poll: when you create an SSH key, do you set a passphrase?

@b0rk Set a passphrase, then promptly forget it. This is the way.

@b0rk all my SSH keys with full access to the target account, used interactively, have passphrases. But when I need something automated like a cron job to SSH from one machine to another, it needs a passphraseless key, so instead I limit the capabilities of that key by only entering it in authorized_keys files with lots of restrictions, including a forced command.

My aim is that every key _either_ has a passphrase, _or_ very limited usefulness.

@simontatham interesting, i didn't know you could put restrictions in an authorized_keys file!

@b0rk Chose "it depends" as i strictly use throwaway SSH-Keys on yubikeys nowadays. The Yubykey has a passphrase/ID step.

@skade that seems like a nice way to do it

@b0rk wow, I am genuinely very surprised by the results of this poll. Thank you for asking the question.

@gnomon me too! i don't know what I expected but it was not this.

a follow up poll: if you secure your SSH keys, do you do it with:

(if you don't secure your SSH keys, the previous poll in this thread is for you!)

@b0rk I'm using GPG for my SSH auth, and while there's a passphrase with GPG, I also have it tied to my yubikey, so... passwordless, as long as that's plugged in.

@b0rk I have many keys with different levels and security. Some keys have passphrase, some are stored in password manager, other in yubikey, I could tick all boxes :-)

@b0rk All of the above, depending on situation.