0 How to explicitly disable SSH keys when connecting.md

How to explicitly disable SSH keys when connecting

Sometimes you want the SSH client to stop offering any private keys (agent keys or files in ~/.ssh), so the server falls back to password/keyboard-interactive or some other auth method. A common attempt is:

ssh -i /dev/null user@host

but that often does not work by itself. Here’s why, and how to do it reliably.

---

Why -i /dev/null alone doesn't disable keys

-i (or IdentityFile) only adds a key file to the list of identities the client may try — it does not prevent the client from also trying keys from:

• the SSH agent (SSH_AUTH_SOCK)
• default identity files (~/.ssh/id_rsa, ~/.ssh/id_ed25519, etc.)

By default IdentitiesOnly is no, so the client will try agent/default keys even when you supply -i /dev/null. Because /dev/null contains nothing, it simply adds an empty candidate but the agent/default keys are still offered.

---

Reliable ways to stop offering keys

1) Prevent offering any public-key identities (recommended)

If you want to turn off public-key auth altogether for this connection:

ssh -o PubkeyAuthentication=no user@host

This tells the client not to attempt public-key authentication. The server must allow some other method (e.g. password) for the connection to succeed.

2) Allow only explicitly-specified IdentityFile(s)

If you prefer to control which identity files are allowed and block the agent/default keys, use IdentitiesOnly=yes. Combining with IdentityFile=/dev/null ensures no usable key is offered:

ssh -o IdentitiesOnly=yes -o IdentityFile=/dev/null user@host

This causes the client to only consider the IdentityFile entries you provided (here /dev/null — which provides none), and to ignore agent and default keys.

3) Force password (or other non-key) authentication

If you want to ensure the client tries password auth first:

ssh -o PubkeyAuthentication=no -o PreferredAuthentications=password user@host

PreferredAuthentications orders the methods the client requests; PubkeyAuthentication=no prevents key attempts entirely.

---

Debugging tips

If you still see keys being offered:

• Run SSH in verbose mode to see what identities are tried:

ssh -vvv -o IdentitiesOnly=yes -o IdentityFile=/dev/null user@host

Look for lines like Offering public key: ... to see what was actually sent.

• Check whether an agent is active:

echo $SSH_AUTH_SOCK

If set, the agent can supply keys. You can temporarily disable it when running ssh:

env -u SSH_AUTH_SOCK ssh -o IdentitiesOnly=yes -o IdentityFile=/dev/null user@host

---

Example ~/.ssh/config snippet

If you want a persistent host entry that disables keys:

Host no-keys.example
  HostName example.com
  User myuser
  IdentitiesOnly yes
  IdentityFile /dev/null
  PubkeyAuthentication no

Then ssh no-keys.example will not use agent/default keys.

---

Summary

• -i /dev/null alone doesn’t stop the client from offering agent or default keys.
• Use -o IdentitiesOnly=yes to restrict identities to only those you specify.
• Use -o PubkeyAuthentication=no (and/or -o PreferredAuthentications=password) to disable public-key auth and force password or other methods.
• Use ssh -vvv and check SSH_AUTH_SOCK to debug what keys are being offered.

If you tell me whether you want to force passwords, keyboard-interactive, or simply prevent the agent from being used, I can give the exact one-line command or config snippet you should use.