Ansible best practice - multiple administrators

Archives Ansible Project
1

Hello,

i would like to ask, what is best practice to handle more Ansible administrators from security perspective.
We would like to login with SSH keys to both control machine and remotes.

Is the best way to do this:

  1. Create every administrator his own account at control machine and then just use BECOME to SSH to remote hosts with one general account with sudo rights on remotes? With this solution only private key stored at control machine would be one for general user.

  2. Create own account for every administrator on control and remote machines and let them SSH to remotes with their own account? This solution basicly means, we would have to store private keys for each administrator at control machine.
    every administrator already have SSH key and we would like to use these existing ones

how insecure is to use passwordless sudo with second approach?

Thank you for your help.

2

I prefer option 2 because everyone has their own keys, accounts and sudo permissions. You should use passwords with the ssh keys to avoid others from using others users keys.

3

How about forwarding the authentication agent connection.
This avoids having to store private keys on your management station.

Dick