# Enhance \`--private-key\` argument to support multiple key files ?

**URL:** <https://forum.ansible.com/t/enhance-private-key-argument-to-support-multiple-key-files/14180>\
**Category:** Ansible Developer\
**Created:** [December 19, 2013, 12:40pm UTC](https://forum.ansible.com/t/enhance-private-key-argument-to-support-multiple-key-files/14180 "2013-12-19T12:40:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gilles\_Cornu](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@Gilles\_Cornu](https://forum.ansible.com/u/Gilles_Cornu)\
**Post date:** [December 19, 2013, 12:40pm UTC](https://forum.ansible.com/t/enhance-private-key-argument-to-support-multiple-key-files/14180/1 "2013-12-19T12:40:30Z")

</div>

In preamble, I know that Ansible already deals very well with multiple SSH identities the following ways:

- SSH agent
- ansible\_ssh\_private\_key\_file optional parameter in inventory file

Now, my goal and my question:

Vagrant 1.4+ now supports multiple SSH keys, and I would like to update Vagrant/Ansible provisioner, so that all Vagrant SSH identities are used by underlying Ansible executions. This Vagrant provisioner relies (and still will rely for now) on `--private-key` argument of ansible-playbook, which for [now only support a single key](https://github.com/ansible/ansible/blob/3d836a1ab72b9b07c9159678cf26ad1e2c8d1aee/lib/ansible/runner/connection_plugins/ssh.py#L85). I would like to know if a patch (multiple “IdentityFile” ssh parameter) providing support for multiple keys via `--private-key` (or similar) would be accepted?  
If yes, could you confirm me:

- the preferred argument syntax (several occurences of “–private-key”, comma-separated list, or what ever would be suit)
- the exact list of ssh transports (openssh, paramiko, ssh\_alt,…) to be updated.

I know it brings some extra complexity to the code, without any huge added value… So if you reject this idea (which I could perfectly understand), I may need some help to figure out the best way to go further on this problem.

Many thanks in advance and best regards,  
Gilles

---

<div class="post-metadata">

**Author:** ![Gilles\_Cornu](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@Gilles\_Cornu](https://forum.ansible.com/u/Gilles_Cornu)\
**Post date:** [December 21, 2013, 10:15pm UTC](https://forum.ansible.com/t/enhance-private-key-argument-to-support-multiple-key-files/14180/2 "2013-12-21T22:15:38Z")

</div>

Here a few more thoughts after looking further into possible variants:

For `ssh` and `ssh_alt` connections, an alternative could consist in passing multiple private keys via ANSIBLE\_SSH\_ARGS environment variable. This solution sounds pretty good, but unfortunately it doesn’t work for `paramiko`. I don’t like the idea to restrict “multiple ssh keys” to native ssh connection, but that would be a minimal solution at least…

On the other hand, paramiko library [supports multiple private key files](https://github.com/paramiko/paramiko/blob/28d78e4e6a33d2e23af196db632e6eeda4167e24/paramiko/client.py#L267) quite easily.

What do you think ? Should we extend `--private-key` argument to support more than one private key? Many thanks in advance for your feedbacks 🙂

Cheers, Gilles

---

<div class="post-metadata">

**Author:** ![Aaron\_Bauman](https://avatars.discourse-cdn.com/v4/letter/a/919ad9/32.png) [@Aaron\_Bauman](https://forum.ansible.com/u/Aaron_Bauman)\
**Post date:** [May 19, 2015, 2:22pm UTC](https://forum.ansible.com/t/enhance-private-key-argument-to-support-multiple-key-files/14180/3 "2015-05-19T14:22:53Z")

</div>

Reviving this old thread because of a bug I ran into with paramiko / ssh\_config

[https://github.com/ansible/ansible/pull/11013](https://github.com/ansible/ansible/pull/11013)

Summary:  
paramiko ssh\_config parsing builds identifyfile / ansible\_ssh\_private\_key\_file as a list, rather than a string.  
this exposes a bug when a user’s ssh config file defines an identityfile for a connection.