add origin [email protected]:user_name/repo_name.git. – Launceston 21/6, 2018 at 11:30

To save some more characters, add User git into that configuration item and just use gitserv:myrepo.git as remote URL. – Gymnasiarch 28/3, 2019 at 16:10

This is the only answer that also works with Windows if you are using the ssh client that comes with Git (located at %ProgramFiles%\Git\usr\bin\ssh.exe by default). Modify or create the config file located at %USERPROFILE%\.ssh\config. – Radiophotograph 9/4, 2020 at 19:37

I needed to use Host instead of Hostname. I.e. Host xfce.org\nHost gitlab.xfce.org – Rosenarosenbaum 7/7, 2020 at 13:28

github: HostName github.com User git (answered by Karsten), gitlab: HostName gitlab.com User git – Lamentable 6/1, 2021 at 12:11

it looks like the comment makes it fail: /root/.ssh/config line 4: garbage at end of line; "#". so if this is the case, remove the comment – Klinges 12/4, 2022 at 12:55

I've took liberty to add a solution for submodules. – Diversity 30/1 at 15:16

N

1132

Something like this should work (suggested by orip):

ssh-agent bash -c 'ssh-add /somewhere/yourkey; git clone [email protected]:user/project.git'

if you prefer subshells, you could try the following (though it is more fragile):

ssh-agent $(ssh-add /somewhere/yourkey; git clone [email protected]:user/project.git)