# how to design this security demands?

**URL:** <https://forum.ansible.com/t/how-to-design-this-security-demands/24322>\
**Category:** Ansible Project\
**Created:** [April 26, 2017, 12:23pm UTC](https://forum.ansible.com/t/how-to-design-this-security-demands/24322 "2017-04-26T12:23:58Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![sd\_song](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@sd\_song](https://forum.ansible.com/u/sd_song)\
**Post date:** [April 26, 2017, 12:23pm UTC](https://forum.ansible.com/t/how-to-design-this-security-demands/24322/1 "2017-04-26T12:23:58Z")

</div>

A python program `P` running on server `S1`, listening port `8443`. Some other services can send `id_isa, ip` pair to `P`. `P` could use this pair and make a ssh connection to the `ip` (create a ssh process).

How to make protect the `id_rsa` file even the machine `S1` is cracked ? How to let root user can’t get the `id_rsa` content (It seems ssh can use `-i` keyfile only)?

The main problem is `P (which call ansible api to use ssh)` must save the id\_rsa file to the disk,so that ssh can use it to conect to the ip.