Why is passwordless ssh not a terrible idea?

Question

So, I generated a passwordless key pair and uploaded it to all of my remote accounts. And now I can log in to all of my remote accounts with extreme ease and comfort. And so can a malicious user which (somehow) gains access to my account which has the private key (my home computer). So, why do people still use passwordless logins? It sounds like a terrible idea, keeping all of your eggs in one basket. Am I becoming paranoid? :-D

Answer 1

Not quite sure what you're looking for here; "passwordless" logins (no password on a private key, as described in the original question) are always a bad idea, and the only situation I've seen to try and justify them (automatically logging into a non-shell account to trigger a predefined server-side script which runs any time that key is used to log in) can be replaced with much more secure manners.

However, "passwordless" logins in the conventional sense (using private/public keypair instead of keyboard interactive or password), are generally far better as long as you can keep the private key secure, which is most commonly done by encrypting the key with a password. While yes, you chose to protect your key with a password, that's not a part of the authentication as far as the system is concerned (the key itself is all that the system cares about, not what you have to do to provide it), so this is what most people refer to when they say "passwordless" logins.

Answer 2

You shouldn't have a passwordless key that is used by a person. People who suggest that are suggest are usually being overly-lazy. Your private key should have a password, and you should use the ssh-agent to you only have to unlock the key-once.

There are some cases where a service needs remote non-interactive access to another service. In this case a password-less key may be appropriate. But this service key should almost always only be used for a single service and the account that is access should have other protections in place. For example you might setup a key to restart/manage some service on a remote system. You would not setup this key for the root-account, you would set it up to a un-privileged account, then grant only the required privileges via sudo or something else.

Answer 3

A passwordless ssh key is a terrible idea, though it's probably better than using clear-text passwords. (If it needs to be used non-interactively, it can be an acceptable terrible idea, because there isn't really a good alternative, but then you have to guard the private key very carefully; see @Zoredache's answer.)

For interactive logins, the best practice is to generate a key pair with a passphrase, and use ssh-agent to hold the decrypted private key. You can use ssh-add -t ... to cause the private key to expire after a specified time.