I have a question about ssh key, I want to know if is better to set password for ssh key or not? which one is more secure?
1Why would a key with no passphrase ever appear as anything other than "glaringly insecure"?– Ignacio Vazquez-AbramsJul 10, 2018 at 4:35
I am not talking about insecure matters. Is pass phrase for ssh key more secure?– yasinJul 10, 2018 at 4:38
If you do NOT put password to your SSH Private Key - then anyone who managed to copy it - can use it. Whether this is considered secure (enough) or not is up to you.
If you put password to your SSH Private Key - then if someone managed to copy your key, they will need your passphrase/password before they can use it. Consider it like a 2 factor authentication - you need both the SSH Privatey Key AND your Password/Passphrase - before it is usable.
I personally believe that putting password/passphrase into SSH key to be more secure, but depends on how you define security or what you believe to be secure.
Now, Imagine my server has a bug on for example glassfish. So hackers exploit and get access on my server as a powershell web interface. If I have .ssh/ directory they are able to copy their own public key to get access on my server while if I don't have .ssh/ directory they don't. So what is the best .ssh/ dir permission for denying such accesses?– yasinJul 10, 2018 at 4:51
@yasin You better off asking question as a separate question topic - rather than as a comment. And also you have the answer here: superuser.com/questions/215504/… (they discusses the permission for the folder, and the individual file)– DariusJul 10, 2018 at 4:53