Setting up OpenSSH keys, to avoid having to type a password when logging in to remote systems, is pretty straight forward. In brief:
Generate public and private keys (just hit enter when prompted for a password):
ssh-keygen -t rsa
Then copy the keys to the hosts you want to be able to log in to:
ssh-copy-id hostname
You can pass the -b option to ssh-keygen and specify the number of bits you want to use. The default is 2048. (A lot of articles I've read go with 4096 bits. But then I've also read it doesn't make a whole lot of difference, as RSA is basically secure for the foreseeable future.)
And as an aside, I've actually started going with the -t ed25519 option, which is a newer algorithm. It's not supported everywhere though, so creating fallback RSA keys might be a good idea still.
Also, instead of using ssh-copy-id, you could of course manually edit the ~/.ssh/authorized keys files on remote systems. This is what I used to naively do in fact, but I see no reason not to use the ssh-copy-id command at this point.
If you do password protect your private key, when you attempt to log in to a remote machine, the difference will be that rather than typing in your password on the remote system, you will need to type a password to decrypt your private key. For me, this sorta defeats the purpose since I like not having to type a password (I do realize ssh keys are better from a security standpoint). So enter ssh-agent and ssh-add. With these programs you'll only need to type a password once per session.
Assuming you use bash:
eval $(ssh-agent)
ssh-add ~/.ssh/id_rsa
Even better though, from my viewpoint, is the keychain program. With keychain you should only have to type your password once in between boots. Keychain will start ssh-agent if it's not already running, or connect to a running instance of ssh-agent if it is running as well as add any keys you specify.
In short, I've added this to my bash login scripts:
eval $(/usr/bin/keychain --eval /home/glen/.ssh/id_rsa)
So now, when it comes to SSH keys with passwords I'm a happy campers.
And like always, this blog is mainly for writing practice and personal reference, but if anyone happens to get some use out of it, cheers.
