Safer Access without Passwords

For passwordless entry, I'd recommend looking into true single sign on solutions. Kerberos, for instance, has done a great job with creating a secure key management, as well as addressing the concerns noted above.

It also integrates cleaner (IMHO, though not completely) with Windows logins.

Just two cents to through out there in the discussion.

I too was hoping to see more discussion of passwordless as in smartcards, or biometrics, etc...

Hi, nice post but I feel the tile is a bit misleading... I really thought there won't be any password at all, not even RSA or DSA (which are password-like and even you mentioned that "Having a 1024 bits long key can be thought of as having a 128 characters long password"). Thus, an option for the tile of this article could also have been "safe access without typing passwords". Don't get me wrong, I just gave the reason why I was expecting to read something else in this post.

Now, the content is correct and I'd like to add here (as it might be the right spot) the way in which a key could be copied from the local machine's .ssh/id_rsa.pub into the server's .ssh/authorized_keys:

$ cat .ssh/id_rsa.pub | ssh user@server 'cat >>/home/user/.ssh/authorized_keys'

Of course one needs to know the exact location of the authorized_keys file and to have rights to write it.

I personally like using these rsa or dsa keys but the drawback of the method is that one might forget the actual password because of its highly decreased usage. :-)

How do you know DSA is safer than RSA? I've looked for this online and I cannot find any references.

but your private ssh key needed passphrase at all, but it really safer than using simple password.

[quote]This is what the ssd-copy-id command does for you.[/qoute]

There's a typo here, ssd-copy-id should be ssh-copy-id.

Yeah, after we used keys in our enviroment instead of passwords, that worked wonders in memorizing stuff. One sure way to amplify the security is to block off root from remote access/SSH and just make sure that the remote user is just a plain user (potentially in the sudoers list). Elevating the permissions once you have remote access to the box is another thing to be considered aside from shell accesss.
While physical security is another aspect of the overall security recommendation, loosing (or leaking) your keys represents a bigger problem than just loosing that. It begs the question: what else are you loosing?
Ah, but yes, going back to using keys instead of passphrases, and the other bigger implementation of having transparent authenticationvia keys to log on multiple hosts via SSH (after taking care of both perimeter and physical securiity) is a beauty.

Nice job but you forgot a step or maybe you should add this feature. There is not mention of the agent. You need to do script or run the following commands.

ssh-agent
ssh-add

If you don't do this the remote server will ask you for your passphrase.
You do this then you just type user@server and your in, no intervention needed.

You need a script if you don't want a lot of agents running.

I’m amazed this article does not put more emphasis on entering a passphrase, in fact it almost suggests that it is optional. Creating a private key that is not encrypted is a major security risk, especially if your computer is compromised and your private key is stolen.

I don't like writing my passwords into a text file or an excel. If someone gets access to this file he will have access to all my accounts and servers.

I prefer to memorize the password, or better yet the formula, so no one can steal it from me.

The private key is not so different than a plain text file with the passwords. If your computer gets compromised your password can be stolen simply by copying a file.

Of course if your computer gets compromised you have to face the risk of a keylogger as well, which is effective against any password.

Then there's the mobility as well. If you use a memorized password you will not have to worry about carrying a USB drive with your private key in a truecrypt container or whatever way you protect the data from losing it or being stolen. And you will not have to worry about securely deleting the private key from whatever computer you decide to use it. Just, again, only about the keyloggers.

I suppose what I am saying is that there is no magic solution for security, everything has it's risks and it's benefits. Just use whatever method fits better in your case.

Of course there's always the option to use a public/private key and a password if you are paranoid enough ;-)