5 ms·

Is it a bad practice to have the private key left unencrypted? It seems easily stoleable. On the other hand, if I had to type the decryption password each time

Is it a bad practice to have the private key left unencrypted? It seems easily stoleable. On the other hand, if I had to type the decryption password each time I wanted to connect, I wouldn't see the benefits of the hassle (not even talking about the ability to easily change user password on the server if needed for security purposes)

panpanna 7y ago
The system password manager usually takes care of that so you only type your password once.
- chopin 7y ago
  I use this for my desktops but does it also work if you only have a console?
  - mschuster91 7y ago
    Yes, ssh-agent can also work in a terminal-only environment. Specify "ssh-agent add" in your .bashrc and you're all set.
    - johnisgood 7y ago
      It even works with GnuPG! You will need to create ~/.gnupg/sshcontrol[1], then run: $ export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket) $ gpg-agent --enable-ssh-support If you get an error[2] when you are trying to ssh into a machine, you may need: $ gpg-connect-agent updatestartuptty /bye > /dev/null For information as to how to create an authentication subkey: https://www.gniibe.org/memo/software/gpg/keygen-25519.html https://www.gniibe.org/memo/software/gpg/keygen-25519.html [1] You need to add your authentication subkey's keygrip which you can get using: gpg --list-keys --with-keygrip or the like. Separate the keygrips with a newline, and IIRC you need to have a newline at the end of the file as well. [2] For example: "sign_and_send_pubkey: signing failed: agent refused operation".
GTP 7y ago
The benefit is having a much more secure "password" (the ssh key) than the password that you have to remember. The password you use to encrypt your key doesn't need to be a really strong one since it's only proupose is to give you enough time to change your key if your pc gets stolen or the key is leaked in some other way.

panpanna 7y ago

The system password manager usually takes care of that so you only type your password once.

chopin 7y ago
I use this for my desktops but does it also work if you only have a console?
- mschuster91 7y ago
  Yes, ssh-agent can also work in a terminal-only environment. Specify "ssh-agent add" in your .bashrc and you're all set.
  - johnisgood 7y ago
    It even works with GnuPG! You will need to create ~/.gnupg/sshcontrol[1], then run: $ export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket) $ gpg-agent --enable-ssh-support If you get an error[2] when you are trying to ssh into a machine, you may need: $ gpg-connect-agent updatestartuptty /bye > /dev/null For information as to how to create an authentication subkey: https://www.gniibe.org/memo/software/gpg/keygen-25519.html https://www.gniibe.org/memo/software/gpg/keygen-25519.html [1] You need to add your authentication subkey's keygrip which you can get using: gpg --list-keys --with-keygrip or the like. Separate the keygrips with a newline, and IIRC you need to have a newline at the end of the file as well. [2] For example: "sign_and_send_pubkey: signing failed: agent refused operation".

GTP 7y ago

The benefit is having a much more secure "password" (the ssh key) than the password that you have to remember. The password you use to encrypt your key doesn't need to be a really strong one since it's only proupose is to give you enough time to change your key if your pc gets stolen or the key is leaked in some other way.