Ansible Generate_ssh_key Module

Ansible was created by Michael DeHaan in 2012 and is written in Python and Powershell. In this tutorial, we will learn how to deploy a new user and enable the SSH Key-Based authentication using the automation tool Ansible. We will also learn how to configure the Ansible 'Control Machine', as well as how to write simple ansible playbook. Oct 13, 2017 ISSUE TYPE Bug Report COMPONENT NAME authorizedkey ANSIBLE VERSION 2.4 SUMMARY Ansible 2.4 seems to have a bug with authorizedkey module. Here the code. Name: generate key user: name: linh5847 cr. July 29, 2015 How To Manage SSH Keys Using Ansible August 26, 2015 How To Write Spark Applications in Python December 14, 2015 How To Add/Remove Input Fields Dynamically with jQuery November 9, 2015 Sending JSON Data to Server using Async Thread. May 29, 2017 H ow do I use Ansible to upload ssh public key to as authorizedkey to multiple Linux or Unix servers saved in an inventory file? To add or remove SSH authorized keys for particular user accounts use authorizedkey module. This quick tutorial shows how to create an Ansible PlayBook that will add public ssh keys to multiple Unix or Linux servers for login securely. Creating User accounts. Now we have a list of usernames in a variable, we can use that to create user accounts. In it’s simplest form the Ansible User Module just needs to be given a name, and we can use the withitems to apply our list to the module in a loop. While Ansible has an authorizedkeys module specifically for handling these files, it has problems with quotes in restricted keys. The third task reads the jinja2 template for sshdconfig, adds the necessary information, and copies the file to the server. 7 thoughts on “How To Manage SSH Keys Using Ansible”.

Adds or removes SSH authorized keys for particular user accounts.

Parameter	Choices/Defaults	Comments
comment string	Change the comment on the public key. Rewriting the comment is useful in cases such as fetching it from GitHub or GitLab. If no comment is specified, the existing comment will be kept.
exclusive boolean	Choices: yes	Whether to remove all other non-specified keys from the authorized_keys file. Multiple keys can be specified in a single `key` string value by separating them by newlines. This option is not loop aware, so if you use `with_` , it will be exclusive per iteration of the loop. If you want multiple keys in the file you need to pass them all to `key` in a single batch as mentioned above.
follow boolean	Choices: no ← yes
key	The SSH public key(s), as a string or (since Ansible 1.9) url (https://github.com/username.keys).
key_options -	A string of ssh key options to be prepended to the key in the authorized_keys file.
manage_dir boolean	Choices: no	Whether this module should manage the directory of the authorized key file. If set to `yes`, the module will create the directory, as well as set the owner and permissions of an existing directory. Be sure to set `manage_dir=no` if you are using an alternate directory for authorized_keys, as set with `path`, since you could lock yourself out of SSH access.
path	Alternate path to the authorized_keys file. When unset, this value defaults to ~/.ssh/authorized_keys.
state string	Choices: absent	Whether the given key (with the given key_options) should or should not be in the file.
user string / required	The username on the remote host whose authorized_keys file will be modified.
validate_certs boolean	Choices: no	This only applies if using a https url as the source of the keys. If set to `no`, the SSL certificates will not be validated. This should only set to `no` used on personally controlled sites using self-signed certificates as it avoids verifying the source site. Prior to 2.1 the code worked as if this was set to `yes`.

Common return values are documented here, the following are the fields unique to this module:

Key	Returned	Description
exclusive boolean	success	If the key has been forced to be exclusive or not.
key string	success	Sample:
key_option	success	Key options related to the key.
keyfile string	success	Sample:
manage_dir	success	Whether this module managed the directory of the authorized key file. True
path string	success
state	success	Whether the given key (with the given key_options) should or should not be in the file present
unique boolean	success
user	success	The username on the remote host whose authorized_keys file will be modified user
validate_certs boolean	success	This only applies if using a https url as the source of the keys. If set to `no`, the SSL certificates will not be validated. True

This module is not guaranteed to have a backwards compatible interface. [preview]
This module is maintained by the Ansible Core Team. [core]

Red Hat Support¶

More information about Red Hat’s support of this module is available from this Red Hat Knowledge Base article.

Authors¶

Ansible Core Team

Hint

If you notice any issues in this documentation, you can edit this document to improve it.

