Here are the steps that I used to replace my daily use of rsh with that of ssh. o on your local (FROM) host, run ssh-keygen. Answer yes to the questions, and use a passphrase. o on your remote (TO) machine, add the contents (ie ONE LINE corresponding to your new key) of $HOME/.ssh/indentity.pub to the file $HOME/.ssh/authorized_keys. o make sure that the following files (on the TO machine) are writable only by you: - $HOME - $HOME/.ssh - $HOME/.ssh/authorized_keys You can conduct your entire X session via ssh, with all subprocesses inheriting the security with the following steps: o on the FROM machine, add to your .xsession or equivalent: - eval `ssh-agent -s` (these are supposed to be back-ticks) - ssh-add These lines will setup the environment, spawn the ssh-agent, and run a program to ask for your passphrase on the FROM host. This passphrase will be kept in memory, and will be used for ssh transactions. o you will need to implement a strategy to kill the ssh-agent when your xsession terminates. I have done the following in a .xsession which runs mwm: - (in .xsession's last line:) exec mwm - (in .mwmrc's root menu:) "Logout" f.exec "quit_xsession" - (in the file $HOME/bin/quit_xsession:) #!/bin/sh ssh-agent -k killall mwm exit In addition, for those of you who use cvs server (which by default runs over rsh), you can replace the use of rsh with that of ssh by doing the following: - setenv CVS_RSH ssh and that's it. If you have setup both ends of the connection with ssh-keygen and authorized_keys, it will behave exactly as before. Let's say that you have started an xsession under your account. Suppose you su to another account, for instance the e910 group account. From your current host, you may want to initiate remote logins from this particular account, but you have a problem: the ssh-agent that you ran during your xsession login was run under your account. You will need to start a ssh-agent for your su's account. REFERENCES: http://www.tac.nyc.ny.us/~kim/ssh/ssh.html ssh(1), ssh-keygen(1), ssh-agent(1), ssh-add(1) man pages