为给定域的 git push 指定 SSH 密钥

Specify an SSH key for git push for a given domain

提问by Confusion

I have the following use case: I would like to be able to push to [email protected]:gitolite-adminusing the private key of user gitolite-admin, while I want to push to [email protected]:some_repousing 'my own' private key. AFAIK, I can't solve this using ~/.ssh/config, because the user name and server name are identical in both cases. As I mostly use my own private key, I have that defined in ~/.ssh/configfor [email protected]. Does anyone know of a way to override the key that is used for a single gitinvocation?

我有以下用例：我希望能够推送到[email protected]:gitolite-admin使用 user 的私钥gitolite-admin，而我想推送到[email protected]:some_repo使用“我自己的”私钥。AFAIK，我无法使用 解决这个问题~/.ssh/config，因为在这两种情况下用户名和服务器名是相同的。由于我主要使用自己的私钥，因此我在~/.ssh/configfor中定义了它[email protected]。有谁知道覆盖用于单个git调用的密钥的方法吗？

(Aside: gitolite distinguishes who is doing the pushing based on the key, so it's not a problem, in terms of access, ownership and auditing, that the user@server string is identical for different users.)

（另外：gitolite 根据密钥区分谁在执行推送，因此就访问、所有权和审计而言，user@server 字符串对于不同的用户是相同的，这不是问题。）

回答by Mark Longair

Even if the user and host are the same, they can still be distinguished in ~/.ssh/config. For example, if your configuration looks like this:

即使用户和主机相同，它们仍然可以在~/.ssh/config. 例如，如果您的配置如下所示：

Host gitolite-as-alice
  HostName git.company.com
  User git
  IdentityFile /home/whoever/.ssh/id_rsa.alice
  IdentitiesOnly yes

Host gitolite-as-bob
  HostName git.company.com
  User git
  IdentityFile /home/whoever/.ssh/id_dsa.bob
  IdentitiesOnly yes

Then you just use gitolite-as-aliceand gitolite-as-bobinstead of the hostname in your URL:

然后你只需在 URL 中使用gitolite-as-aliceandgitolite-as-bob而不是主机名：

git remote add alice git@gitolite-as-alice:whatever.git
git remote add bob git@gitolite-as-bob:whatever.git

Note

笔记

You want to include the option IdentitiesOnly yesto prevent the use of default ids. Otherwise, if you also have id files matching the default names, they will get tried first because unlike other config options (which abide by "first in wins") the IdentityFileoption appendsto the list of identities to try. See: https://serverfault.com/questions/450796/how-could-i-stop-ssh-offering-a-wrong-key/450807#450807

您希望包含IdentitiesOnly yes防止使用默认 ID的选项。否则，如果您也有与默认名称匹配的 id 文件，它们将首先被尝试，因为与其他配置选项（遵循“先赢”）不同，该IdentityFile选项会附加到要尝试的身份列表中。参见：https: //serverfault.com/questions/450796/how-could-i-stop-ssh-offering-a-wrong-key/450807#450807

回答by sinelaw

An alternative approach to the one offered above by Mark Longairis to use an alias that will run anygit command, on anyremote, with an alternative SSH key. The idea is basically to switch your SSH identity when running the git commands.

Mark Longair 提供的上述方法的另一种方法是使用别名，该别名将在任何远程运行任何git 命令，并带有备用 SSH 密钥。这个想法基本上是在运行 git 命令时切换您的 SSH 身份。

Advantages relative to the host alias approach in the other answer:

相对于另一个答案中的主机别名方法的优点：

• Will work with anygit commands or aliases, even if you can't specify the remoteexplicitly.
• Easier to work with many repositories because you only need to set it up once per client machine, not once per repository on each client machine.

• 可以使用任何git 命令或别名，即使您不能明确指定remote。
• 使用多个存储库更容易，因为您只需在每个客户端机器上设置一次，而不是每个客户端机器上的每个存储库设置一次。

I use a few small scripts and a git alias admin. That way I can do, for example:

我使用了一些小脚本和一个 git alias admin。这样我就可以做到，例如：

git admin push 

To push to the default remote using the alternative ("admin") SSH key. Again, you could use any command (not just push) with this alias. You could even do git admin clone ...to clone a repository that you would only have access to using your "admin" key.

使用备用（“admin”）SSH 密钥推送到默认远程。同样，您可以使用push具有此别名的任何命令（不仅仅是）。您甚至git admin clone ...可以克隆一个您只能使用“管理员”密钥访问的存储库。

Step 1:Create the alternative SSH keys, optionally set a passphrase in case you're doing this on someone else's machine.

