# Git module - SSH connection with keys **URL:** \ **Category:** Ansible Project\ **Tags:** ansible-project\ **Created:** [May 1, 2013, 1:51pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747 "2013-05-01T13:51:47Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![C\_Morgan\_Hamill](https://avatars.discourse-cdn.com/v4/letter/c/ebca7d/32.png) [@C\_Morgan\_Hamill](https://forum.ansible.com/u/C_Morgan_Hamill)\ **Post date:** [May 1, 2013, 1:51pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/1 "2013-05-01T13:51:47Z")
Would you mind sharing what you passed to GIT\_SSH, out of curiosity? ---
**Author:** ![David\_Wu1](https://avatars.discourse-cdn.com/v4/letter/d/b38774/32.png) [@David\_Wu1](https://forum.ansible.com/u/David_Wu1)\ **Post date:** [May 1, 2013, 2:35pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/2 "2013-05-01T14:35:41Z")
Sure thing. I have a private repo that requires accessing via an SSH key. Here is what I do in my playbook: > - name: Upload the SSH key > copy: src=id\_rsa\_deployment dest=/tmp/id\_rsa\_deployment mode=600 > > - name: Configure SSH script > template: src=git\_ssh.j2 dest=/tmp/git\_ssh.sh mode=700 > > - name: Clone the git repo using GIT\_SSH > git: repo=ssh://git@bitbucket.org/username/someprivaterepo.git dest=/home/username/project depth=1 > environment: > GIT\_SSH: /tmp/git\_ssh.sh And the git\_ssh.j2 content is as follows: ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [May 2, 2013, 11:58am UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/3 "2013-05-02T11:58:50Z")
We should probably put this in the git module documentation. Does anyone else have a different way of doing this they may also want to share? ---
**Author:** ![John\_Jarvis](https://avatars.discourse-cdn.com/v4/letter/j/e47774/32.png) [@John\_Jarvis](https://forum.ansible.com/u/John_Jarvis)\ **Post date:** [May 2, 2013, 2:47pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/4 "2013-05-02T14:47:47Z")
We do the same thing here, I could see this being a new option in the git module to reduce boilerplate: ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [May 2, 2013, 3:08pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/5 "2013-05-02T15:08:46Z")
I would really like to see this, how about sending a patch? I think this is better than a param to pass GIT\_SSH as nobody knows how that works 🙂 ---
**Author:** ![C\_Morgan\_Hamill](https://avatars.discourse-cdn.com/v4/letter/c/ebca7d/32.png) [@C\_Morgan\_Hamill](https://forum.ansible.com/u/C_Morgan_Hamill)\ **Post date:** [May 2, 2013, 3:21pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/6 "2013-05-02T15:21:47Z")
Excerpts from John Jarvis's message of 2013-05-02 10:47:47 -0400: > We do the same thing here, I could see this being a new option in the git > module to reduce boilerplate: > > - name: Upload the SSH key >   copy: src=path/to/git-identity dest=/path/to/git-identity mode=600 > > - name: Clone the git repo using GIT\_SSH >   git: repo=ssh://git@bitbucket.org/username/someprivaterepo.git > dest=/path/to/project > git\_key=/path/to/git-identity I would love this also. Does anyone happen to know if there's any simple way to do something along this lines when the SSH key in question is locked with a passphrase (not just in Ansible, but more generally when you can't unlock the key interactively)? I imagine there'd have to be either an ssh-agent dance or a sshpass dance, but I'd love to be proven wrong. I suppose using an unlocked key and removing it after use would be enough, really. Perhaps the proposed patch could even take care of copying the key over, storing it temporarily, and killing it after the git clone is done? That might be insane... ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [May 2, 2013, 4:19pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/7 "2013-05-02T16:19:53Z")
Would probably be best to have your git repos mirrored publically, in all fairness. Having your deploys reliant on the cloud servers seems a bit sketchy. ---
