SSH How do I ignore IdentityFile not found errors?

Question

I currently have this in my .ssh/config file:

Host *
AskPassGUI no
IdentityFile ~/.ssh/%r@%h
IdentityFile ~/.ssh/%h
IdentityFile ~/.ssh/id_dsa

When I ssh into a host that I don't have a key file for, login works, but I also get these errors:

no such identity: /Users/user/.ssh/user@example.com: No such file or directory
no such identity: /Users/user/.ssh/example.com: No such file or directory

Ideally, i'd like ssh to check for the files, but not throw an error if any of them can't be found. The idea is to be able to put private keys named like "user@example.com" or "example.com" into my .ssh directory, and have ssh use those when logging in with that user / host combo, but not complain and then log in normally if the file is missing. I don't want to use Host directives as described in this answer, because I have a lot of key files and I'd rather not have to both add them to the folder, then edit the config file and add host directives for each one.

Is such a thing possible?

@TomO'Connor I suppose they are warnings since the login doesn't actually fail. — bmacs, Mar 18 '14 at 22:19

score 10 · Accepted Answer · edited Apr 12 '14 at 05:34

After reviewing openssh's source code, it seems that the answer is as follows:

OpenSSH considers the IdentityFile lines in ~/.ssh/config to be "user provided." If a user provided IdentityFile can't be found, it logs a warning to the console. See the 'load_identity_file' function in sshconnect2.c.

So unfortunately, it is impossible to do exactly what I want it to do, but a couple of workarounds exist:

One would be to add the line LogLevel ERROR to your ~/.ssh/config file. This is one step below the default log level of INFO. I didn't choose this as I wasn't sure what other warnings it would suppress.

The option I chose was to add the following lines to my /etc/ssh_config file:

Host *
    IdentityFile ~/.ssh/%r@%h
    IdentityFile ~/.ssh/%h

    # The lines below maintain ssh's default behavior:
    IdentityFile ~/.ssh/identity
    IdentityFile ~/.ssh/id_rsa
    IdentityFile ~/.ssh/id_dsa

I then removed the IdentityFile lines from my ~/.ssh/config file.

Those lines are not considered "user provided" when they are in /etc/ssh_config, so nothing is logged when the file can't be found.

You get a +1 for looking at the source – Jacob Apr 12 '14 at 05:39 — Jacob, Apr 12 '14 at 05:39

SSH How do I ignore IdentityFile not found errors?

1 Answers1