第 1 步：创建备用 SSH 密钥，可选择设置密码，以防您在其他人的机器上执行此操作。

Step 2:Create a script called “ssh-as.sh” that runs stuff that uses SSH, but uses a given SSH key rather than the default:

第 2 步：创建一个名为“ssh-as.sh”的脚本，它运行使用 SSH 的东西，但使用给定的 SSH 密钥而不是默认值：

#!/bin/bash
exec ssh ${SSH_KEYFILE+-i "$SSH_KEYFILE"} "$@"

Step 3:Create a script called “git-as.sh” that runs git commands using the given SSH key.

第 3 步：创建一个名为“git-as.sh”的脚本，该脚本使用给定的 SSH 密钥运行 git 命令。

#!/bin/bash
SSH_KEYFILE= GIT_SSH=${BASH_SOURCE%/*}/ssh-as.sh exec git "${@:2}"

Step 4:Add an alias (using something appropriate for “PATH_TO_SCRIPTS_DIR” below):

第 4 步：添加别名（使用适合下面“PATH_TO_SCRIPTS_DIR”的内容）：

# Run git commands as the SSH identity provided by the keyfile ~/.ssh/admin
git config --global alias.admin \!"PATH_TO_SCRIPTS_DIR/git-as.sh ~/.ssh/admin"

More details at: http://noamlewis.wordpress.com/2013/01/24/git-admin-an-alias-for-running-git-commands-as-a-privileged-ssh-identity/

更多详细信息，请访问：http: //noamlewis.wordpress.com/2013/01/24/git-admin-an-alias-for-running-git-commands-as-a-privileged-ssh-identity/

回答by Hustlion

You can utilize git environment variable GIT_SSH_COMMAND. Run this in your terminal under your git repository:

您可以使用 git 环境变量GIT_SSH_COMMAND。在您的 git 存储库下的终端中运行此命令：

GIT_SSH_COMMAND='ssh -i ~/.ssh/your_private_key' git submodule update --init

Replace ~/.ssh/your_private_keywith the path of ssh private key you wanna use. And you can change the subsequent git command (in the example is git submodule update --init) to others like git pull, git fetch, etc.

替换~/.ssh/your_private_key为您要使用的 ssh 私钥的路径。你可以改变随后的git命令（在本例中是git submodule update --init）别人喜欢git pull，git fetch等等。

回答by Chau H?ng L?nh

One Unix based systems (Linux, BSD, Mac OS X), the default identity is stored in the directory $HOME/.ssh, in 2 files: private key: $HOME/.ssh/id_rsa public key: $HOME/.ssh/id_rsa.pub When you use sshwithout option -i, it uses the default private key to authenticate with remote system.

一个基于 Unix 的系统（Linux、BSD、Mac OS X），默认身份存储在$HOME/.ssh目录中，在 2 个文件中： private key: $HOME/.ssh/id_rsa public key: $HOME/.ssh/id_rsa.pub 当您ssh不带选项使用时-i，它使用默认私钥与远程系统进行身份验证。

If you have another private key you want to use, for example $HOME/.ssh/deploy_key, you have to use ssh -i ~/.ssh/deploy_key ...

如果您有另一个要使用的私钥，例如$HOME/.ssh/deploy_key，则必须使用ssh -i ~/.ssh/deploy_key ...

It is annoying. You can add the following lines in to your $HOME/.bash_profile: ssh-add ~/.ssh/deploy_key ssh-add ~/.ssh/id_rsa

这很烦人。您可以将以下行添加到您的$HOME/.bash_profile 中： ssh-add ~/.ssh/deploy_key ssh-add ~/.ssh/id_rsa

So each time you use sshor gitor scp(basically sshtoo), you don't have to use option -ianymore.

因此，每次您使用sshorgit或scp（基本上ssh也是）时，您不必再使用 option-i了。

You can add as many keys as you like in the file $HOME/.bash_profile.

您可以在$HOME/.bash_profile文件中添加任意数量的密钥。

回答by rabexc

Another alternative is to use ssh-ident, to manage your ssh identities.

另一种选择是使用ssh-ident 来管理您的 ssh 身份。

It automatically loads and uses different keys based on your current working directory, ssh options, and so on... which means you can easily have a work/ directory and private/ directory that transparently end up using different keys and identities with ssh.

它会根据您当前的工作目录、ssh 选项等自动加载和使用不同的密钥……这意味着您可以轻松拥有一个 work/ 目录和 private/ 目录，最终透明地使用不同的密钥和身份与 ssh。

回答by user1738546

I am using Git Bash on Win7. The following worked for me.

