Because that is the default. If a host has no IdentityFile configured, ssh tries your default key files and also any identities held by your ssh-agent. Setting IdentitiesOnly yes with an explicit IdentityFile for each host makes ssh offer only the key you chose.
What the manual says
The ssh_config manual says that without an IdentityFile option, ssh tries default key files such as ~/.ssh/id_rsa, ~/.ssh/id_ecdsa and ~/.ssh/id_ed25519. It also says identities held by the authentication agent are used too, unless IdentitiesOnly is set. IdentitiesOnly accepts yes or no, defaults to no, and restricts ssh to the configured identity and certificate files, even when the agent offers more. Repeating IdentityFile adds to the list of identities tried.
Why this matters
Each key you offer tells the server something: that a key with that fingerprint exists on your machine. A server you do not fully trust learns your public keys, which can link your accounts across services. Many servers also limit failed attempts, so offering many keys first can lock you out before the right one is tried. The more serious point is the neighbor risk covered in is ssh agent forwarding safe: the fewer places your agent is usable, the better.
A host block that behaves
Host git-work
HostName github.com
User git
IdentityFile ~/.ssh/id_ed25519_work
IdentitiesOnly yes
Host git-personal
HostName github.com
User git
IdentityFile ~/.ssh/id_ed25519_personal
IdentitiesOnly yes
You then clone with the alias, for example git clone git@git-work:org/repo.git. Each alias offers exactly one key.
Steps
- List what your agent holds with
ssh-add -l. - Run
ssh -v hostand read which identities are offered, in order. - Add a
Hostblock per service or account with an explicit IdentityFile. - Add
IdentitiesOnly yesto each block. - Retest with
ssh -vand confirm only one key is offered. - Use a passphrase on each key. See ssh key passphrase and ssh-agent.
Common mistakes
| Mistake | Effect |
|---|---|
| Setting IdentityFile without IdentitiesOnly | Agent keys are still offered |
| One shared key for every service | One theft opens everything |
Wildcard Host * with a personal key | Every server sees it |
Forgetting IdentityFile none for hosts that need password or other auth | Default keys still tried |
Safeguard scans repositories and dependencies; for the code you pull over ssh, a free scan is at gold.safeguard.sh/scan.
Quick check
Does IdentitiesOnly stop the agent from running?
No. The agent keeps running. ssh simply ignores agent keys that are not the configured identity files for that host.
Should I use one key per service?
It limits the damage from one stolen key and keeps accounts unlinkable, at the cost of a few extra config lines.
Sources
Last reviewed: 19 October 2026.
