From: Brian Candler <B.Candler@...>
Date: 2003-04-14T17:00:51+09:00
Subject: Re: Controlling an interactive program from Ruby

On Mon, Apr 14, 2003 at 08:23:59AM +0900, Daniel Carrera wrote:
> On Sun, Apr 13, 2003 at 06:38:19PM +0900, Brian Candler wrote:
> > The passphrase on an ssh key tends to be equally weak (or totally
> > non-existent, if Daniel's running ssh with RSA/DSA but empty passphrase).
> 
> Well, I'm not.  I realize how silly that would be.  My passwords are 
> acutally fairly good.

OK - but then you must be supplying the passphrase to ssh somehow (and the
original thread was because you had problems supplying a normal password to
ssh)

Perhaps you are using ssh-agent? I had forgotten about that.

> > There are lots of other side-benefits to RSA/DSA authentication though - for
> > example being able to use the same key on lots of systems without any
> > security drawbacks, and being able to change the passphrase on your private
> > key whenever you like without having to log into all those systems. Strongly
> > recommended.
> 
> That's interesting.  Where can I learn more about that?
> I understand RSA from a mathematical perspective, but I'm not familiar 
> with these other advantages you point out.

At the client side, your private key is encrypted with a symmetric cipher,
where the symmetric key is a hash of your passphrase. Hence if someone hits
you over the head and steals your laptop, the private key is no good to them
unless they break the symmetric cipher. They have to look over your
shoulder, watch you type your passphrase, *then* hit you over the head and
steal your laptop :-)

There's an O'Reilly book on SSH which I've not seen but apparently is good.

Cheers,

Brian.