When I first learned how to make ssh keys, the tutorials I read all stated that a good passphrase should be chosen. But recently, when setting up a daemon process that needs to ssh to another machine, I discovered that the only way (it seems) to have a key that I don't need to auth at every boot is to create a key with an empty passphrase. So my question is, what are the concerns with using a key with no passphrase?
Ssh – Is it okay to use a SSH key with an empty passphrase
Securityssh
Related Topic
- Ssh – How to automate SSH login with password
- Security – Our security auditor is an idiot. How to give him the information he wants
- SSH – Putty Private Key and Passphrase
- Ssh – How safe is it to protect an ssh key without passphrase using the “command” option in the authorized_keys file
- SSH Key Authentication – How to Set Up SSH Key Authentication Using LDAP
- Linux – Copy ssh key or create a new one
Best Answer
A key with no passphrase is reliant upon nobody else being able to get at that key (who wouldn’t be able to get at the resources it gives access to anyway). So, if the key grants access to a machine next to it, and both machines have the same level of electronic and physical security, then it’s not really any big deal.
On the other hand, if your key is on a machine with poor security (perhaps it has many untrusted users, is easily physically accessible, or isn’t kept well up-to-date with its patching regime), then you probably don’t want to keep passphrase-less keys on there.
Ultimately, it’s down to confidence in your setup and weighing up the risks/costs of doing it — if you can be pretty confident that it’s not realistically easier for an attacker to gain access to the key than to the resource the key gives you access to, then you’re fine. If you don’t have that confidence, you should probably fix the reasons why :)