SSH & Remote Administration

Stop letting your SSH agent bloat with stale identities

🧩 The Challenge

Ever notice how `ssh` just keeps trying every single key in your agent until the server boots you for too many attempts? I’ve spent way too much time debugging why my logins were failing only to realize my agent was clogged with five-year-old keys.

💡 The Fix

Use the IdentitiesOnly flag in your config to force SSH to pick exactly the key you tell it to for that specific host. It saves you from auth-failures and keeps your session clean.

Host prod-web-01
HostName 10.0.5.22
IdentityFile ~/.ssh/id_rsa_prod
IdentitiesOnly yes

⚙️ Why It Works

Setting this to yes tells the client to ignore the SSH agent entirely for that host and only use the specific identity file provided. It’s the only way to guarantee you aren’t leaking keys you shouldn’t be using.

🚀 Pro-Tip: Stick it in your ~/.ssh/config globally if you really want to lock down which keys are offered to which jump boxes.

Linux Tips & Tricks | © ngelinux.com | 10/23/2026