Multiple SSH keys for different github accounts

multiple_ssh_setting.md

Multiple SSH Keys settings for different github account

create different public key

create different ssh key according the article Mac Set-Up Git

$ ssh-keygen -t rsa -C "your_email@youremail.com"

Please refer to github ssh issues for common problems.

for example, 2 keys created at:

~/.ssh/id_rsa_activehacker
~/.ssh/id_rsa_jexchan

then, add these two keys as following

$ ssh-add ~/.ssh/id_rsa_activehacker
$ ssh-add ~/.ssh/id_rsa_jexchan

you can delete all cached keys before

$ ssh-add -D

finally, you can check your saved keys

$ ssh-add -l

Modify the ssh config

$ cd ~/.ssh/
$ touch config
$ subl -a config

Then added

#activehacker account
Host github.com-activehacker
	HostName github.com
	User git
	IdentityFile ~/.ssh/id_rsa_activehacker

#jexchan account
Host github.com-jexchan
	HostName github.com
	User git
	IdentityFile ~/.ssh/id_rsa_jexchan

Clone you repo and modify your Git config

clone your repo git clone git@github.com:activehacker/gfs.git gfs_jexchan

cd gfs_jexchan and modify git config

$ git config user.name "jexchan"
$ git config user.email "jexchan@gmail.com" 

$ git config user.name "activehacker"
$ git config user.email "jexlab@gmail.com" 

or you can have global git config $ git config --global user.name "jexchan" $ git config --global user.email "jexchan@gmail.com"

then use normal flow to push your code

$ git add .
$ git commit -m "your comments"
$ git push

Another related article in Chinese

1. http://4simple.github.com/docs/multipleSSHkeys/

I had to change the [remote "origin"] / url field in my local .git/config to use the Host defined in .ssh/config in order for this to work, i.e.,

[remote "origin"]
        url = git@github.com-activehacker:activehacker/gfs.git

Without that modification, git would just try to use my default ssh key.

Had to do the same to get it working.

Me too 😉

Me as well.

Instead of having to change the remote origin in the config after cloning, you can just use that custom Host variable on the git clone command instead.

e.g.

git clone git@github.com-activehacker:activehacker/gfs.git gfs_jexchan
________________________^

as oppose to:

git clone git@github.com:activehacker/gfs.git gfs_jexchan

that's the ticket!

Thanks!

To make it work with Gists, I needed to add another entry in ~/.ssh/config:

Host gist.github.com
  ...

If your ssh keys don't all show up with
ssh-add -l
you have to run
ssh-add ~/.ssh/yourkey.rsa

thanks, worked like a charm

but how it can works with "rake deploy" when I deploy my octopress blog? The mapping ssh-key seems no effect....

thanks, would be better if it could be changed as @jmpnot mentioned.

when trying to pull through a php script via exec it would not use the key automatically though it was the correct user configured (my user). Going through the ssh config file just saved the day! :D

ssh config +
updated clone url

Working great... :-) Thanks alot...

The same on so http://stackoverflow.com/questions/7927750/specify-an-ssh-key-for-git-push-without-using-ssh-config

I was having an issue with SSH using the wrong key, depending on which order I accessed repositories. Turns out it will try all the keys loaded into ssh-agent in order, and IdentityFile only adds to the end of that list.

You can add IdentitiesOnly yes the SSH config block to force it to only use the IdentityFile you specified.

I was also having issues with SSH using the wrong key even after following the advice of most who have encountered the same issue. In my case, I have a globally enabled ControlMaster in my ssh config. Removing the global ControlMaster config and deleting the github ssh socket (which in my case, is stored in /tmp as ssh_hostname.com_user as specified by my ControlPath config) fixed the issue for me. I can still use ControlMaster in other hosts by adding a ControlMaster auto line in that host's block.

@oleweidner: Thank you !

How do you do this with https urls though?

Thanks Jexchan. It helped and working as expected.

Thank you. It worked fine.

What exactly is the rule for setting up "Host" in the config file
Is it always github.com-[accountname] or can it be anything, because I set it to the shortname of my repository. Everything works, but it is not quit clear what needs to be set there.

Tnx it helps a lot!

Thanks for the tips. Might help to add the following to the instructions:

git remote set-url origin git@<host-in-ssh-config>:<username>/<repo>

This is the same as editing your .git/config file.

Same question: How do you do this with https urls though?

