Anne Wilson wrote:
Everything is set up exactly as you say, except that there is a
passphrase. Surely you lose security if you remove it?
If you want automated scripts to be able to connect without you typing in a
passphrase, you have to have the passphrase stored somewhere, at which point
it doesn't really add any security anymore (you just have 2 files the
attacker would have to read instead of 1; in both cases, he or she needs a
way to read files which are supposed to be readable only by you (and root,
unless it's a daemon which dropped the dac_override capability)).