What are some good ways to protect against that? My first thought is to create a...

marklgr · on Dec 8, 2015

In your .ssh/config file:

    Host *
    # Do not send pubkey to each and any host
    PubkeyAuthentication no
    # Use Agent
    IdentitiesOnly       yes

Then override 'PubkeyAuthentication' to yes for each known server you want to connect to.

placeybordeaux · on Dec 8, 2015

A simple solution would be to create a dummy account and use that for sshing into untrusted hosts.

voltagex_ · on Dec 8, 2015

I wonder if you can turn off automatic use of public keys for "*", and then enable it in .ssh/config on an as-needed basis.

andreabedini · on Dec 8, 2015

Totally possible, I do this. Also I have a different key per host (using %h in IdentityFile)

vinceguidry · on Dec 8, 2015

Do you use pass-phrases with your per-host keys? I wanted to do this, but was unable to make it manageable. ssh-agent will only try so many keys before moving on.

andreabedini · on Dec 8, 2015

No, I don't use key pass-phrases.

alexbecker · on Dec 8, 2015

Just use a different key for github than for everything else. You can specify this in your ssh config using the IdentityFile directive.