Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I was thinking of using key files for remote SSH access to my server instead of entering the account's password manually at login. On the Internet I found several tutorials on how to do that for Putty, which I am using. All of them recommend to protect the private key file with a passphrase. That makes perfect sense, as I don't want anyone who might gain access to that private key file to access my server without password.

However, then I was asking myself: If I need to enter the key's passphrase every time I use it to connect to my server, why should I bother to use key files then at all? I could simply continue to enter the user's password directly.

Unfortunately I could not find a good answer to this question online.

So I would like to ask you here. What is the reason for using a password protected key file for SSH authentication, instead of simply entering the user's password directly?

share|improve this question

marked as duplicate by voretaq7 Jun 7 '13 at 16:40

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

The quick answer is that with key auth, you never send your password over the network (it's entered locally to authenticate the key), so there's no opportunity for someone on the network to intercept any password attempts. It's more secure.

To your point about having to constantly type it, there are agents (PuTTY's pagent most notably) that will cache the keys in memory, so you only have to type the password once. It's very convenient.

share|improve this answer
    
Ok thanks, that makes sense. Would that key agent also allow to automatically access the server then from a scheduled task (for backup from the server)? That was my original intention of using key files. –  Matthias Jun 7 '13 at 15:34
    
I haven't done that firsthand, but I believe that's exactly how you would do it. –  Jim G. Jun 7 '13 at 15:54

If someone steals your key somehow, you're compromised.

Putty includes something (if you used the installer) called Pagent which you can load the key files in and only type the passwords once. The key adds another layer of security since simply brute-forcing a password won't do any good since they need the key too.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.