Enhance `--private-key` argument to support multiple key files ?

Archives Ansible Developer
1

In preamble, I know that Ansible already deals very well with multiple SSH identities the following ways:

  • SSH agent
  • ansible_ssh_private_key_file optional parameter in inventory file

Now, my goal and my question:

Vagrant 1.4+ now supports multiple SSH keys, and I would like to update Vagrant/Ansible provisioner, so that all Vagrant SSH identities are used by underlying Ansible executions. This Vagrant provisioner relies (and still will rely for now) on --private-key argument of ansible-playbook, which for now only support a single key. I would like to know if a patch (multiple “IdentityFile” ssh parameter) providing support for multiple keys via --private-key (or similar) would be accepted?
If yes, could you confirm me:

  • the preferred argument syntax (several occurences of “–private-key”, comma-separated list, or what ever would be suit)
  • the exact list of ssh transports (openssh, paramiko, ssh_alt,…) to be updated.

I know it brings some extra complexity to the code, without any huge added value… So if you reject this idea (which I could perfectly understand), I may need some help to figure out the best way to go further on this problem.

Many thanks in advance and best regards,
Gilles

2

Here a few more thoughts after looking further into possible variants:

For ssh and ssh_alt connections, an alternative could consist in passing multiple private keys via ANSIBLE_SSH_ARGS environment variable. This solution sounds pretty good, but unfortunately it doesn’t work for paramiko. I don’t like the idea to restrict “multiple ssh keys” to native ssh connection, but that would be a minimal solution at least…

On the other hand, paramiko library supports multiple private key files quite easily.

What do you think ? Should we extend --private-key argument to support more than one private key? Many thanks in advance for your feedbacks :slight_smile:

Cheers, Gilles

3

Reviving this old thread because of a bug I ran into with paramiko / ssh_config

https://github.com/ansible/ansible/pull/11013

Summary:
paramiko ssh_config parsing builds identifyfile / ansible_ssh_private_key_file as a list, rather than a string.
this exposes a bug when a user’s ssh config file defines an identityfile for a connection.