[rjh29]

This seems like bad advice, password auth is less secure than key auth^. And many servers don't accept password-based auth at all.

^password is sent to the server directly; passwords are generally weak and easy to brute force. Pubkeys without a passphrase _can_ be stolen from the local machine, but if an attacker has access to your local machine, you are probably SOL anyway.

edit: as several people have pointed out, this config option does not completely prevent pubkey auth being used (i.e. if configured or overriden on the command line). But if you only use that config by itself, it will disable pubkey authentication for every host.

[addingnumbers]

That's a petty interpretation, it's a big leap reading "don't send your unique identity to strange servers by default" as "never use private keys, always use passwords instead."

Nothing about that config snippet precludes using private keys for known servers.

[rjh29]

Well that is how I read it :P I think it would be good to point out that you can add other Host sections to override it.

[alexeldeib]

It’s about preventing identity leakage, not using password. I can’t tell if the post was edited, but it already includes how to override per host.

I value this and I universally disable password auth…on the server :)

E: as listed by others, IdentitiesOnly=yes seems like a better approach?

[nerdbert]

I have that line in my .ssh/config and I never use password auth.

I explicitly list every server that I want to connect to in the config file, so I know exactly what is going to happen.

[cryptonector]

You can disable password authentication as well.