# automated sshkey distribution to known\_hosts

**URL:** <https://forum.ansible.com/t/automated-sshkey-distribution-to-known-hosts/13805>\
**Category:** Ansible Project\
**Created:** [October 30, 2013, 4:24pm UTC](https://forum.ansible.com/t/automated-sshkey-distribution-to-known-hosts/13805 "2013-10-30T16:24:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kesten\_Broughton2](https://avatars.discourse-cdn.com/v4/letter/k/ecc23a/32.png) [@Kesten\_Broughton2](https://forum.ansible.com/u/Kesten_Broughton2)\
**Post date:** [October 30, 2013, 4:24pm UTC](https://forum.ansible.com/t/automated-sshkey-distribution-to-known-hosts/13805/1 "2013-10-30T16:24:17Z")

</div>

I’d like to know what the best practice is for achieving passwordless logins BETWEEN ansible managed hosts.  
I have wrapped the user module with a playbook that creates sudo priveleged users.  
The authorized\_keys module can be used to populate ~/.ssh/authorized\_keys but I need the same for ~/.ssh/known\_hosts

My use case is creating a hadoop cluster. To issue map-reduce jobs, the master node must have passwordless ssh login access to the slaves.  
I want to be able to spin up and tear down spot clusters so this must be automated.

Here is the rough work i’ve been working on. Currently I pass in ‘user’ and ‘pwd’ via --extra-vars, but will likely switch to vars\_prompt or something with pycrypto salting for production.  
more complete gist [ssh password strategy for populating known\_hosts so remote hosts can access each other. This assumes we already have an ansible controller with paswordless loging from it to each remote host. We are trying to add passwordless logins BETWEEN the remote hosts. · GitHub](https://gist.github.com/darKoram/7235534)

- hosts: all  
sudo: true  
tasks:

- name: Make sure the user {{user}} exists  
user: name=ansibler groups=sudo generate\_ssh\_key=yes shell=/bin/bash  
tags: ansibler

- name: Make sure the ‘ansibler’ RSA SSH key is installed  
authorized\_key: user={{user}} key=“{{ lookup(‘file’, ‘ansible\_rsa.pub’) }}”  
tags: ansibler

- name: Make sure sudoers contains NOPASSWD for sudo group  
shell: “creates=/etc/sudoers.bak chdir=/etc cp sudoers sudoers.bak && sed -ri -e ‘s/(%sudo\s+ALL=\(ALL:ALL\))\s+ALL/\1 NOPASSWD: ALL/’ /etc/sudoers”  
#TODO replace this with proper visudo as in lynx-ansible/playbooks/utils/sudo\_adduser.yml

- name: In case generate\_ssh\_key fails, do it manually  
shell: creates=/home/{{user}}/.ssh/id\_rsa  
ssh-keygen -f /home/{{user}}/.ssh/id\_rsa -t rsa -N ‘’

# sshpass method

# [http://stackoverflow.com/questions/12202587/ssh-script-that-automatically-enters-password](http://stackoverflow.com/questions/12202587/ssh-script-that-automatically-enters-password)

- name: Copy the user pwds to hosts  
copy: content={{pwd}} dest=“/home/{{user}}/.ssh/{{user}}\_pwd”

- name: Use sshpass to distribute keys  
shell: sshpass -f /home/{{user}}/.ssh/{{user}}\_pwd ssh -o StrictHostKeyChecking=no {{user}}@{{item}}  
with\_items: groups[‘all’]

# This hangs forever

#TODO This should work, but does not

---

<div class="post-metadata">

**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\
**Post date:** [October 30, 2013, 7:13pm UTC](https://forum.ansible.com/t/automated-sshkey-distribution-to-known-hosts/13805/2 "2013-10-30T19:13:41Z")

</div>

I use this to populate /etc/ssh/ssh\_known\_hosts, this won’t scale to thousands but it works well with a few dozen

[https://github.com/bcoca/ansible-pb/blob/master/known\_hosts.yml](https://github.com/bcoca/ansible-pb/blob/master/known_hosts.yml)

---

<div class="post-metadata">

**Author:** ![Kesten\_Broughton2](https://avatars.discourse-cdn.com/v4/letter/k/ecc23a/32.png) [@Kesten\_Broughton2](https://forum.ansible.com/u/Kesten_Broughton2)\
**Post date:** [October 30, 2013, 9:38pm UTC](https://forum.ansible.com/t/automated-sshkey-distribution-to-known-hosts/13805/3 "2013-10-30T21:38:55Z")

</div>

thanks. it works for me.

I had to add the following:

- name: Set StrictHostKeyChecking no in ~/.ssh/config  
lineinfile: create=yes dest=“/home/{{user}}/.ssh/config”  
regexp=StrictHostKeyChecking  
line=“StrictHostKeyChecking no”  
owner={{user}}  
group={{user}}  
mode=0644