<story><title>SSH key and passwordless login basics for developers</title><url>http://opensourcehacker.com/2012/10/24/ssh-key-and-passwordless-login-basics-for-developers/</url></story><parent_chain></parent_chain><comment><author>apawloski</author><text>This was mentioned before, but if this post gains traction it&apos;s worth talking about again:&lt;p&gt;It is almost totally unnecessary to maintain multiple key pairs for multiple purposes if they&apos;re going to be stored on the same machine (eg separate key for github). If one of these services is compromised, an adversary will only get your &lt;i&gt;public&lt;/i&gt; key, which is useless. This is very different than the security practices of symmetric passwords.</text></comment>
<story><title>SSH key and passwordless login basics for developers</title><url>http://opensourcehacker.com/2012/10/24/ssh-key-and-passwordless-login-basics-for-developers/</url></story><parent_chain></parent_chain><comment><author>thaumaturgy</author><text>Unless I missed something while skimming this, they&apos;re suggesting that you set your password to &quot;something random&quot; and then go on to use ssh keys. This means that a brute force attack is still feasible (if super incredibly unimaginably unlikely). Better still is to use, &apos;passwd -d -l [user]&apos;, which will delete the password (it creates a nonsense hash value, &quot;&quot; I think) and then lock it.&lt;p&gt;While you&apos;re messing about with config files, make sure that &quot;PermitRootLogin&quot; in /etc/ssh/sshd_config is set to &quot;no&quot; (this is now default in most distributions I think), and also add an &quot;AllowUsers [user] [other user] [...]&quot; line thereabouts, which will help to protect you from misbehaving packages or someone attempting to add remote users to your system without your permission.&lt;p&gt;It should go without saying that if you do all this, and you somehow lose your private key, and you don&apos;t have a good backup as the article suggests (for whatever reason), and you don&apos;t have some kind of local console access, then you&apos;re pooched. Private key management is easy to screw up, so don&apos;t scoff. Make sure you have some other way of accessing your machine if you can&apos;t get to your private key.</text></comment>