I use two computers every day, my home server which is a desktop system and my laptop. Both systems run xubuntu and, being mostly a command line user, I use ssh to connect between the systems, to connect to various headless Raspberry Pis and Beaglebone Blacks and to connect to remote servers.

At present I have a slight preference for using password authentication as opposed to public-key for the following reason:-

My laptop and desktop machines both stay turned on nearly all the time. The desktop is always on because it's a mail server (and the DNS for my LAN), the laptop stays on simply because it's convenient. My key files are encrypted (i.e. they have a passphrase) but are automatically decrypted and put into ssh-agent when I log in. Thus any login that uses my default key is passwordless and passphraseless at the time of use. So, anyone walking up to my turned on system can log in to any remote ssh server where I have set up public-key authentication. If I use password authentication the remote server will need a password for login.

Thus for me in my default situation it feels as if password authentication is more secure, not in the sense of the password itself being 'stronger' than a public-key but in the sense that it makes my overall use of remote systems more secure.

Have I missed anything obvious here or does the above analysis make reasonable sense?

  • Anyone walking by can drop an one-liner to your .bashrc and backdoor sudo, ssh, su...
    – ThoriumBR
    Jan 2 at 12:18
  • 1
    wrt 'anyone walking up to my turned on system can log in to any remote ssh server where I have set up public-key authentication' - why not keep your system locked when you are not using it?
    – mti2935
    Jan 2 at 12:48
  • 1
    what a backwards way of protecting your connection... using Passwords (that travel over the line) in favor of using public keys because you foolishly automatically add them to your ssh-agent... without even checking how you could secure your agent... (you can add timeout, re-auth requirements for new connections, use something like Keepass XC to manage your keys inside the agent.... ). and why not just lock your system... or if you can't use Kee[ass XC and lock just that... nothing about your security profile improved by using passwords... all you did was lower your keys security.
    – LvB
    Jan 2 at 15:32
  • My systems are actually fairly secure in that they are not left around in public! Jan 3 at 13:30
  • 1
    Why are you asking? You are not following the best practices you are already aware of, because you have an own idea of what seems more secure to you. It is unlikely you would be taking any of the advices given here, either. Jan 4 at 5:04


You must log in to answer this question.

Browse other questions tagged .