Forwarding access to a subset of ssh-agent identitites

Solution 1:

I implemented an ssh-agent-filter for myself, use it with:

$ afssh -c id_bluecorp -- server1.bluecorp.com
$ afssh -c id_bluecorp -- server2.bluecorp.com
$ afssh -c id_redcorp -- server42.redcorp.com

It's already in Debian (and Ubuntu).

Solution 2:

You can use multiple agents and specify each specifically using IdentityAgent and add the keys you want with IdentityFile and set AddKeysToAgent to yes. You will have to specify the unix socket for each ssh-agent to bind to with the -a option. You could also of course add the keys manually with ssh-add, after you create each one.

First create your agent:

ssh-agent -a ~/.ssh/redcorp-agent

Then in your .ssh/config have something like this:

Host redcorp* *.redcorp.com
IdentityFile ~/.ssh/redcorp.pem
IdentityAgent ~/.ssh/redcorp-agent
AddKeysToAgent yes
ForwardAgent yes