Thanks for the help!!!

Awsome!!!!!!!!

Thanks worked a treat. The following worked for me:
git clone git@github.com-sshID:myGitHubAccount/myRepo.git

I've forked and made the changes suggested by @noonat, @dontfidget, and @jmpnot
https://gist.github.com/RichardBronosky/dc0ced21d6dc7be7d196

see also: http://stackoverflow.com/questions/4565700/specify-private-ssh-key-to-use-when-executing-shell-command-with-or-without-ruby/11251797#11251797

👍

I forked @RichardBronosky (by mistake :) ) and changed the Host and User settings in ~/.ssh/config (User ) which enables one to actually use multiple accounts, on the local machine, with SSH access.

I borrowed one of my friend's laptops, and created a github account. It took a while to figure out why I kept getting kicked off github 'as user <friend's username>' - he hadn't created a new user for me on the laptop, so I was accessing with his username set in ~/.gitconfig and used with SSH. So the above, along with my ssh config changes, was the best way to get around the issue without wrecking his setup.

I just found out another way no need to deal with multiple SSH keys: use gitcredentials's useHttpPath option

[credential]
    helper = osxkeychain
    useHttpPath = true

English see http://www.davidhayden.org/blog/multiple-github-accounts-git-credential-osxkeychain
Chinese see http://jianshu.io/p/ef394ef6df95

On Windows 7, I want to manage multiple github users with passphrase-protected ssh keys.

I sorted my ~.ssh/config file to use different keys for different repo domains as described above (I previously documented the steps on mint/ubuntu.)

However, I don't want to type my passphrase every time, and I don't want to use ssh-agent.

Here's how I set up Pageant to ask for and remember my passphrase on Windows login:

• Download the Putty Tools package
• Win+R to open run dialog
• shell:startup to open the auto start folder in windows explorer
• Navigate to your Pageant folder in a separate Explorer window
• Right click and drag PAGEANT.EXE to the Startup folder. Choose Create Shortcut
• Right click the shortcut, properties, Shortcut tab
• Find the path to your .ppk encoded keypair
  • generate one with PUTTYGEN.EXE if you need a new one
  • convert one with PUTTYGEN.EXE if you have a linux id_rsa file but no .ppk
  • win7+ : shift right click your key in Explorer, Copy as path
• Append the key path to the C:\whatever\PAGEANT.EXE line
  • e.g: "Target: C:\putty\PAGEANT.EXE plato_cambrian.ppk plato.ppk"
  • If your keys aren't adjacent to PAGEANT you can use absolute paths or change "Start in:" which is Pageant's CWD
• Open the shortcut or reboot, and type your passphrases

Let's say alice is a github.com user, with 2 or more private repositories repoN.
For this example we'll work with just two repositories named repo1 and repo2

https://github.com/alice/repo1

https://github.com/alice/repo2

You need to be to pull from these repositories without entering a passwords probably on a server, or on multiple servers.
You want to perform git pull origin master for example, and you want this to happen without asking for a password.

You don't like dealing with ssh-agent, you have discovered (or you're discovering now) about ~/.ssh/config a file that let's your ssh client know what private key to use depending on Hostname and username, with a simple configuration entry that looks like this:

Host github.com
  HostName github.com
  User git
  IdentityFile /home/alice/.ssh/alice_github.id_rsa
  IdentitiesOnly yes

So you went ahead and created your (alice_github.id_rsa, alice_github.id_rsa.pub) keypair, you then also went to your repository's .git/config file and you modified the url of your remote origin to be something like this:

[remote "origin"]
        url = "ssh://git@github.com/alice/repo1.git"

And finally you went to the repository Settings > Deploy keys section and added the contents of alice_github.id_rsa.pub

At this point you could do your git pull origin master without entering a password without issue.

but what about the second repository?

So your instinct will be to grab that key and add it to repo2's Deploy keys, but github.com will error out and tell you that the key is already being used.

Now you go and generate another key (using ssh-keygen -t rsa -C "alice@alice.com" without passwords of course), and so that this doesn't become a mess, you will now name your keys like this:

• repo1 keypair: (repo1.alice_github.id_rsa, repo1.alice_github.id_rsa.pub)
• repo2 keypair: (repo2.alice_github.id_rsa, repo2.alice_github.id_rsa.pub)

You will now put the new public key on repo2's Deploy keys configuration at github.com, but now you have an ssh problem to deal with.

