Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a benefit to using keys over regular passwords when it comes to logging into a remote server over SSH? (Besides not having to remember/input that password)

share|improve this question

migrated from stackoverflow.com Jun 25 '10 at 22:49

This question came from our site for professional and enthusiast programmers.

4 Answers 4

Is there a benefit to using keys over regular passwords when it comes to logging into a remote server over SSH? (Besides not having to remember/input that password)

Two simple benefits are:

  • Keys are much less guessable. They are generated randomly, so an attacker has to have some access to the key material. This is not true when your password is 'secret'.
  • The access granted to the possessor of the key is configurable in the authorized_keys file per man sshd

Note, however, that having the keys unprotected on disk is LESS secure than having a secure password in your brain. Access to the disk can be gained without your knowledge. I doubt the same is true for your brain. A good approach is a combination of the two: Protect your private key with a secure password.

share|improve this answer

If you put a password on that assymetric key, you can keep using the same password well beyond what your sysadmin has configured for password rotation AND leverage the benefits of two factor security. Lose that laptop with the key on it? You are not nearly as screwed!

share|improve this answer

Yes. If the keypair is compromised -- for example if you lose your laptop with a private key -- you can disable that key on the server and be secure once more.

If you had stored the password on that laptop, you would need to change the password in order to regain a secure system. Now you would also have to change the stored passwords on all you client machines. Much more work :)

share|improve this answer

No, there's not really an advantage.

Asymmetric cryptography makes sense as a solution to the key exchange problem. But, in order for that to work, it requires a third-party "authority", and a PKI. These typically aren't part of an SSH deployment, so it doesn't really help.

One exception would be if you store your private key on a smart card, and your SSH client is smart-card–enabled. The security of the key in a set up like this is a huge advantage over a password.

share|improve this answer
1  
SSH public+private keys don't require a third-party authority or an infrastructure. At worst you provide your public key to the first party in a secure fashion so that they can enable an account for you. –  Slartibartfast Jun 28 '10 at 6:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.