SSH Multiple Git Accounts Configuration - AI-Optimized Technical Reference

Configuration Requirements

SSH Key Generation

• Recommended Algorithm: ED25519 (faster, GitHub recommended as of 2025)
• Critical Warning: RSA SHA-1 signatures disabled by GitHub since March 2022
• Key Naming Convention: Use descriptive filenames (id_ed25519_work, id_ed25519_personal)
• Passphrase Decision:
  • Personal machines: Skip passphrases (usability vs security trade-off)
  • Work laptops: Use passphrases (IT security audit requirement)
  • Failure Mode: macOS Keychain integration breaks on OS updates (Monterey 12.3, Ventura 13.0)

SSH Configuration File Requirements

File Location: ~/.ssh/config
Critical Permissions: chmod 600 ~/.ssh/config (SSH ignores world-readable configs)
Syntax Requirements:

• Spaces only for indentation (tabs break parsing)
• No inline comments (breaks SSH parser)
• Host blocks don't inherit from each other

Essential Configuration Template:

Host github-work
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519_work
    IdentitiesOnly yes
    AddKeysToAgent yes

Host github-personal
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519_personal
    IdentitiesOnly yes
    AddKeysToAgent yes

Critical Settings:

• IdentitiesOnly yes: Prevents "too many authentication failures" rate limiting
• AddKeysToAgent yes: Avoids repeated passphrase prompts

Failure Modes and Solutions

Authentication Failures

"Permission denied (publickey)" Root Causes:

1. Wrong IdentityFile path in SSH config (typos like id_es25519)
2. Incorrect file permissions (run chmod 600 ~/.ssh/id_ed25519_*)
3. SSH config syntax errors (tabs instead of spaces)
4. Wrong public key uploaded to wrong account

Debugging Command: ssh -vT git@github-work (verbose output shows key offering attempts)

Repository URL Mismatches

Common Error: Using HTTPS URLs with SSH configuration
Detection: git remote -v shows https://github.com/...
Fix: git remote set-url origin git@github-work:company/repo.git

SSH Agent Issues

Agent Death Symptoms: Previously working SSH stops functioning
Recovery Process:

killall ssh-agent
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519_work
ssh-add ~/.ssh/id_ed25519_personal
ssh-add -l  # Verify keys loaded

Corporate Network Workarounds

Firewall Bypass (Port 22 Blocked)

Solution: SSH over HTTPS port 443

Host github-work
    HostName ssh.github.com
    Port 443
    User git
    IdentityFile ~/.ssh/id_ed25519_work
    IdentitiesOnly yes

Effectiveness: Port 443 cannot be blocked without breaking internet access

VPN Interference

Common VPNs with SSH Issues: Cisco AnyConnect, Zscaler (2025)
Symptoms: SSH works at home, fails at office
Solution: Port 443 workaround or connection multiplexing

Performance Optimizations

Connection Multiplexing

Performance Impact: Eliminates SSH handshake delay for subsequent connections
Configuration:

Host *
    ControlMaster auto
    ControlPath ~/.ssh/sockets/%r@%h-%p
    ControlPersist 5m

Prerequisite: mkdir -p ~/.ssh/sockets

Time-Limited Key Loading

Security Enhancement: Automatic key expiration
Command: ssh-add -t 3600 ~/.ssh/id_ed25519_work (1-hour timeout)
Production Use: ssh-add -c ~/.ssh/id_ed25519_production (confirmation prompts)

Security Critical Operations

Key Rotation Process

Safe Rotation Steps:

1. Generate new key with different filename
2. Add new public key to Git service (keep old active)
3. Update SSH config to new key
4. Test new key: ssh -T git@github-work
5. Remove old public key only after verification

Key Compromise Response

Immediate Actions:

1. Remove compromised public key from all Git services
2. Generate new key pair immediately
3. Update SSH config
4. Notify team if work-related

Common Compromise Vectors:

• Malware scanning ~/.ssh/ directory
• Accidental private key commits to repositories
• Unencrypted cloud storage sync
• Docker container escape exposing host filesystem

Access Cleanup (Job Termination)

Checklist:

1. Remove work SSH public key from personal accounts
2. Delete work private keys: rm ~/.ssh/id_ed25519_work*
3. Clean SSH config (remove work host aliases)
4. Clear SSH agent: ssh-add -D
5. Verify no access to company repositories

Resource Requirements

Implementation Time

• First-time setup: 1 hour
• With SSH config syntax issues: 4 hours
• Key rotation: 15 minutes per key
• Corporate firewall bypass: Additional 30 minutes

Expertise Requirements

• Basic setup: Intermediate command-line skills
• Troubleshooting: Advanced SSH debugging knowledge
• Corporate environments: Network security understanding

Maintenance Overhead

• Key rotation: Every 6-12 months (SOC 2 compliance: 90 days)
• SSH agent restarts: Weekly on Linux systems
• Configuration updates: When changing jobs or adding accounts

Breaking Points and Limits

Scale Limitations

• Maximum practical accounts: 20+ accounts supported
• SSH agent memory: No practical limit for key count
• Configuration complexity: Scales linearly with account count

Platform Compatibility

• Supported OS: macOS, Linux, Windows (Git Bash)
• Git hosting platforms: GitHub, GitLab, Bitbucket, Azure DevOps
• Enterprise requirements: Works with corporate SSO and SAML

Common Failure Thresholds

• SSH connection timeout: Default 30 seconds
• Key authentication attempts: 6 attempts before lockout
• File permission sensitivity: Any world-readable permission breaks SSH

Decision Criteria

When SSH Keys Are Worth It

• Multiple Git accounts required
• Frequent Git operations (multiple pushes/pulls daily)
• Security compliance requirements
• Team collaboration with identity separation

Alternative Comparison

Method	Setup Time	Reliability	Security	Maintenance
SSH Keys + Aliases	1 hour	High	High	Low
Manual Git Config	30 seconds	Low (human error)	Medium	High
HTTPS Tokens	2 hours	Medium (expiration)	Medium	Medium
Multiple Machines	N/A	High	High	Very High

Hidden Costs

• Learning curve: SSH configuration syntax
• Debugging time: SSH troubleshooting can take hours
• Corporate compliance: Key rotation policies
• Platform differences: macOS vs Linux SSH behavior variations

Critical Warnings

Production Deployment

• Never commit private keys to repositories
• Test SSH connections before trusting configuration
• Backup SSH config but never backup private keys to cloud storage
• Use connection multiplexing for performance in automated systems

Common Misconceptions

• Myth: Same SSH key can be used for multiple accounts on same platform
• Reality: Each account requires unique SSH key
• Myth: SSH is automatically more secure than HTTPS
• Reality: Security depends on proper key management and rotation

Silent Failure Modes

• Wrong identity commits: SSH authenticates correctly but uses wrong Git user.email
• Cached connections: SSH config changes ignored due to connection reuse
• IDE Git integration: VS Code/IntelliJ may use different Git binary than terminal

This configuration provides enterprise-grade Git account separation with minimal ongoing maintenance once properly implemented.