Double-reading the man page I noticed that IdentitiesOnly makes ssh only send IdentityFile keys, however IdentityFile has a default of "~/.ssh/id_dsa, ~/.ssh/id

Double-reading the man page I noticed that IdentitiesOnly makes ssh only send IdentityFile keys, however IdentityFile has a default of "~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 and ~/.ssh/id_rsa". The result is that with this configuration you would still send id_rsa to unknown hosts. You also need to add "PubkeyAuthentication no" to your global stanza, and re-enable it for good hosts. # Ignore ssh-agent keys IdentitiesOnly yes # Disable public key authentication PubkeyAuthentication no # Send your public key to github only Host github.com PubkeyAuthentication yes IdentityFile ~/.ssh/id_rsa More instructions: https://github.com/FiloSottile/whosthere#how-do-i-stop-it https://github.com/FiloSottile/whosthere#how-do-i-stop-it