I have 2 Ubuntu 14.04 servers with
openssh-server installed on both.
I've set up key-based authentication using RSA keys, without passphrase, so that I can run automated backup scripts, to a remote site, with rsync.
I normally do the key exchange over a lan network, while password based login is still enabled, I then disable password only ssh, before taking the remote server to its off-site location. So any users log in through keys with passphrase, and automated scripts use keys without passphrase.
To share keys I use the
All commands for off-site use a high non-standard port on the external modem/router, forwarded to the router on subnet, which then NAT addresses to the standard 22 port on the remote server.
If I wanted to add a new user's key, I could use a current user to enable password only login, which would make it possible to use
ssh-copy-id (as it requires the user's password. After using
ssh-copy-id to set up key-based ssh, I would disable password based login afterwards.
Is there any risk in using
ssh-copy-id over an internet connection?