# Better way to reference SSH Identity Key?

**URL:** <https://forum.ansible.com/t/better-way-to-reference-ssh-identity-key/36253>\
**Category:** Ansible Project\
**Tags:** ubuntu\
**Created:** [January 26, 2022, 6:59pm UTC](https://forum.ansible.com/t/better-way-to-reference-ssh-identity-key/36253 "2022-01-26T18:59:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jason\_Wood](https://avatars.discourse-cdn.com/v4/letter/j/3bc359/32.png) [@Jason\_Wood](https://forum.ansible.com/u/Jason_Wood)\
**Post date:** [January 26, 2022, 6:59pm UTC](https://forum.ansible.com/t/better-way-to-reference-ssh-identity-key/36253/1 "2022-01-26T18:59:14Z")

</div>

Right now I have in ansible.cfg:

[ssh\_connection]  
ssh\_args = -F ssh\_config  
scp\_if\_ssh = True

And in ssh\_config:

Host [sub.domain.com](http://sub.domain.com)  
Hostname [sub.domain.com](http://sub.domain.com)  
User ubuntu  
IdentityFile ~/mykeyfile.pem

Right now I’m manually editing this file to change the 2 hostnames when I want to work with a different host!  
The IdentityFile is the same for all hosts.

Can you suggest a better way? I’ve had trouble finding docs on this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [January 26, 2022, 7:06pm UTC](https://forum.ansible.com/t/better-way-to-reference-ssh-identity-key/36253/2 "2022-01-26T19:06:59Z")

</div>

several ways:

In ssh\_config you can:  
Host \*

^ will match all hosts, you can be more/less restrictive than that.

Within ansible there are many ways to supply the key :

[defaults]  
private\_key\_file = ~/mykeyfile.pem

for a full list see  
[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/ssh\_connection.html#parameters](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/ssh_connection.html#parameters)

---

<div class="post-metadata">

**Author:** ![Evan\_Hisey](https://avatars.discourse-cdn.com/v4/letter/e/ce73a5/32.png) [@Evan\_Hisey](https://forum.ansible.com/u/Evan_Hisey)\
**Post date:** [January 26, 2022, 7:30pm UTC](https://forum.ansible.com/t/better-way-to-reference-ssh-identity-key/36253/3 "2022-01-26T19:30:04Z")

</div>

Funny this came up, as I just finished a playbook that bounces keys several times. There are 2 variables you can use in the playbook itself and can be changed using set\_fact:ansible\_private\_key\_file, and ansible\_ssh\_private\_key\_file. Used with the ansible\_user or ansible\_ssh\_user variables it can be quite handy cycling users or updating authorized keys mid play.

---

<div class="post-metadata">

**Author:** ![Jason\_Wood](https://avatars.discourse-cdn.com/v4/letter/j/3bc359/32.png) [@Jason\_Wood](https://forum.ansible.com/u/Jason_Wood)\
**Post date:** [January 27, 2022, 2:08pm UTC](https://forum.ansible.com/t/better-way-to-reference-ssh-identity-key/36253/4 "2022-01-27T14:08:50Z")

</div>

Thank you both.

I’m going with the

[defaults]  
private\_key\_file = ~/mykeyfile.pem

method, but it’s good to know that this can also be done inside the playbook, as I might want to consider using ansible for key rotation at some point in the future…

Thanks again.

Jason