To make working with SSH keys more secure, you should use a more convenient option.
So what can you do?
Well, the problem is that when you are using passphrases, entering a passphrase for every
single command is inconvenient.
If you are in a bash shell, you can use SSH agent bin bash to allocate space in the bash
shell to catch the private key passphrase.
After doing so, you need SSH add to add the current passphrase to the cache.
Now cached passphrases stay available for the rest of the session duration.
And if you are in a GNOME graphical environment, it's even easier because there you use the
GNOME keyring daemon that automatically caches SSH private key passphrases.
Let me show you.
So for the first part of this demo, I'm going to open a new virtual terminal.
And on this virtual terminal, I'm going to recreate my SSH key pair.
I'm doing this from a virtual terminal because I do not want to use the GNOME keyring daemon
because that only works from a graphical environment.
And who knows?
On the exam, you might be working from service that don't have a graphical environment.
So if I want to use passphrases, I need to SSH keygen again.
So I'm pressing enter, and then it's telling me, hey, this file already exists.
Do you want to overwrite?
Yes, I want to overwrite.
And next, I'm going to enter my passphrase.
There's no security requirements for passphrases, so make it as insecure as you want.
The thing is that you have a passphrase.
So using SSH copy ID to copy it over to the remote host, which is on 143.
And now the key has been installed on the remote host.
Good.
So what happens if I use SSH to 192.168.29.143?
Well, it's prompting for the passphrase.
And now I'm on the remote host.
And what happens if I use exit and I connect again?
Well, this is the point that I was making.
It's entering for the passphrase over and over again.
So what are we going to do about it?
Well, we are going to use SSH agent slash bin slash bash.
And then SSH add.
And that is prompting for the passphrase.
So I'm entering the passphrase.
And now the identity has been added.
And the benefit is that if I'm going to connect to the remote host again using SSH followed
by its IP address, then I don't have to enter the passphrase anymore.
This passphrase will be cached for the duration of my session.
So when I exit my session and I open a new session, I will need to do this again.
As I mentioned, in the GNOME graphical interface, this has been made a little bit easier.
Let's get back to the graphical interface using sudo chvt2.
So what happens if here I'm using SSH to 192.168.29.143?
There we go.
This is this GNOME keyring daemon.
And the GNOME keyring daemon is telling me, hey, an application wants to access a private
key, but it is locked.
And I am going to enter this passphrase right now.
Once I click automatically unlock this key, whenever I'm logged in and I'm clicking unlock,
and it's a done deal.
So now I'm on the remote host.
And when I do it again, the passphrase is cached.
So the graphical interface really makes this a lot easier.
But don't forget, on Surface, you don't always have a graphical interface.