On my Linux machine (Alice), I am setting up a service account with an rsync cron job that will synchronise some files with a remote host (Bob). Obviously, I would want to make the rsync secure by using SSH with a keypair.
So my question is: is there any point in passphrase-protecting the private key?
If I passphrase-protect the private key, obviously I wouldn't put the passphrase in the cron job script. I would need to set up a persistent background
ssh-agent process so that the cron job can use it. But then doesn't it somewhat defeat the purpose of the passphrase-protection? If someone can break into Alice, can't they just use the persistent
ssh-agent to do all the bad things they need to?
The only (slight) advantage, I believe, is that even if the intruder can copy the private key, they would not be able to use it elsewhere because they don't know the password.