How do I stop SSH offering the wrong keys?
Use an explicit identity with IdentitiesOnly=yes for the affected connection. This avoids offering every eligible key from an agent. You can apply the setting to one host alias without clearing the agent or changing other server profiles.
Instructions
1. Inspect loaded public identities
Review the fingerprints so you can identify whether the intended key is available.
ssh-add -lThis lists agent-held public fingerprints. An empty agent is acceptable when you pass a private-key file directly.
2. Limit one connection
Use the matching private file for the intended account.
ssh -o IdentitiesOnly=yes -i "$env:USERPROFILE\.ssh\server_ed25519" adminuser@203.0.113.10SSH restricts identity selection to the configured identity instead of trying unrelated agent keys.
3. Make the correction host-specific if needed
If the command works, add IdentityFile and IdentitiesOnly to that server’s Host block. Inspect it with ssh -G. Avoid deleting all loaded identities, because that can interrupt other legitimate workflows.
Check the result
- The connection uses the intended public-key fingerprint.
- The login succeeds without exhausting the server’s authentication-attempt allowance.
Troubleshooting
- The selected identity still fails
- Check that its public key is enrolled for the chosen remote account.
- The agent contains a key you no longer need
- Remove that specific identity with ssh-add -d and its public-key file, after checking that no other workflow requires it.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.