Ssh password and passphrase

Ssh password and passphrase 1. Use the default path ssh-keygen-t rsa and enter passphrase. 2. scp/root /. ssh/id_rsa.pub remote:/root /. for ssh/authorized_keys, enter the password of the root account on the remote machine 3, eval 'ssh-agent' 4, and passphrase entered before ssh-add. Note that step 1 and Step 2 are used to generate an rsa public/private key pair. The first step is to generate a key pair. The id_rsa file contains a private key and id_rsa.pub is the public key. You can also generate a dsa key pair. The second step is to attach the public key to the remote host/root /. ssh/authorized_keys file. Because the file is empty, scp is used directly. If it is not empty, scp is used to access the temporary file first, and then cat is used. Step 3 and Step 3 are used to prefabricate Passphrase. step 3: run the ssh-agent output (this is the eval inversion function). Two environment variables SSH_AUTH_SOCK and SSH_AGENT_PID are set, in this way, the program can access the ssh-agent program in the background and set passphrase in step 4. After completing these four steps, no passphrase is prompted for ssh or scp. If only step 1 and 2 are completed, a prompt is displayed, indicating passphrase. If none of them are used, the system prompts you to enter the account password on the remote machine. Passphrase is used to encrypt the private key of the key pair and does not spread over the network. Disadvantage: You must perform this operation on every Logon at 3, 4. Because 3 sets environment variables, different logins are different. But for shell, it can be executed in. bash_profile, or for cron scripts, it can be set and executed in the script; 4 is even more fatal because it is interactive and cannot be customized. Solution: Set passphrase to null, so that step 3 and 4 are saved. Appendix: The ssh-agent program is like a gatekeeper. It provides secure access to the security key as needed. After the ssh-agent is started, it runs in the background and can be used by ssh, scp, and other OpenSSH applications. This allows the ssh program to request a decrypted key, instead of asking you for a secure password for the private key every time you need it.