Contents
Is SSH with password Safe?
The first pro is that SSH keys are more difficult to hack than passwords and thus are more secure. SSH keys can be up to 4096 bits in length, making them long, complex, and difficult to brute-force hack. And unlike passwords, your private SSH key isn’t sent to the server.
What should be the password for SSH key?
In practice, however, most SSH keys are without a passphrase. There is no human to type in something for keys used for automation. The passphrase would have to be hard-coded in a script or stored in some kind of vault, where it can be retrieved by a script.
How to generate a passphrase for a SSH key?
$ man ssh-keygen […] It is possible to specify a passphrase when generating the key; that passphrase will be used to encrypt the private part of this file using 128-bit AES. So this passphrase just encrypts the key locally. An attacker with access to your system will not be able to read the private key, because it’s encrypted.
What happens if I Lose my SSH passphrase?
No Way To Recover Forgotten Passphrase. IMPORTANT: you cannot overwrite a forgotten passphrase. If your SSH key is encrypted, you must have the original passphrase to decrypt the key and save it with the new passphrase. If passphrase is lost, you can’t decript the key so access to it is lost until you recover the passphrase.
Which is stronger a password or a SSH key?
The balance of evidence strongly suggests that passwords are weaker and keys are stronger. With passwords, then the password is sent to the server, so the safety of the password is relative to how well the server protects whatever it uses to verify passwords (e.g. the /etc/shadow file).
What happens when the SSH key is not encrypted?
When we encrypt SSH keys, the risk of SSH key stolen remains the same (still just as easy to copy id_rsa file), but the likelihood of it actually being used is minimised because the key will be encrypted with the passphrase that only you know. When the SSH key isn’t encrypted, ssh-keygen -p command will not ask for the old passphrase: