When configuring nodes with Ansible, each server has a its own user and password, but it asks for root pass for ssh connection.
is it a good idea to give all servers same root pass for easy use?
if not please how can i give each server different root pass and connect via ssh to use same playbook simultaneously in all nodes ?
i am new to devops and ansible so please bear with me
It shouldn’t need root for SSH,
You should ideally have a dedicated ansible user with SSH keys.
Interested to see if anyone else has a better way of doing this though.
Option 1:
SSH keys to each server,
Passwordless sudo for the ansible user on each host.
Option 2:
Host vars file for each host that is encrypted.
https://docs.ansible.com/ansible/latest/user_guide/vault.html#vault
something like this in your playbook.
host_vars
-host1
– vars
– vars_creds
-host2
You have you host vars,
A directory per host and files with vars e.g. in “vars” hostname/ip/ port, etc and encrypt vars_creds that contains your user/pass.
Option 3: (not recommended)
Host vars but without the encryption with vault.
That should be the default choice for almost everyone.
Only deviating from that if there are very compelling reasons to do so.
I have not come across them, but I'm interested to know what those might be.
Deviates for managing windows servers
Which is where having encrypted host_vars helps I guess.
And I guess there could be an argument made against having password less sudo for a user
thanks so much for helping guys
dont you think Passwordless sudo for the ansible user on each host is risky ?
otherwise i will try to apply your second method @Stu with vars file, i think is more secure
though i would do as previous posters suggest, the way to do what you
initially asked for can be done with setting ansible_user and
ansible_password variables per host (i recommend using vault for the
latter).