# Default code to add public ssh key fails **URL:** \ **Category:** Get Help\ **Tags:** ubuntu, awx\ **Created:** [February 6, 2024, 1:01pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702 "2024-02-06T13:01:05Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\ **Post date:** [February 6, 2024, 1:01pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/1 "2024-02-06T13:01:05Z")
Hello! im new to AWX. I have for testing everything in a GitHub Repo. Im evaluating the playbook from [here](https://docs.ansible.com/ansible/latest/collections/ansible/posix/authorized_key_module.html) with adding via git url: ```auto --- - name: Set authorized keys hosts: all gather_facts: false tasks: - name: Set authorized keys taken from url ansible.posix.authorized_key: user: charlietteeiiiaaste state: present key: https://github.com/gsg-git/awx_pub/blob/main/awxtestpub ``` But it fails when i deploy it to a test Ubuntu 22 VM: It states the public key is invalid. Here is the Key: ![grafik](https://us1.discourse-cdn.com/ansible/original/2X/9/975fe3a7a223bef37148d28087f87d112d6458de.png) Can you add public keys in credentials and use them locally? Where would they be ? You just cant poke around the AWC Docker Compose i got told. Thank you in davanve! ---
**Author:** ![akira6592](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/akira6592/32/222_2.png) [@akira6592](https://forum.ansible.com/u/akira6592)\ **Post date:** [February 6, 2024, 1:09pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/2 "2024-02-06T13:09:02Z")
@gothsome Hello again! Are the Playbook and `awxtestpub` exsit same repository? If so, how about bellow Playbook? ```yaml --- - name: Set authorized keys hosts: all gather_facts: false tasks: - name: Set authorized keys taken from url ansible.posix.authorized_key: user: root state: present key: : "{{ lookup('file', 'awxtestpub') }}" validate_certs: false ``` ---
**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\ **Post date:** [February 6, 2024, 1:27pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/3 "2024-02-06T13:27:56Z")
Yeah i have just everything at the same repo in one folder: ![grafik](https://us1.discourse-cdn.com/ansible/original/2X/0/0fa0386a3cecc0765817e2f14109c4e100aa34b0.png) ---
**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\ **Post date:** [February 6, 2024, 1:33pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/4 "2024-02-06T13:33:30Z")
It doesnt like mapping values there. ```auto Syntax Error while loading YAML. mapping values are not allowed in this context ``` ---
**Author:** ![akira6592](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/akira6592/32/222_2.png) [@akira6592](https://forum.ansible.com/u/akira6592)\ **Post date:** [February 6, 2024, 1:38pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/5 "2024-02-06T13:38:58Z")
Sorry. There was a typo. Corrected example. ```yaml --- - name: Set authorized keys hosts: all gather_facts: false tasks: - name: Set authorized keys taken from url ansible.posix.authorized_key: user: root state: present key: "{{ lookup('file', 'awxtestpub') }}" validate_certs: false ``` ---
**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\ **Post date:** [February 6, 2024, 1:44pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/6 "2024-02-06T13:44:58Z")
> [@akira6592](#): > > ```auto > --- > - name: Set authorized keys > hosts: all > gather_facts: false > > tasks: > - name: Set authorized keys taken from url > ansible.posix.authorized_key: > user: root > state: present > key: "{{ lookup('file', 'awxtestpub') }}" > validate_certs: false > > ``` Now it seems it loaded the key content ut still isnt happy about it: ```auto fatal: [192.168.151.237]: FAILED! => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python3" }, "changed": false, "invocation": { "module_args": { "comment": null, "exclusive": false, "follow": false, "key": "---- BEGIN SSH2 PUBLIC KEY ----\\r\\nComment: \\"rsa-key-20240206\\"\\r\\nAAAAB3NzaC1yc2EAAAADAQABAAABAQDKp5WjU+MEOBSeyqcDW48u5cOeInmiA5bm\\r\\nSe99Nxo8QdBZ8AkyLreDQ37NXdacxziEEWknl+bcMwOGRDvQab8l8WGjn22vQsXM\\r\\nDprFPkh4eY6aEwHjdbAmpy0z0jRWyWV6MClUBrBoD1wHn3YdKYevRGPRaajwz8Ec\\r\\nwHbad5rGM9TH46V71ZGFebHyv3+KZe966+6m9y+xv0RRVGpu3lCCJTosqIwQDixu\\r\\n1pwmJz4uyWhkBmviZ+ioW+d6L+VjzsbIxAsLp1a3qR2UbimUzgMMoMfDVir2B3nf\\r\\nTEqj0Zn7ut1Mj+URL9OaLf0oIR7H5JZ33Q0E3LdWB4cngbwF+Fof\\r\\n---- END SSH2 PUBLIC KEY ----", "key_options": null, "keyfile": "/root/.ssh/authorized_keys", "manage_dir": true, "path": null, "state": "present", "user": "root", "validate_certs": false } }, "msg": "invalid key specified: ---- BEGIN SSH2 PUBLIC KEY ----" } ``` ---