How can ssh tell which key to use if the repositories are hosted on the same github.com domain?

Your .ssh/config file points to github.com and it doesn't know which key to use when it's time to do the pull.

So I found a trick with github.com. You can tell your ssh client that each repository lives in a different github.com subdomain, in these cases, they will be repo1.github.com and repo2.github.com

So first thing is editing the .git/config files on your repo clones, so they look like this instead:

For repo1

[remote "origin"]
        url = "ssh://git@repo1.github.com/alice/repo1.git"

For repo2

[remote "origin"]
        url = "ssh://git@repo2.github.com/alice/repo2.git"

And then, on your .ssh/config file, now you will be able to enter a configuration for each subdomain :)

Host repo1.github.com
  HostName github.com
  User git
  IdentityFile /home/alice/.ssh/repo1.alice_github.id_rsa
  IdentitiesOnly yes

Host repo2.github.com
  HostName github.com
  User git
  IdentityFile /home/alice/.ssh/repo2.alice_github.id_rsa
  IdentitiesOnly yes

Now you are able to git pull origin master without entering any passwords from both repositories.

If you have multiple machines, you could copy the keys to each of the machines and reuse them, but I'd advise doing the leg work to generate 1 key per machine and repo. You will have a lot more keys to handle, but you will be less vulnerable if one gets compromised.

Let me add that it is not enough to have

Host repo1.github.com
  HostName github.com
  User git
  IdentityFile /home/alice/.ssh/repo1.alice_github.id_rsa
  IdentitiesOnly yes

 Host github.com
   HostName github.com
   User git
   IdentityFile /home/alice/.ssh/repo2.alice_github.id_rsa
   IdentitiesOnly yes

In this case the repo1 block will point to the second github.com block because the repo1 block says HostName github.com which will redirect from first to second block.

Took me a while to figure out just how smart ssh is 😄

@burningTyger The HostNames can be identical - it is the 'Host' that must differ. What may work best is to use "repo2.github.com", instead of that second "github.com". Then clone with git clone git@repo2.github.com:GitHubUserName/RepoName.git

Thank you. Worked as expected.

thank you @oleweidner for the tip on changing the git config!

Thanks dudels.

Thanks for the guide, helped me solve this very issue. I need a public keys for each of my GitHub repos.

go figure....

Thank you Xianjun!!!
Your answer is the first one when I searched this problem on google. 😄

Thank you very much for the instructions @jexchan ! Doing as @jmpnot wrote fixed all the problems !

Thank you so much for this guide, this worked wonders with my sublime text git plugin!

Works great. Thank you!

$ git config --local remote.origin.url git@[repository]-[public_ssh_key_file_name]:[repository_user]/[project].git
$ git config --local user.email [user_email]

Works!!! ^^

The .git file looks like this

[remote "origin"]
  url = git@[repository]-[public_ssh_key_file_name]:[repository_user]/[project].git

I think others have mentioned this but I couldn't find it when I searched the page.

I was getting the following error on bitbucket:

$ git push -u origin master
conq: repository access denied.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.`

adding this to the ~/.ssh/config file entries after specifying IdentityFile fixed it ...

IdentitiesOnly yes

Contents of ~/.ssh/config:

Host bitbucket.org-foo
HostName bitbucket.org
User git
IdentityFile ~/.ssh/my_rsa_private_key
IdentitiesOnly yes

Contents of .git/config:

[remote "origin"]
>url = git@bitbucket.org-foo:repo/repo.git
>fetch = +refs/heads/:refs/remotes/origin/

Notice how bitbucket.org-foo matches in each.

AT LAST, I've seen someone else use subl command. I'm not alone 😄

@ashanbrown thanks for your line, saved me 👍 🚀

[remote "origin"]
url = git@github.com-activehacker:activehacker/gfs.git

Golden line, solved the problem.

On Ubuntu 15.10 I faced with “Bad owner or permissions on ~/.ssh/config” error.
This article helped me http://serverfault.com/questions/253313/ssh-hostname-returns-bad-owner-or-permissions-on-ssh-config

Just need:
chmod 600 ~/.ssh/config

What worked for me is to use "github-activehacker" instead of "github.com-activehacker".

learned a lot, thx!

Worked pretty good, thanks!

Thanks, it worked pretty awesome!

Worked fine for me!

Thanks @oleweidner !!

