Bug 3062 - ssh client ignores IdentitesOnly=yes if the identity file isn't found
Summary: ssh client ignores IdentitesOnly=yes if the identity file isn't found
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh (show other bugs)
Version: 8.0p1
Hardware: amd64 Linux
: P5 major
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks: V_8_1
  Show dependency treegraph
 
Reported: 2019-08-30 18:18 AEST by Stephen Shirley
Modified: 2021-03-04 09:53 AEDT (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Stephen Shirley 2019-08-30 18:18:01 AEST
This ssh command will use any key the client can find through it's normal means (i.e. agent, and ~/.ssh/id_{algo}):

  ssh -F /dev/null -o IdentitiesOnly=yes -i /something/that/doesnt/exist hostname

It will also ignore IdentitiesOnly=yes if no identity file is specified:

  ssh -F /dev/null -o IdentitiesOnly=yes hostname

I've tested this with:
- OpenSSH_7.2p2
- OpenSSH_7.9p1
- OpenSSH_8.0p1

This contradicts the documentation, which states:
  Specifies that ssh(1) should only use the authentication identity and
  certificate files explicitly configured in the ssh_config files or
  passed on the ssh(1) command-line, even if ssh-agent(1) or a
  PKCS11Provider offers more identities.
Comment 1 Stephen Shirley 2019-08-30 20:39:44 AEST
Just discovered a workaround:

  ssh -F /dev/null -o IdentitiesOnly=yes -i /something/that/doesnt/exist -i /dev/null hostname

This will cause ssh to fail with:

  Warning: Identity file /something/that/doesnt/exist not accessible: No such file or directory.
  Load key "/dev/null": invalid format
  hostname: Permission denied (publickey).
Comment 2 Damien Miller 2019-09-13 14:54:22 AEST
Thanks, I've clarified the documentation in commit 7047d5afe. IdentitiesOnly is intended mostly to limit which keys are tried from ssh-agent.
Comment 3 Damien Miller 2021-03-04 09:53:25 AEDT
close bugs that were resolved in OpenSSH 8.5 release cycle