This module allows one to (re)generate OpenSSH private and public keys. It uses ssh-keygen to generate keys. One can generate rsa, dsa, rsa1, ed25519 or ecdsa private keys.

The below requirements are needed on the host that executes this module. Adobe lightroom 5.2 serial key generator.

ssh-keygen

Parameter	Choices/Defaults	Comments
attributes string	The attributes the resulting file or directory should have. To get supported flags look at the man page for chattr on the target system. This string should contain the attributes in the same order as the one displayed by lsattr. The `=` operator is assumed as default, otherwise `+` or `-` operators need to be included in the string.
comment added in 2.9	Provides a new comment to the public key. When checking if the key is in the correct state this will be ignored.
force boolean	Choices: yes	Should the key be regenerated even if it already exists
group string	Name of the group that should own the file/directory, as would be fed to chown.
mode string	The permissions the resulting file or directory should have. For those used to /usr/bin/chmod remember that modes are actually octal numbers. You must either add a leading zero so that Ansible's YAML parser knows it is an octal number (like `0644` or `01777`) or quote it (like `'644'` or `'1777'`) so Ansible receives a string and can do its own conversion from string into number. Giving Ansible a number without following one of these rules will end up with a decimal number which will have unexpected results. As of Ansible 1.8, the mode may be specified as a symbolic mode (for example, `u+rwx` or `u=rw,g=r,o=r`). As of Ansible 2.6, the mode may also be the special string `preserve`. When set to `preserve` the file will be given the same permissions as the source file.
owner string	Name of the user that should own the file/directory, as would be fed to chown.
path path / required	Name of the files containing the public and private key. The file containing the public key will have the extension `.pub`.
selevel string	Default:	The level part of the SELinux file context. This is the MLS/MCS attribute, sometimes known as the `range`. When set to `_default`, it will use the `level` portion of the policy if available.
serole string	When set to `_default`, it will use the `role` portion of the policy if available.
setype string	When set to `_default`, it will use the `type` portion of the policy if available.
seuser string	By default it uses the `system` policy, where applicable. When set to `_default`, it will use the `user` portion of the policy if available.
size integer	Specifies the number of bits in the private key to create. For RSA keys, the minimum size is 1024 bits and the default is 4096 bits. Generally, 2048 bits is considered sufficient. DSA keys must be exactly 1024 bits as specified by FIPS 186-2. For ECDSA keys, size determines the key length by selecting from one of three elliptic curve sizes: 256, 384 or 521 bits. Attempting to use bit lengths other than these three values for ECDSA keys will cause this module to fail. Ed25519 keys have a fixed length and the size will be ignored.
state string	Choices: absent	Whether the private and public keys should exist or not, taking action if the state is different from what is stated.
type string	Choices: dsa rsa1 ecdsa ed25519	The algorithm used to generate the SSH private key. `rsa1` is for protocol version 1. `rsa1` is deprecated and may not be supported by every version of ssh-keygen.
unsafe_writes boolean	Choices: yes	Influence when to use atomic operation to prevent data corruption or inconsistent reads from the target file. By default this module uses atomic operations to prevent data corruption or inconsistent reads from the target files, but sometimes systems are configured or just broken in ways that prevent this. One example is docker mounted files, which cannot be updated atomically from inside the container and can only be written in an unsafe manner. This option allows Ansible to fall back to unsafe methods of updating files when atomic operations fail (however, it doesn't force Ansible to perform unsafe writes). IMPORTANT! Unsafe writes are subject to race conditions and can lead to data corruption.

Common return values are documented here, the following are the fields unique to this module:

Ansible Add Ssh Key

Key	Returned	Description
comment string	changed or success	Sample:
filename	changed or success	Path to the generated SSH private key file /tmp/id_ssh_rsa
fingerprint string	changed or success	Sample: SHA256:r4YCZxihVjedH2OlfjVGI6Y5xAYtdCwk8VxKyzVyYfM
public_key string	changed or success	Sample: ssh-rsa AAAAB3Nza(..omitted..)veL4E3Xcw test_key
size integer	changed or success	Sample:
type	changed or success	Algorithm used to generate the SSH private key rsa

This module is not guaranteed to have a backwards compatible interface. [preview]
This module is maintained by the Ansible Community. [community]

Authors¶

David Kainz (@lolcube)

Ansible Use Ssh Key

Hint

Ansible Argument_spec

Ansible Create Public Ssh Key

If you notice any issues in this documentation, you can edit this document to improve it.