From: Ruben Vandeginste <Ruben.Vandeginste@...>
Date: 2003-04-13T18:54:11+09:00
Subject: Re: Controlling an interactive program from Ruby



On Sun, 13 Apr 2003, Brian Candler wrote:

> The passphrase on an ssh key tends to be equally weak (or totally
> non-existent, if Daniel's running ssh with RSA/DSA but empty passphrase).
> It's almost as bad as having a script with a password hard-coded in it.
> However you can use a feature in .ssh/authorized_keys which lets you say
> that a particular key is only usable from a certain IP address, and/or only
> for running a particular command.
>
Using an ssh-agent, gives you the benefit that you only have to fill in
the passphrase once. 'ssh-add' (on linux) can be used to add the
passphrase for a given key to the agent. From then on, all ssh sessions
using that key can easily be scripted without the need for giving in
passphrases. This is more secure than using empty passphrases, and also
more secure than storing the passphrase/password in your filesystem.

Ruben