5/2     Okay, I think I get it now.  If I want password-less login to
        soda, then I need to do the whole generating the public and private
        keys which requires a pass phrase, if I can put up with entering
        my unix password every time in SSH or PUTTY, then I don't need
        to do the whole ssh-keygen stuff.  Is it correct?
        \_ Yes.  But if you go password-less, then if soda is compromised
           again, you won't need to change your unix password.
           \_ why is that?  if soda is compromised then they have access
              to the unix password too.
              \_ Not if you didn't type it in while soda was compromised. -tom
                 \_ Unless it was cracked, which basically depends only on
                    how motivated the attacker is. -gm
                    \_ This is why a couple of soda users choose not to have
                       passwords at all -- they have "*" for their password
                       in /etc/shadow, so ssh keys are the only way they can
                       log in.  For those users, an attacker who gets soda's
                       password file won't have anything to crack.  --mconst
                        \_ how do you put * in /etc/shadow?  I can't even
                           view it?  so if I don't want to use unix password,
                           I need to ssh-keygen on my client server, then copy
                           the generated public key to soda under .ssh/ folder?
                           I should not copy my private key on soda though, right?
                           \_ Unfortunately, it's not possible for you to do
                              this yourself.  If you really want to have no
                              password, mail root and we can remove it for
                              you -- but before you do that, you might want
                              to try just setting your password to something
                              random and not using it for a while.  This will
                              give you a chance to get used to ssh keys and
                              see how you like them, and if anything goes
                              wrong with your ssh keys, you'll be able to log
                              in with your password and fix them.  And yes,
                              your ssh-keygen stuff is exactly right.  You
                              didn't mention this, but when you put the public
                              key on soda, you need to put it in a file named
                              .ssh/authorized_keys.  --mconst
                                \_ thank you bery much! this helped alot in clearing
                                   out my confusions.
        \_ I was told because of the comprise, my ssh private key may be
           stolen as well, but how is that possible?  I thought the ssh
           private key is on the client host, not on the server host (i.e.
           http://csua.berkeley.edu)?
           \_ Some people put their private keys on soda (with a passphrase,
              I would hope). If you did, then both your private key and your
              passphrase may have been stolen. If you didn't store your private
              key on soda, you should be fine. -gm
              \_ they put their private keys on soda, is it because they want
                 to use soda as a client to a different server?
                 \_ Exactly.
              \_ the private key would be under .ssh/ right?