# continual deployment with ansible... and managing SSH keys? **URL:** \ **Category:** Ansible Project\ **Created:** [September 23, 2014, 12:23am UTC](https://forum.ansible.com/t/continual-deployment-with-ansible-and-managing-ssh-keys/16304 "2014-09-23T00:23:31Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Kevin\_Burton](https://avatars.discourse-cdn.com/v4/letter/k/dec6dc/32.png) [@Kevin\_Burton](https://forum.ansible.com/u/Kevin_Burton)\ **Post date:** [September 23, 2014, 12:23am UTC](https://forum.ansible.com/t/continual-deployment-with-ansible-and-managing-ssh-keys/16304/1 "2014-09-23T00:23:31Z")
Right now I just manually SSH into a box in our cluster and run ansible. But I want to automate this… Ideally I could just bump the version number in my code when I want it released… and 2 minutes later it would be staged, tested, and deployed. But the issue is SSH auth… many of my daemons need root. I don’t necessarily want to have keys just sitting there giving anyone full access to my cluster. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 23, 2014, 12:31am UTC](https://forum.ansible.com/t/continual-deployment-with-ansible-and-managing-ssh-keys/16304/2 "2014-09-23T00:31:05Z")
So a very good option for key management would be ansible tower - [http://ansible.com/tower](http://ansible.com/tower) Let Tower hold on to your key, and nobody will see it. It will use ssh-agent behind the scenes (your key may be locked with a password or not) and only allow that key to be used for running Ansible playbooks. (The key is saved encrypted in the database) I’d also consider setting things up so something like an “ansible” user can sudo. It isn’t strictly required, but might help a little bit with tracking who does what. (Tower also keeps good logs of this) ---
**Author:** ![Kevin\_Burton](https://avatars.discourse-cdn.com/v4/letter/k/dec6dc/32.png) [@Kevin\_Burton](https://forum.ansible.com/u/Kevin_Burton)\ **Post date:** [September 23, 2014, 5:47am UTC](https://forum.ansible.com/t/continual-deployment-with-ansible-and-managing-ssh-keys/16304/3 "2014-09-23T05:47:36Z")
The SSH issue is still an issue if I"m letting this daemon run as root on tower, because anyone can just inject code if they can break into this box… ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 23, 2014, 12:19pm UTC](https://forum.ansible.com/t/continual-deployment-with-ansible-and-managing-ssh-keys/16304/4 "2014-09-23T12:19:17Z")
Not really. Any config tool does need to actually configure the box, however Tower has role based access control that you can use to restrict _WHO_ can configure the box. Further, you can also control access to your source control so only certain people should have access to your playbooks. You can allow some users you don’t trust to deploy into test/stage environments, and only allow ops team members you trust to deploy into prod. And that exists with every single configuration tool on the planet – needing to be able to configure the system – and is not a SSH key specific kind of thing. ---
**Author:** ![John\_Favorite](https://avatars.discourse-cdn.com/v4/letter/j/ba9def/32.png) [@John\_Favorite](https://forum.ansible.com/u/John_Favorite)\ **Post date:** [September 23, 2014, 2:28pm UTC](https://forum.ansible.com/t/continual-deployment-with-ansible-and-managing-ssh-keys/16304/5 "2014-09-23T14:28:40Z")
i think he meant unauthorized access to the tower machine. Either way, thats a bigger issue. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 23, 2014, 4:22pm UTC](https://forum.ansible.com/t/continual-deployment-with-ansible-and-managing-ssh-keys/16304/6 "2014-09-23T16:22:11Z")
"i think he meant unauthorized access to the tower machine. Either way, thats a bigger issue. " Yeah, it’s not really possible to have unauthorized access to the Tower machine, unless you have a physical access problem. ---
**Author:** ![John\_Favorite](https://avatars.discourse-cdn.com/v4/letter/j/ba9def/32.png) [@John\_Favorite](https://forum.ansible.com/u/John_Favorite)\ **Post date:** [September 23, 2014, 5:48pm UTC](https://forum.ansible.com/t/continual-deployment-with-ansible-and-managing-ssh-keys/16304/7 "2014-09-23T17:48:58Z")
well lets hope for the best on the first 🙂 but yeah, physical access = game over