Configure SSH host aliases

The previous lesson separated your Git author identity by directory. Authentication has the same problem one layer down: GitHub identifies you by whichever SSH key you present, and with a personal and a work account on one Mac, “whichever” is doing a lot of work.

SSH host aliases let one service have separate personal and work identities. You invent a hostname per identity, and each one pins its own key. The alias becomes the hostname in the Git remote while HostName keeps the real server.

Write the alias

Example ~/.ssh/config entry:

Host github-work
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519_work
  IdentitiesOnly yes

Host github-work is the made-up name you will type. HostName github.com is where the connection really goes. IdentityFile names the key for this identity.

IdentitiesOnly yes is the line people omit and regret. Without it, the SSH agent offers every loaded key in order, and GitHub accepts the first valid one — often your personal key, even on a connection you aliased for work. The setting means: for this host, offer this key and nothing else.

Protect the configuration and private key permissions:

chmod 600 ~/.ssh/config ~/.ssh/id_ed25519_work

SSH refuses keys that other users could read, and the config file deserves the same treatment. No step here ever copies a private key anywhere — each identity’s key stays where it was generated.

Test, then use it in remotes

Test with ssh -T github-work:

ssh -T github-work
# Hi flavio-acme! You've successfully authenticated, but GitHub does not
# provide shell access.

Read the username in that greeting carefully. It names the account your key actually mapped to — this is the verification step, and the greeting saying the wrong account is exactly the failure this lesson prevents.

Then use a remote such as git@github-work:team/project.git:

git remote set-url origin git@github-work:team/project.git

The remote now encodes the identity. Anyone (including future you) can read git remote -v and know which account this repository speaks as — no agent luck involved.