Adding private key to remote host

Archives Ansible Project
1

Hi all!

In my company, we have playbooks to set up brand new servers in different roles, so that we can quickly configure new servers in case of expansion, emergency, etc.

One of the steps involved in these setups is adding a private key to some of them. Now, this goes great 99% of the time, since it usually involves adding a .ssh/id_rsa key, and ssh will attempt to use it automatically, (based on its name I believe)

However, the problem is when adding private keys with a non standard name. Say for example a server will hold 2 keys, one “id_rsa” and the other “id_rsa_git”. Normally, the second key will not work until ssh is made aware of it with ssh-add. However, I seem to be unable to run this command with ansible.

Here’s what I have tried:

  • command: ssh-add /home/{{ user }}/.ssh/id_rsa_git

Does not work, outputs “Could not open a connection to your authentication agent.”. Fair enough.

  • shell: eval “$(ssh-agent)” && ssh-add /home/{{ user }}/.ssh/id_rsa_git

Seems to work, but doesn’t. Here’s the output I get if I run with the verbose flag:

changed: [REDACTED] => {“changed”: true, “cmd”: “eval "$(ssh-agent)" && ssh-add /home/johndoe/.ssh/id_rsa_git”, “delta”: “0:00:00.006037”, “end”: “2015-07-16 23:23:28.667177”, “rc”: 0, “start”: “2015-07-16 23:23:28.661140”, “stderr”: “Identity added: /home/johndoe/.ssh/id_rsa_git (/home/johndoe/.ssh/id_rsa_git)”, “stdout”: “Agent pid 28489”}

Seems about right, right? That would be the output you would get if you ran it directly on the server. However, when I go to the server and I do “ssh-add -l”, I get “The agent has no identities.” Huh?

I thought maybe the user wasn’t right. So I tried:

shell: eval “$(ssh-agent)” && ssh-add /home/{{ user }}/.ssh/id_rsa_git && whoami

remote_user: johndoe

But this of course fails, since johndoe cannot ssh into servers (it’s a system user).

So, my question. Is there some sane way of doing the equivalent of ssh-add that I am not aware of?

Thanks in advance!

2

ssh-add relies on environment variables that are not available to
ansible, so when you run the ssh-agent + ssh-add you are spawning a
2nd agent, while when you login you seem to be getting the env vars
for the 1st agent, which did not get the keys added.

You'll have to do something like shell: . ssh_agent_env.sh && ssh-add ....

Or you can guess and set the environment vars yourself, the socket
file is normally in /tmp and owned by your user (i,.e
/tmp/ssh-7Mk71cc78Qwb/agent.4567) where the last number is the agent's
pid before forking, normally you can add +1 to get actual agent pid
and set SSH_AGENT_PID=4568
and SSH_AUTH_SOCK=/tmp/ssh-7Mk71cc78Qwb/agent.4567. You can also use
pgrep to confirm.

3

Makes sense. As a workaround, and since this is a very specific case, I have decided to explicitly add the key’s path to the only command that depends on it (an rsync job). But this info will come in handy if in the future we need to start working with more private keys.

Thanks for the useful info!

4

You can also use your .ssh/config file to specify one or more keys to use for a target host. Have a look at the IdentityFile option in the ssh_config man page.