If you have to change your local .git/config for this to work, how are you supposed to make the first clone?

EDIT: I figured it out. Instead of changing the remote url in .git/config, you can clone by replacing github.com with the host like so: git clone git@github.com-activehacker:activehacker/gfs.git gfs_jexchan. This will automatically set the remote url in .git/config to use the ssh host, so no need to manually edit after cloning.

this is going to save my life!

Thank you for the documentation. It helped me. Could you please apply @oleweidner changes as well. It seems it is mandatory.

I find this really easy

Example

git clone gh:jream/config-ubuntu.git

~/.gitconfig

[url "git@github.com:"]
     insteadOf = "gh:"
     pushInsteadOf = "github:"
     pushInsteadOf = "git://github.com/"

[url "git://github.com/"]
     insteadOf = "github:"

~/.ssh/config

Host github.com                                                             
      HostName github.com
      User git
      IdentityFile ~/.ssh/id_rsa

+1

With a git push, if underlying ssh returns an error as "nodename or servname" unknown replace the ":" by a / in the origin url, like
(git config --get remote.origin.url) ssh://git@github.com-[reponame]/[username]/[reponame].git (at least with git 2.11.0)

I finally made it work! 🎉
The issue in my case (I think it's related to https://gist.github.com/jexchan/2351996#gistcomment-998128) was that I had this in my ~/.ssh/config (it's to make ssh connections persistent):

Host * !localhost
  ControlPath ~/tmp/ssh_mux_%h_%p_%r
  ControlMaster auto
  ControlPersist 2h

Whenever I connect to a server via SSH, that configuration checks if the files exists in ~/tmp if not, it creates a new one. But if it exists, it reuses the latest connection that created that file (I'm not pretty sure how exactly works, but it's something like that). With that ControlPath configuration, it creates files like: ~/tmp/ssh_mux_github.com-22-git because %h is for "remote host", %p is for "port" and %r is for "ssh user". So, no matter which repository hostname I used, the "remote host" was always github.com (because of the HostName github.com configuration this gist suggest) and the connection was reused every time.

The trick was change my ~/.ssh/config from ControlPath ~/tmp/ssh_mux_%h_%p_%r to ControlPath ~/tmp/ssh_mux-%n-%p-%r.
%n is for "local hostname" (the Host config), so now this control path file is created like ~/tmp/ssh_mux_github.com-activehacker-22-git.

I was using the user as my github username rather than git . Hence having problems with connection . Now everything working perfectly . Thanks a lot .

I was facing problems but thank god this works properly. Thanks for sharing

Quick Tip: How to Work with GitHub and Multiple Accounts

Thank you, JexChan! This post is really helpful.

According to my experiment, git config user.name "myusername" and git config user.email "my@email.com" does NOT matter at all. What really matters is what oleweidner mentioned in the first comment of this post as following:

`I had to change the [remote "origin"] / url field in my local .git/config to use the Host defined in .ssh/config in order for this to work, i.e.,

[remote "origin"]
url = git@github.com-activehacker:activehacker/gfs.git
Without that modification, git would just try to use my default ssh key.`

In addition, if your url from git hub is git@github.com:activehacker/gfs.git, when doing git clone, you need to do
$ git clone git@github.com-activehacker:activehacker/gfs.git

following worked for me:

• update url for origin in .git/config as given for HOST in /.ssh/config
• git config user.email
• git config user.name

thanks mate 👍 💯

Guys, hope you won't lose as much time as I did to realize that I just had to reopen the console.
If you have all set up correctly and all of the sudden it stops working, just close and open your console and try again.

So sad...

Another solution is to only have one active ssh key in the ssh-agent.

Example ssh config-file:
Host www.github.com
    ForwardAgent yes
    User jexchan

Only use one key in the ssh-agent at any time:
$ ssh-add -D
$ ssh-add ~/.ssh/id_rsa_jexchan

Change user:
$ ssh-add -D
$ ssh-add ~/.ssh/id_rsa_activehacker

Thank you so much, I finally set up both of my keys, ssh config and remote URLs correctly, I've been struggling for months when pushing projects to different accounts and finally everything is working!

...just removed my stupid comment here as I learned something the hard way...

Usually a Host-section could contain more than one IdentityFile entry - and a plain SSH connection will usually probe all keys in the given order until it finds one that can be used.

