1

I have a question about ssh key, I want to know if is better to set password for ssh key or not? which one is more secure?

Improve this question
2
  • 1
    Why would a key with no passphrase ever appear as anything other than "glaringly insecure"?
    – Ignacio Vazquez-Abrams
    Jul 10, 2018 at 4:35
  • I am not talking about insecure matters. Is pass phrase for ssh key more secure?
    – yasin
    Jul 10, 2018 at 4:38

1 Answer 1

Reset to default
2

If you do NOT put password to your SSH Private Key - then anyone who managed to copy it - can use it. Whether this is considered secure (enough) or not is up to you.

If you put password to your SSH Private Key - then if someone managed to copy your key, they will need your passphrase/password before they can use it. Consider it like a 2 factor authentication - you need both the SSH Privatey Key AND your Password/Passphrase - before it is usable.

I personally believe that putting password/passphrase into SSH key to be more secure, but depends on how you define security or what you believe to be secure.

Improve this answer
2
  • Now, Imagine my server has a bug on for example glassfish. So hackers exploit and get access on my server as a powershell web interface. If I have .ssh/ directory they are able to copy their own public key to get access on my server while if I don't have .ssh/ directory they don't. So what is the best .ssh/ dir permission for denying such accesses?
    – yasin
    Jul 10, 2018 at 4:51
  • @yasin You better off asking question as a separate question topic - rather than as a comment. And also you have the answer here: superuser.com/questions/215504/… (they discusses the permission for the folder, and the individual file)
    – Darius
    Jul 10, 2018 at 4:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.