# How to manage authorized\_keys?

**URL:** <https://forum.ansible.com/t/how-to-manage-authorized-keys/18840>\
**Category:** Ansible Project\
**Created:** [July 24, 2015, 11:41am UTC](https://forum.ansible.com/t/how-to-manage-authorized-keys/18840 "2015-07-24T11:41:25Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eugene\_Knoxville](https://avatars.discourse-cdn.com/v4/letter/e/ebca7d/32.png) [@Eugene\_Knoxville](https://forum.ansible.com/u/Eugene_Knoxville)\
**Post date:** [July 24, 2015, 11:41am UTC](https://forum.ansible.com/t/how-to-manage-authorized-keys/18840/1 "2015-07-24T11:41:25Z")

</div>

Hello,

I’m using authorized\_keys core module for managing the same name files. So, what I need?

I have a role, and var file with all ssh-keys. For exmpl:

user1\_key: SSH PUB KEY HERE  
user2\_key: SSH PUB KEY HERE

I want to define which users I can put to authorized\_keys. For example, I use in a playbook:

roles:

- { role: ssh.role, ssh\_user: test1, ssh\_user\_key: “{{ user1\_key }}”, “{{ user2\_key }}” }

But… I need to define a list of values, separated with a “new line”. Using line above I’m getting authorized\_keys file with 2 SSH keys, separated with comma.

In role:

- name: Manage authorized\_keys  
authorized\_key: user=“{{ ssh\_user }}” key=“{{ ssh\_user\_key }}”

Please suggest!

---

<div class="post-metadata">

**Author:** ![Eugene\_Knoxville](https://avatars.discourse-cdn.com/v4/letter/e/ebca7d/32.png) [@Eugene\_Knoxville](https://forum.ansible.com/u/Eugene_Knoxville)\
**Post date:** [July 24, 2015, 12:02pm UTC](https://forum.ansible.com/t/how-to-manage-authorized-keys/18840/2 "2015-07-24T12:02:02Z")

</div>

Found solution in Doc:

```auto
- user: name={{ item.name }} state=present generate_ssh_key=yes
  with_items: "{{users}}"

- authorized_key: "user={{ item.0.name }} key='{{ lookup('file', item.1) }}'"
  with_subelements:
     - users
     - authorized

```

```auto
And somewhere define:

```

```auto
users:

```

```auto
- name: test1
    authorized:
      - "{{ user1_key }}"
      - "{{ user2_key }}"

```

```auto

```

```auto
But, when I decide to remove user2_key, It still persists in authorized_key file! It's unacceptable!

```

---

<div class="post-metadata">

**Author:** ![Eugene\_Knoxville](https://avatars.discourse-cdn.com/v4/letter/e/ebca7d/32.png) [@Eugene\_Knoxville](https://forum.ansible.com/u/Eugene_Knoxville)\
**Post date:** [July 26, 2015, 10:59am UTC](https://forum.ansible.com/t/how-to-manage-authorized-keys/18840/3 "2015-07-26T10:59:31Z")

</div>

Is there anyone who can share own experience? It’s supposed to be a widespread task!

---

<div class="post-metadata">

**Author:** ![Nusenu1](https://avatars.discourse-cdn.com/v4/letter/n/db5fbb/32.png) [@Nusenu1](https://forum.ansible.com/u/Nusenu1)\
**Post date:** [July 26, 2015, 11:09am UTC](https://forum.ansible.com/t/how-to-manage-authorized-keys/18840/4 "2015-07-26T11:09:54Z")

</div>

> But, when I decide to remove user2\_key, It still persists in  
> authorized\_key file! It's unacceptable!

maybe you find the  
'exclusive' parameter useful?  
[http://docs.ansible.com/ansible/authorized\_key\_module.html](http://docs.ansible.com/ansible/authorized_key_module.html)

---

<div class="post-metadata">

**Author:** ![Eugene\_Knoxville](https://avatars.discourse-cdn.com/v4/letter/e/ebca7d/32.png) [@Eugene\_Knoxville](https://forum.ansible.com/u/Eugene_Knoxville)\
**Post date:** [July 28, 2015, 7:08am UTC](https://forum.ansible.com/t/how-to-manage-authorized-keys/18840/5 "2015-07-28T07:08:01Z")

</div>

Unfortunately, It’s not useful for multiple keys ☹

---

<div class="post-metadata">

**Author:** ![Igor\_Homyakov](https://avatars.discourse-cdn.com/v4/letter/i/f4b2a3/32.png) [@Igor\_Homyakov](https://forum.ansible.com/u/Igor_Homyakov)\
**Post date:** [July 28, 2015, 8:28am UTC](https://forum.ansible.com/t/how-to-manage-authorized-keys/18840/6 "2015-07-28T08:28:38Z")

</div>

Hi Eugene,

Here is a fairly old snipped I used for such purpose. I hope you will  
find it useful

it uses template to produce authorized\_keys

[https://gist.github.com/hostmaster/fc4bb8a2a9301bc2285f](https://gist.github.com/hostmaster/fc4bb8a2a9301bc2285f)

I think it is possible to do the same with assemble module but I have not tried.

-- Best

---

<div class="post-metadata">

**Author:** ![Nusenu1](https://avatars.discourse-cdn.com/v4/letter/n/db5fbb/32.png) [@Nusenu1](https://forum.ansible.com/u/Nusenu1)\
**Post date:** [July 28, 2015, 10:06am UTC](https://forum.ansible.com/t/how-to-manage-authorized-keys/18840/7 "2015-07-28T10:06:30Z")

</div>

> Unfortunately, It's not useful for multiple keys

to quote the documentation again:

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [July 28, 2015, 12:40pm UTC](https://forum.ansible.com/t/how-to-manage-authorized-keys/18840/8 "2015-07-28T12:40:34Z")

</div>

I would just use templates

---

<div class="post-metadata">

**Author:** ![Mischa\_ter\_Smitten](https://avatars.discourse-cdn.com/v4/letter/m/c0e974/32.png) [@Mischa\_ter\_Smitten](https://forum.ansible.com/u/Mischa_ter_Smitten)\
**Post date:** [July 29, 2015, 7:07pm UTC](https://forum.ansible.com/t/how-to-manage-authorized-keys/18840/9 "2015-07-29T19:07:18Z")

</div>

Have a look at our ssh-keys role. [https://github.com/Oefenweb/ansible-ssh-keys](https://github.com/Oefenweb/ansible-ssh-keys)