How to manage authorized_keys?

Archives Ansible Project
1

Hello,

I’m using authorized_keys core module for managing the same name files. So, what I need?

I have a role, and var file with all ssh-keys. For exmpl:

user1_key: SSH PUB KEY HERE
user2_key: SSH PUB KEY HERE

I want to define which users I can put to authorized_keys. For example, I use in a playbook:

roles:

  • { role: ssh.role, ssh_user: test1, ssh_user_key: “{{ user1_key }}”, “{{ user2_key }}” }

But… I need to define a list of values, separated with a “new line”. Using line above I’m getting authorized_keys file with 2 SSH keys, separated with comma.

In role:

  • name: Manage authorized_keys
    authorized_key: user=“{{ ssh_user }}” key=“{{ ssh_user_key }}”

Please suggest!

2

Found solution in Doc:

- user: name={{ item.name }} state=present generate_ssh_key=yes
  with_items: "{{users}}"

- authorized_key: "user={{ item.0.name }} key='{{ lookup('file', item.1) }}'"
  with_subelements:
     - users
     - authorized

And somewhere define:

users:


- name: test1
    authorized:
      - "{{ user1_key }}"
      - "{{ user2_key }}"




But, when I decide to remove user2_key, It still persists in authorized_key file! It's unacceptable!
3

Is there anyone who can share own experience? It’s supposed to be a widespread task!

4

But, when I decide to remove user2_key, It still persists in
authorized_key file! It's unacceptable!

maybe you find the
'exclusive' parameter useful?
http://docs.ansible.com/ansible/authorized_key_module.html

5

Unfortunately, It’s not useful for multiple keys :frowning:

6

Hi Eugene,

Here is a fairly old snipped I used for such purpose. I hope you will
find it useful

it uses template to produce authorized_keys

https://gist.github.com/hostmaster/fc4bb8a2a9301bc2285f

I think it is possible to do the same with assemble module but I have not tried.

-- Best

7

Unfortunately, It's not useful for multiple keys

to quote the documentation again:

8

I would just use templates

9

Have a look at our ssh-keys role. https://github.com/Oefenweb/ansible-ssh-keys