You don't want passwords, at all, so that you can't be bruteforced. On the otherside, your private key, on your local machine, should be password protected. B

You don't want passwords, at all, so that you can't be bruteforced. On the otherside, your private key, on your local machine, should be password protected. But the node itself should not accept passwords over SSH.