IdentityFile

IdentityFile is a directive used in the SSH client configuration to specify private key files that should be used for authentication when connecting to a host or a pattern of hosts. It appears in configuration files such as ~/.ssh/config or /etc/ssh/ssh_config and controls which private keys the client will attempt to use for public key authentication.

The directive can be used multiple times within a host or global section to provide a list of candidate private keys. The path can be absolute or relative, and most implementations support tilde expansion (for example, IdentityFile ~/.ssh/id_rsa). In practice, you might see lines like IdentityFile ~/.ssh/id_rsa and IdentityFile ~/.ssh/id_ed25519. The client will try these identities in the order listed, stopping when authentication succeeds.

The -i command-line option serves a similar purpose for a single connection, allowing you to specify a private key file directly. IdentityFile interacts with other authentication settings, notably IdentitiesOnly, which if set to yes restricts the client to using only the identities listed by IdentityFile and those provided by an agent.

Security considerations include protecting private keys with appropriate file permissions, using passphrases where feasible, and leveraging ssh-agent to manage keys securely. IdentityFile enables per-host or per-pattern key selection, which can simplify management in environments with multiple keys.

See also: IdentitiesOnly, IdentityAgent, ssh_config, and the -i option for the SSH client.