我在 Win7 上使用 Git Bash。以下对我有用。

Create a config file at ~/.ssh/config or c:/users/[your_user_name]/.ssh/config. In the file enter:

在 ~/.ssh/config 或 c:/users/[your_user_name]/.ssh/config 创建一个配置文件。在文件中输入：

Host your_host.com
     IdentityFile [absolute_path_to_your_.ssh]\id_rsa

I guess the host has to be a URL and not just a "name" or ref for your host. For example,

我猜主机必须是一个 URL，而不仅仅是主机的“名称”或引用。例如，

Host github.com
     IdentityFile c:/users/[user_name]/.ssh/id_rsa

The path can also be written in /c/users/[user_name]/.... format

路径也可以写成 /c/users/[user_name]/.... 格式

The solution provided by Giordano Scalzo is great too. https://stackoverflow.com/a/9149518/1738546

Giordano Scalzo 提供的解决方案也很棒。 https://stackoverflow.com/a/9149518/1738546

回答by firfin

From git 2.10 upwards it is also possible to use the gitconfig sshCommand setting. Docs state:

从 git 2.10 起，也可以使用 gitconfig sshCommand 设置。文档状态：

If this variable is set, git fetch and git push will use the specified command instead of ssh when they need to connect to a remote system. The command is in the same form as the GIT_SSH_COMMAND environment variable and is overridden when the environment variable is set.

如果设置了这个变量，git fetch 和 git push 将在需要连接到远程系统时使用指定的命令而不是 ssh。该命令与 GIT_SSH_COMMAND 环境变量的形式相同，并在设置环境变量时被覆盖。

An usage example would be: git config core.sshCommand "ssh -i ~/.ssh/[insert_your_keyname]

一个使用示例是： git config core.sshCommand "ssh -i ~/.ssh/[insert_your_keyname]

In some cases this doesn't work because ssh_config overriding the command, in this case try ssh -i ~/.ssh/[insert_your_keyname] -F /dev/nullto not use the ssh_config.

在某些情况下这不起作用，因为 ssh_config 覆盖了命令，在这种情况下尝试ssh -i ~/.ssh/[insert_your_keyname] -F /dev/null不使用 ssh_config。

回答by karlos

I've cribbed together and tested with github the following approach, based on reading other answers, which combines a few techniques:

基于阅读其他答案，我将以下方法汇总并使用 github 进行了测试，这些方法结合了一些技术：

• correct SSH config
• git URL re-writing

• 正确的 SSH 配置
• git URL 重写

The advantage of this approach is, once set up, it doesn't require any additional work to get it right - for example, you don't need to change remote URLs or remember to clone things differently - the URL rewriting makes it all work.

这种方法的优点是，一旦设置好，它就不需要任何额外的工作来让它正确——例如，你不需要更改远程 URL 或记住以不同的方式克隆东西——URL 重写使这一切都能正常工作.

~/.ssh/config

~/.ssh/config

# Personal GitHub
Host github.com
  HostName github.com
  User git
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/github_id_rsa

# Work GitHub
Host github-work
  HostName github.com
  User git
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/work_github_id_rsa

Host *
  IdentitiesOnly yes

~/.gitconfig

~/.gitconfig

[user]
    name = My Name
    email = [email protected]

[includeIf "gitdir:~/dev/work/"]
    path = ~/dev/work/.gitconfig

[url "github-work:work-github-org/"]
    insteadOf = [email protected]:work-github-org/

~/dev/work/.gitconfig

~/dev/work/.gitconfig

[user]
    email = [email protected]

As long as you keep all your work repos under ~/dev/work and personal stuff elsewhere, git will use the correct SSH key when doing pulls/clones/pushes to the server, and it will also attach the correct email address to all of your commits.

只要您将所有工作存储库都保存在 ~/dev/work 和其他地方的个人资料下，git 在向服务器执行 pull/clone/push 操作时将使用正确的 SSH 密钥，并且它还会将正确的电子邮件地址附加到所有你的承诺。

References:

参考：

• 1

• 2

• 1

• 2

回答by Andrew Murphy

If using Git's version of ssh on windows, the identity file line in the ssh config looks like

如果在 Windows 上使用 Git 版本的 ssh，ssh 配置中的身份文件行看起来像

IdentityFile /c/Users/Whoever/.ssh/id_rsa.alice

where /cis for c:

哪里/c是为了c:

To check, in git's bash do

要检查，在 git 的 bash 中做

cd ~/.ssh
pwd 

回答by ViliusK

You might need to remove (or comment out) default Host configuration

您可能需要删除（或注释掉）默认主机配置