On Thu, Apr 14, 2005 at 01:11:13PM -0500, McKown, John wrote:
| Just for grins and giggles, I created an SSH private key/public key
| pair. I can now use PuTTY to logon to Linux without using my Linux
| password. Instead, I must use a "Passphrase". What have I gained? I did
| replace my password with a passphrase, but how is that more secure? I
| don't see a way to say: "This passphrase must be used when doing an SSH
| from that incoming IP address." Am I missing something? (very likely). I
| could use a different private/public key for each server that I use SSH
| with, I guess. But I've only got one server, so far.
I don't know about PuTTY since my desktop is penguin powered. But with
OpenSSH I can enter my passphrase just once (per whatever cycle ssh-agent
is restarted) and the agent will keep the decrypted copy of my private
key handy, but prevent it from going to disk or swap space. Power off
and it's gone. This lets me do all the logins to all machines that accept
that key, as well as other things that establish ssh sessions, such as
rsync and many scripts I've written, to also login without any interaction
needed from me. Just kill the agent when going to lunch or home for the
day. If your computer is stolen, only the encrypted private key is in
their hands, and to the extent of the strength of encryption, they cannot
use it.
I don't know if PuTTY or Windows can ensure the safety of your decrypted
private key by making sure it can only be in RAM and never get swapped or
written to disk.
What advantage is this over traditional passwords? That you do not have
to re-enter the pass{word,phase} every time, but with as much security or
more. Excessive password entry is actually a security risk as it exposes
the password more often to potentially prying eyes, webcams, etc.
--
-----------------------------------------------------------------------------
| Phil Howard KA9WGN | http://linuxhomepage.com/ http://ham.org/ |
| (first name) at ipal.net | http://phil.ipal.org/ http://ka9wgn.ham.org/ |
-----------------------------------------------------------------------------
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