**Author:** ![C\_Morgan\_Hamill](https://avatars.discourse-cdn.com/v4/letter/c/ebca7d/32.png) [@C\_Morgan\_Hamill](https://forum.ansible.com/u/C_Morgan_Hamill)\ **Post date:** [May 2, 2013, 5:09pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/8 "2013-05-02T17:09:57Z")
Excerpts from Michael DeHaan's message of 2013-05-02 12:19:53 -0400: > Would probably be best to have your git repos mirrored publically, in all > fairness. If only! Unfortunately, I'm not in a position to make the code in question available outside of our shop. > Having your deploys reliant on the cloud servers seems a bit sketchy. We're pulling from an on-site git repository which allows ssh key access only. I know that the right answer in this case is a passphrase-less key with read-only access to the repository, but my curiosity can't help but wonder if there's a way to have a setup with a key passphrase. ---
**Author:** ![Serge\_van\_Ginderacht](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@Serge\_van\_Ginderacht](https://forum.ansible.com/u/Serge_van_Ginderacht)\ **Post date:** [May 2, 2013, 5:38pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/9 "2013-05-02T17:38:29Z")
​Maybe have a look at keychain: you could add the passphrase to keychain in a first task, register it's output (keychain --noask --eval id\_dsa 2\>/dev/null) with needed environment variables, then run your git module with those variables set in the environment. That \*might\* work.​ ​Serge​ ---
**Author:** ![Scott\_Anderson](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@Scott\_Anderson](https://forum.ansible.com/u/Scott_Anderson)\ **Post date:** [May 2, 2013, 6:00pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/10 "2013-05-02T18:00:25Z")
I’ve got private repos with SSH keys with pass phrases… I use agent forwarding to make it work. That way the key is only ever on the machine of the person doing the deploy. It works for both direct and sudo access. There is a slight hitch that I haven’t bothered to overcome yet: the github remote key has to be accepted first (ie. test the github access from the account doing the deploy so it shows up in known\_hosts). I’m happy to give more details if this sounds interesting to anyone. -scott ---
**Author:** ![Serge\_van\_Ginderacht](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@Serge\_van\_Ginderacht](https://forum.ansible.com/u/Serge_van_Ginderacht)\ **Post date:** [May 2, 2013, 6:04pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/11 "2013-05-02T18:04:36Z")
​Maybe this can help (didn't test it yet): [https://github.com/ansible-contrib/ansible-plugins/blob/stable/library/known\_host](https://github.com/ansible-contrib/ansible-plugins/blob/stable/library/known_host) ​ ​Serge​ ---
**Author:** ![Jesus\_Garcia\_Crespo](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@Jesus\_Garcia\_Crespo](https://forum.ansible.com/u/Jesus_Garcia_Crespo)\ **Post date:** [May 2, 2013, 6:05pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/12 "2013-05-02T18:05:51Z")
I don't know if Ansible supports SSH agent forwarding through paramiko or ssh, but it would be cool to make a local agent with the keys that you need temporary available in the remote host. As soon as the git module is done you could close the agent to limit any potential risk. ---
**Author:** ![Scott\_Anderson](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@Scott\_Anderson](https://forum.ansible.com/u/Scott_Anderson)\ **Post date:** [May 2, 2013, 6:08pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/13 "2013-05-02T18:08:30Z")
Nice, thanks Serge, I’ll try it out when I get a chance. Regards, -scott ---
**Author:** ![Scott\_Anderson](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@Scott\_Anderson](https://forum.ansible.com/u/Scott_Anderson)\ **Post date:** [May 2, 2013, 6:09pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/14 "2013-05-02T18:09:38Z")
I use connection=ssh to make agent forwarding work. Regards, -scott ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [May 2, 2013, 7:04pm UTC](https://forum.ansible.com/t/git-module-ssh-connection-with-keys/12747/15 "2013-05-02T19:04:22Z")
Seems to be the cleanest approach and shares the least data with the host.