The same is true for cloning public repositories from github. It will ignore unknown keys in the config (not known to github at all) and accepts the first known key in the chain.

But if you try to push to a repository github bails out on the first unknown key or a key that is not associated with the targeted repo.

Keychain cannot remember your passwords in MacOS when using this trick?

I ran into this issue as a MacOS user. I use ssh-add -K to have MacOS's KeyChain remember my passwords to my two SSH keys. Yet I would still be asked for a password when pushing my change in my second account or other some such issue.

See. I traced it back... If you add the identity like so:

cd ~/.ssh;
ssh-add -K private.rsa;

And then in your .ssh/config file define your IdentityFile's absolute path (like I did):

  IdentityFile /Users/jdoe/.ssh/private.rsa
  IdentitiesOnly yes

It won't work. In the mind of the ssh agent and KeyChain private.rsa and /Users/jdoe/.ssh/private.rsa are different and will ask you for the password when trying to pull/push.

No, you need to be consistent with how you add the password to the keychain. Add your Identity with ssh-add -K /Users/jdoe/.ssh/private.rsa

(I use absolute path /Users/jdoe/ instead of ~/ just because I felt like it. I believe ~/ should work just fine.)

To fix this open up KeyChain Access in MacOS, search your keychain for your SSH keys and after reminding yourself of the passwords (you can look at them in KeyChain Access) delete them. Then re-add the Identities using ssh-add -K /Users/jdoe/.ssh/private.rsa. That should fix things up.

Had to do the same to get it working. My friend, web developer from web development company helped me to solve it. He's a former programmer, has a huge experience in creating and optimizing more than 2,000 websites for small to mid-sized companies throughout the United States, so he usually gives me pieces of advice, cause I'm just the beginner..

Work well. (Y)

Worked good for me, thanks. Also had to match the origin url to the host url in config.

What is the subl command? It doesn't exist on my machine.

@brlafreniere it's the command for opening sublime

👍

Thanks!

DANKE!1

@ashanbrown: Your syntax was way cleaner than OPs. Totally helped my brain figure it out. Thank you!! 🥇

Thanks man! I had to create a new SSH key for a project and the git clone did not work. After I "ssh-add" the private key, git clone worked as the key was registered. :)

Thanks for the tips. Might help to add the following to the instructions:

git remote set-url origin git@<host-in-ssh-config>:<username>/<repo>

This is the same as editing your .git/config file.

Thank you @ashanbrown! That solved my problem

What is the subl command? It doesn't exist on my machine.

it opens up the sublime text editor :-)

me: how is appending -my_username to the github url supposed to work?
oh wait, it doesn't:
ssh: Could not resolve hostname github.com-username: nodename nor servname provided or not known

How is everyone getting this to work?

Anytime I try to clone, push, pull etc. from "git@github.com-username", I get an error message: nodename nor servname provided, or not known

Edit: Got this to work. If you're seeing this error message, it probably means you forgot to include the HostName github.com line in your ~/.ssh/config

Command "ssh-add -D" saved me from wrong git account because ssh multiplex connection. Thanks!

So helpful, thank you! Like many other people above, I also needed to add IdentitiesOnly yes to the global config file for this to work. Full working example from @RichardBronsky

Thanks. 👍

I've got a problem that when you have an entry

Host *
 AddKeysToAgent yes
 UseKeychain yes
 IdentityFile ~/.ssh/id_rsa

Then it will override your custom identities even if you were using IdentitiesOnly yes. Commenting out this part of config made everything work again. I wonder if I've broke something with it though. We'll see :)

Yeah, ssh-config host must match the host name in .git/config.
Thanks a lot!

I've rewritten this guide to include changes from Git 2.13 that allow this to be managed in a much easier fashion.
See https://gist.github.com/yinzara/bbedc35798df0495a4fdd27857bca2c1

Thanks! :bow

You can add ssh -vT git@github.com as the final step to check if you can connect

I had to change the [remote "origin"] / url field in my local .git/config to use the Host defined in .ssh/config in order for this to work, i.e.,

[remote "origin"]
        url = git@github.com-activehacker:activehacker/gfs.git

Without that modification, git would just try to use my default ssh key.

Me too

I followed this

generated and added the ssh for user1
generated and added the ssh for user2
now all git actions are being performed by user2
like if i have a project that is related to user1 , when i try to push code it gives error permission denied for user: user2

how can i switch users ?

Nice It works for me.

+1