**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\ **Post date:** [February 6, 2024, 1:47pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/7 "2024-02-06T13:47:19Z")
Sadly its a imortant featue i have to get to run ---
**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\ **Post date:** [February 6, 2024, 9:43pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/8 "2024-02-06T21:43:39Z")
You could convert to the supported format: ```auto - name: convert RFC4716 key to OpenSSH-compat debug: msg="{{ lookup('pipe', 'ssh-keygen -i -m RFC4716 -f ' + key_path) }}" ``` ---
**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\ **Post date:** [February 7, 2024, 7:09am UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/9 "2024-02-07T07:09:34Z")
Yeah i had this issue with Ansible - i had to convert the key to the openssh format in puttygen, but i could just export the private one so i thought its not possible - thank you i will try ---
**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\ **Post date:** [February 7, 2024, 8:23am UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/10 "2024-02-07T08:23:11Z")
I tested to convert the Key with -m RFC4716/PKCS8 but still invalid key specified i try to add the lines to convert in the playbook and try again but the samen. Even with a new generated key. ---
**Author:** ![kurokobo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kurokobo/32/182_2.png) [@kurokobo](https://forum.ansible.com/u/kurokobo)\ **Post date:** [February 7, 2024, 11:40am UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/11 "2024-02-07T11:40:37Z")
Could you provide actual playbook you’ve tried to convert keys? ---
**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\ **Post date:** [February 7, 2024, 11:54am UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/12 "2024-02-07T11:54:27Z")
If your screenshot was accurate, converting seems to work for me. The key file contains: ```auto ---- BEGIN SSH2 PUBLIC KEY ---- Comment: "rsa-key-20240206" AAAAB3NzaC1yc2EAAAADAQABAAABAQDKp5WjU+MEOBSeyqcDW48u5cOeInmiA5bm Se99Nxo8QdBZ8AkyLreDQ37NXdacxziEEWknl+bcMwOGRDvQab8l8WGjn22vQsXM DprFPkh4eY6aEwHjdbAmpy0z0jRWyWV6MClUBrBoD1wHn3YdKYevRGPRaajwz8Ec wHbad5rGM9TH46V71ZGFebHyv3+KZe966+6m9y+xv0RRVGpu3lCCJTosqIwQDixu 1pwmJz4uyWhkBmviZ+ioW+d6L+VjzsbIxAsLp1a3qR2UbimUzgMMoMfDVir2B3nf TEqj0Zn7ut1Mj+URL9OaLf0oIR7H5JZ33Q0E3LdWB4cngbwF+Fof ---- END SSH2 PUBLIC KEY ---- ``` Playbook contains: ```auto - hosts: all gather_facts: no vars: key_path: /home/shertel/pub_key tasks: - name: Set authorized keys taken from local file ansible.posix.authorized_key: user: shertel state: present key: "{{ lookup('pipe', 'ssh-keygen -i -m RFC4716 -f ' + key_path) }}" # lookups run on localhost validate_certs: false ``` Output: ```auto TASK [Set authorized keys taken from local file] ************************************************************************************************************************************************************* changed: [h1] => {"changed": true, "comment": null, "exclusive": false, "follow": false, "key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKp5WjU+MEOBSeyqcDW48u5cOeInmiA5bmSe99Nxo8QdBZ8AkyLreDQ37NXdacxziEEWknl+bcMwOGRDvQab8l8WGjn22vQsXMDprFPkh4eY6aEwHjdbAmpy0z0jRWyWV6MClUBrBoD1wHn3YdKYevRGPRaajwz8EcwHbad5rGM9TH46V71ZGFebHyv3+KZe966+6m9y+xv0RRVGpu3lCCJTosqIwQDixu1pwmJz4uyWhkBmviZ+ioW+d6L+VjzsbIxAsLp1a3qR2UbimUzgMMoMfDVir2B3nfTEqj0Zn7ut1Mj+URL9OaLf0oIR7H5JZ33Q0E3LdWB4cngbwF+Fof", "key_options": null, "keyfile": "/home/shertel/.ssh/authorized_keys", "manage_dir": true, "path": null, "state": "present", "user": "shertel", "validate_certs": false} ``` If you have the key contents from a URL and don’t have a file, you can still do this (\*edited improve the example): ```auto - hosts: localhost gather_facts: no vars: key_url: "https://raw.githubusercontent.com/gsg-git/awx_pub/main/awxtestpub" key_content: "{{ lookup('url', key_url, split_lines=false) }}" conversion_cmd: 'ssh-keygen -i -m RFC4716 -f /dev/stdin <<<"{{ key_content }}"' new_key_content: "{{ lookup('pipe', conversion_cmd) }}" tasks: - debug: msg="{{ new_key_content }}" ``` If you’re getting ‘invalid key’ error still, it suggests your key doesn’t look like `ssh-rsa ...`. Here are the types the module knows how to parse: [ansible.posix/plugins/modules/authorized\_key.py at main · ansible-collections/ansible.posix · GitHub](https://github.com/ansible-collections/ansible.posix/blob/main/plugins/modules/authorized_key.py#L398-L422). ---
