# Generating TSIG Keys for Bind server **URL:** \ **Category:** Ansible Project\ **Created:** [October 22, 2017, 8:02pm UTC](https://forum.ansible.com/t/generating-tsig-keys-for-bind-server/25801 "2017-10-22T20:02:12Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Ken\_Jenney](https://avatars.discourse-cdn.com/v4/letter/k/c2a13f/32.png) [@Ken\_Jenney](https://forum.ansible.com/u/Ken_Jenney)\ **Post date:** [October 22, 2017, 8:02pm UTC](https://forum.ansible.com/t/generating-tsig-keys-for-bind-server/25801/1 "2017-10-22T20:02:12Z")
I need to generate TSIG keys for use by nsupdate. dnssec-keygen creates two files after run: ` - name: generate TSIG keys command: “dnssec-keygen -r /dev/urandom -a HMAC-MD5 -b 512 -n HOST {{item.name}}” args: chdir: ‘{{ bind\_base\_zones\_path }}/tsig/{{item.name}}/’ with\_items: ‘{{bind\_config\_master\_zones}}’ ` I need to copy the generated key in one of the files and insert it into a new file (named.conf.local): ` - name: populate TSIG key config command: “grep Key {{ bind\_base\_zones\_path }}/tsig/{{item.name}}/K{{item.name}}.\*.private | awk ‘{print $2}’” register: ‘key-{{ item.name }}’ with\_items: ‘{{bind\_config\_master\_zones}}’ ` My problem is that the grep returns “No such file or directory” even though a grep locally on the system returns the key. I suspect an issue with the regex. The other issue is with the dynamic nature of the variables. How can I extract the key from the files generated and copy them into the config file? ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [October 22, 2017, 8:50pm UTC](https://forum.ansible.com/t/generating-tsig-keys-for-bind-server/25801/2 "2017-10-22T20:50:48Z")
When using pipe and I guess also with wildcard you must use the shell module. Register doesn't support variables in them, so here you create the literal variable "key-{{ item.name }}". You can only register to one variable, and since you are using with\_items the variable will contain a list, one for each item. ---
**Author:** ![Ken\_Jenney](https://avatars.discourse-cdn.com/v4/letter/k/c2a13f/32.png) [@Ken\_Jenney](https://forum.ansible.com/u/Ken_Jenney)\ **Post date:** [October 23, 2017, 2:30pm UTC](https://forum.ansible.com/t/generating-tsig-keys-for-bind-server/25801/3 "2017-10-23T14:30:08Z")
Thanks! Another question: If I use with\_dict to register the variable how do I access stdout from the shell command: - name: populate TSIG key config command: “grep Key {{ bind\_base\_zones\_path }}/tsig/{{[item.k](http://item.name/)ey}}/K{{[item.k](http://item.name/)ey}}.\*.private | awk ‘{print $2}’” register: ‘tsig\_keys’ with\_items: ‘{{bind\_config\_master\_zones}}’ ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [October 23, 2017, 2:43pm UTC](https://forum.ansible.com/t/generating-tsig-keys-for-bind-server/25801/4 "2017-10-23T14:43:38Z")
Well, this task uses with\_items and command module. But when using with\_\* your result will be in {{ tsig\_keys.results }}, this is a list, one list entry for each item. tsig\_keys.results.0.stdout is the first, tsig\_keys.results.1.stdout is the second and so on. I recommend using   - debug: var=tsig\_keys this will show all the content of the variable in a human readable format. ---
**Author:** ![Ken\_Jenney](https://avatars.discourse-cdn.com/v4/letter/k/c2a13f/32.png) [@Ken\_Jenney](https://forum.ansible.com/u/Ken_Jenney)\ **Post date:** [October 23, 2017, 2:57pm UTC](https://forum.ansible.com/t/generating-tsig-keys-for-bind-server/25801/5 "2017-10-23T14:57:29Z")
I can extract the stdout from the shell command but ultimately I’m going to want to associate the stdout of the shell command with a zone. So if I use with\_items and iterate over each result all I’ve got is a number. How do I re-associate that number with it’s corresponding zone. Here’s an example of the zone variables: `vars: bind_config_master_zones: example.org: dnssec: yes mail: ops.example.org serial: 2017092200 refresh: 3600 retry: 1800 expire: 2419200 negative_cache: 300 example.com: dnssec: yes mail: ops.example.com serial: 2016102200 refresh: 3600 retry: 1800 expire: 2419200 negative_cache: 300` I’d want to set a fact from tsig\_keys.results.0.stdout to example.org.key and tsig\_keys.results.1.stdout to example.com.key. How can I do that? ---
**Author:** ![Ken\_Jenney](https://avatars.discourse-cdn.com/v4/letter/k/c2a13f/32.png) [@Ken\_Jenney](https://forum.ansible.com/u/Ken_Jenney)\ **Post date:** [October 23, 2017, 3:24pm UTC](https://forum.ansible.com/t/generating-tsig-keys-for-bind-server/25801/6 "2017-10-23T15:24:54Z")
I figured it: I don’t need to set facts - I need to set the keys in config files. I can use templates to iterate over the zones and pull the values from the results. I’ll update with my answer once I tested it.