Why to use Key's Passphrase in SSH ?

Using a passphrase with your SSH key provides an additional layer of security by adding a secret password to your key. When you generate an SSH key pair, you can add a passphrase to the private key, which is essentially an encryption key used to protect the key itself.

Here are a few reasons why you might want to use a passphrase with your SSH key:

1. Protects your private key: If someone gains access to your private key, they can potentially log in to any server where you have installed the corresponding public key. By adding a passphrase to the key, you can prevent unauthorized access to the key itself, even if someone gains access to the file that contains the key.

2. Prevents unauthorized access: If someone gains unauthorized access to your local machine, they won't be able to use your SSH key to log in to remote servers without the passphrase. This can help prevent unauthorized access to sensitive systems.

3. Adds an additional layer of security: Even if someone knows your passphrase, they still need to have access to your private key in order to use it to log in to remote servers. This adds an additional layer of security to the authentication process.

It's important to note that adding a passphrase to your SSH key can make the authentication process slightly more cumbersome, as you need to enter the passphrase every time you use the key. However, the added security is generally considered worth the inconvenience. 

When you use an SSH agent, you can also use the `ssh-add` command to add your key with passphrase to the agent's cache, so you only need to enter the passphrase once per session, rather than every time you use the key.

Here's an example of how to generate an SSH key with a passphrase using the `ssh-keygen` command:

```

ssh-keygen -t rsa -b 4096 -C "your_email@example.com" -f ~/.ssh/id_rsa_mykey

```

In this example, we're generating an RSA key pair with a key size of 4096 bits, and we're specifying a custom filename for the private key (`id_rsa_mykey`). The `-C` option is used to add a comment to the key, which can be useful for identifying the key later. The `-f` option specifies the filename to use for the key files.

After running this command, you'll be prompted to enter a passphrase for the private key. This passphrase will be used to encrypt the private key file, so make sure to choose a strong passphrase and keep it safe.

Once you've generated the key pair, you can add the public key (`id_rsa_mykey.pub`) to your remote servers as needed, and use the private key (`id_rsa_mykey`) to log in to those servers. You'll be prompted to enter the passphrase each time you use the private key.

If you're using an SSH agent, you can use the `ssh-add` command to add the private key to the agent's cache, like this:

```

ssh-add ~/.ssh/id_rsa_mykey

```

This will prompt you to enter the passphrase for the key, and then add it to the agent's cache. You can then use the key to log in to remote servers without having to enter the passphrase again.

More about : SSH-KEYGEN , SSH-COPY-ID , RSA , DSA & ECDSA