**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\ **Post date:** [February 7, 2024, 2:02pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/13 "2024-02-07T14:02:57Z")
I converted via ssh-keygen in the shell without playbook. ---
**Author:** ![kurokobo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kurokobo/32/182_2.png) [@kurokobo](https://forum.ansible.com/u/kurokobo)\ **Post date:** [February 7, 2024, 2:17pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/14 "2024-02-07T14:17:29Z")
If the error `invalid key specified: ---- BEGIN SSH2 PUBLIC KEY ----` does not change at all after your conversion, it simply indicates that your playbook is not able to use the converted key file. Therefore, it is important to know how you converted the file, where you placed the converted file, and how you are trying to read it from the playbook. Not stopping at simple explanations by some words, but presenting actual commands, the logs, the contents of actual YAML files, and your attempts as much as possible may help us a lot. ---
**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\ **Post date:** [February 7, 2024, 2:20pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/15 "2024-02-07T14:20:34Z")
> [@shertel](#): > > ```auto > - hosts: localhost > gather_facts: no > vars: > key_url: "https://raw.githubusercontent.com/gsg-git/awx_pub/main/awxtestpub" > key_content: "{{ lookup('url', key_url, split_lines=false) }}" > conversion_cmd: 'ssh-keygen -i -m RFC4716 -f /dev/stdin <<<"{{ key_content }}"' > new_key_content: "{{ lookup('pipe', conversion_cmd) }}" > tasks: > - debug: msg="{{ new_key_content }}" > > ``` Thank you!!! Thats it - the loaded file content needs to be fomated so AWX can read it! I would never could have thought about this possibility! ---
**Author:** ![kurokobo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kurokobo/32/182_2.png) [@kurokobo](https://forum.ansible.com/u/kurokobo)\ **Post date:** [February 7, 2024, 2:22pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/16 "2024-02-07T14:22:46Z")
You should close this: [public key not accepted in playbook to add keys · Issue #14850 · ansible/awx · GitHub](https://github.com/ansible/awx/issues/14850) ---
**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\ **Post date:** [February 7, 2024, 2:34pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/17 "2024-02-07T14:34:55Z")
Done! Im exited to learn more! Its like for every issue at least 5 questions pop up 😆 ---
**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\ **Post date:** [February 13, 2024, 12:46pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/18 "2024-02-13T12:46:26Z")
I have a last question because i wanted to see where the Key gets stored at the hosts, because i couldnt see it in the allowed\_keys and te search for a part of the pub key is still running. ---
**Author:** ![kurokobo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kurokobo/32/182_2.png) [@kurokobo](https://forum.ansible.com/u/kurokobo)\ **Post date:** [February 13, 2024, 1:26pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/19 "2024-02-13T13:26:32Z")
I believe your key is added into `//.ssh/authorized_keys` on the target nodes, e.g. `/home/charlietteeiiiaaste/.ssh/authorized_keys`. Note that you have the pub key in RFC4716 format, but you’ve added it _after converting into OpenSSH format_, so I bet the added keys in `authorized_keys` have different appearance than your original file. Therefore, if you search on a part of the original public key string, you will not find it. ---
**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\ **Post date:** [February 13, 2024, 1:57pm UTC](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702/20 "2024-02-13T13:57:55Z")
I cant ssh with the key to the host. What i can imagine is that the playbook doesnt contain a assigned user so it doesnt know where to put the key(?), but in the job the remote user is root… In the successfull job i looked up i couldnt find any issues ans its still running. The only home is from the user and the authorized\_keys is empty. I try to run the playbook with some more hosts to see if there is an global issue. [Next page](https://forum.ansible.com/t/default-code-to-add-public-ssh-key-fails/3702.md?page=2)