Quickly Bypass ssh-agent
When ssh-agent is running, ssh consults it before trying identity files on disk. Sometimes you want to force ssh to ignore the agent and use a specific key file directly — for example, when the agent has a stale or wrong key loaded.
env -u SSH_AUTH_SOCK ssh -i $KEY_FILE ${USER}@${HOST}env -u SSH_AUTH_SOCK unsets the SSH_AUTH_SOCK environment variable for the duration of that single command. Without the socket path, ssh cannot contact the agent and falls back to the -i identity file.
Use cases
- Testing a specific key: Confirm that a newly generated or recovered key actually works before adding it to the agent.
- Avoiding agent lock-in: Some agents (gpg-agent, GNOME Keyring) aggressively offer keys. Bypassing them prevents “Too many authentication failures” errors.
- Forensics / IR: On a compromised host, an investigator may want to use a known-good key without trusting the user’s agent.
Related
- ssh — the broader SSH ecosystem
- gpg-key-with-ssh-support — when gpg-agent is the agent you’re bypassing
- openssl-rsa-passphrase — passphrase management for the keys you’re using directly