How do I get ssh to use only one key from ssh-agent?

Question

I need to use two different ssh keys when connecting to the same host.

The machine I need to use to connect (because of ip address restrictions) is not the machine where the ssh keys are stored, so I am using ssh-agent here. Also, these ssh connections happen under control of a script which is run on the intermediate machine.

If the ssh keys were local to that machine, I imagine I could use ssh -i (or maybe ssh-add in a nested agent) to specify the identity I want to use, and I could update the scripts and/or script context to do the right thing for my case (probably with a config file to specify the relevant details).

But, since the keys are not on the machine performing the ssh connection, ssh -i fails (the private key file does not exist on that machine). And, similarly, ssh-add wants me to specify the key by providing the private key's file name. (Or I suspect that that's the case - I have not actually figured out how to nest ssh-agents but the documentation on ssh-add makes doubt that that would be a plausible approach.)

So my question is: how do I get ssh to use only the key I specify when making contact to the destination system?

[Other people need to use these scripts, also, of course, but that's a problem I can solve after I get it working for myself.]

In other words, I have this situation:

$ ssh-add -l
2048 SHA256:A8PFww3boSTRe8sPvXDgir09KNVqu+JvWNw7/GLCiwM /home/account/.ssh/key1.pem (RSA)
2048 SHA256:Em5p4B++GIm0l/zDYgZ26VaHbIb07T6MViu5ioMPTiA /home/account/.ssh/key2_rsa (RSA)
4096 SHA256:JON2JaTTk1r3ufUrGm4C/cE9IG9edyfDxE1zTel/0u8 /home/account/.ssh/key3_rsa (RSA)

And in one context I need to ssh to use key2_rsa and in the other context I need ssh to use key3_rsa

Using the wrong key here causes the connection to the destination system to fail (because it recognizes the other key as having access to the machine but not having access to that subsystem).

How do I make this work?

Answer 1

ssh -i also accepts files containing public keys, and if a matching key is found in the agent, it will be tried before everything else.

Additionally, if -o IdentitiesOnly=yes is specified, the client will use only that key and won't fall back to any other keys if it was rejected. (Note that fallback to other mechanisms, such as GSSAPI or password, is controlled by a different option.)