# inventory script and ssh host keys **URL:** \ **Category:** Ansible Project\ **Created:** [August 18, 2013, 2:28pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326 "2013-08-18T14:28:24Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![phil777x](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@phil777x](https://forum.ansible.com/u/phil777x)\ **Post date:** [August 18, 2013, 2:28pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326/1 "2013-08-18T14:28:24Z")
Hello I created an EC2 inventory script. For each discovered instance, I can retrieve the ssh host key from the instance console. The way it is working now is: - it dump all the keys in a specific known\_hosts file - this known host file is pointed to by a specific ssh\_config file - this ssh\_config file is pointed to by a ssh\_args option in ansible.cfg Is there a prettier way to do it ? ---
**Author:** ![James\_Cammarata1](https://avatars.discourse-cdn.com/v4/letter/j/d26b3c/32.png) [@James\_Cammarata1](https://forum.ansible.com/u/James_Cammarata1)\ **Post date:** [August 18, 2013, 3:38pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326/2 "2013-08-18T15:38:31Z")
Is there any reason you’re not using the EC2 inventory script we ship along with ansible? ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [August 18, 2013, 3:45pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326/3 "2013-08-18T15:45:02Z")
Yeah, we don’t technically ship it, but it’s included in the repo. [https://github.com/ansible/ansible/blob/devel/plugins/inventory/ec2.py](https://github.com/ansible/ansible/blob/devel/plugins/inventory/ec2.py) ---
**Author:** ![phil777x](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@phil777x](https://forum.ansible.com/u/phil777x)\ **Post date:** [August 18, 2013, 5:24pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326/4 "2013-08-18T17:24:38Z")
The main reason is that I create my own hierarchy of groups using instance tags. Beside that, the EC2 inventory script included in the repo does nothing to solve the ssh host keys problem. ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [August 18, 2013, 8:16pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326/5 "2013-08-18T20:16:22Z")
Have you seen the ec2\_facts module? [https://github.com/ansible/ansible/blob/devel/library/cloud/ec2\_facts](https://github.com/ansible/ansible/blob/devel/library/cloud/ec2_facts) ? ---
**Author:** ![phil777x](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@phil777x](https://forum.ansible.com/u/phil777x)\ **Post date:** [August 18, 2013, 8:38pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326/6 "2013-08-18T20:38:11Z")
I did and AFAIU, this is supposed to run on the remote EC2 instances, isn’t it ? So, if I am correct, how am I supposed to use it as it needs the ssh host key beforehand to run securely and the ssh host key is supposed to be obtained by running it ? I may have been unclear. My question is not about gathering ssh host keys securely from an EC2 we never contacted yet. On this point, I think grabbing it from the instance console is the least bad way to do it. If any of you have better ideas, I’d be happy to start a new thread about it. My question is how to manage those keys once I gathered them. ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [August 19, 2013, 12:47pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326/7 "2013-08-19T12:47:55Z")
Define “manage” ? ---
**Author:** ![phil777x](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@phil777x](https://forum.ansible.com/u/phil777x)\ **Post date:** [August 19, 2013, 3:09pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326/8 "2013-08-19T15:09:06Z")
These ssh host keys cannot be put in the inventory (there is no ansible\_ssh\_host\_key inventory variable). The way I did it is that my inventory script has side effects. It creates a my\_knwon\_hosts file, pointed to by a my\_ssh\_config file, pointed to by an ssh\_args entry in ansible.cfg. However I find this is a bit hackish, and I’m looking for better ideas. ---
**Author:** ![Bryon\_Fryer](https://avatars.discourse-cdn.com/v4/letter/b/e8c25b/32.png) [@Bryon\_Fryer](https://forum.ansible.com/u/Bryon_Fryer)\ **Post date:** [August 19, 2013, 4:49pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326/9 "2013-08-19T16:49:52Z")
what about ansible\_ssh\_private\_key\_file? Private key file used by ssh. Useful if using multiple keys and you don’t want to use SSH agent. [http://www.ansibleworks.com/docs/patterns.html](http://www.ansibleworks.com/docs/patterns.html) ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [August 19, 2013, 6:40pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326/10 "2013-08-19T18:40:10Z")
“there is no ansible\_ssh\_host\_key inventory variable” It’s actually called “ansible\_ssh\_private\_key\_file” ---
**Author:** ![phil777x](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@phil777x](https://forum.ansible.com/u/phil777x)\ **Post date:** [August 19, 2013, 7:42pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326/11 "2013-08-19T19:42:27Z")
No, this is the one used by the client to authenticate itself to the server. I’m speaking about the _host_ public key (as opposed to the _user_ key), used by the client to authenticate the server. ---
**Author:** ![Lester\_Wade](https://avatars.discourse-cdn.com/v4/letter/l/97f17d/32.png) [@Lester\_Wade](https://forum.ansible.com/u/Lester_Wade)\ **Post date:** [August 19, 2013, 7:47pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326/12 "2013-08-19T19:47:36Z")
This relates directly to Lorin’s module proposal: [https://github.com/ansible/ansible/pull/3787](https://github.com/ansible/ansible/pull/3787) The thing is, getting the host key from the console output is not accurate. A module for this might still be a good idea, or else some best practices around hoovering up host keys from transient hosts. ---
**Author:** ![Lester\_Wade](https://avatars.discourse-cdn.com/v4/letter/l/97f17d/32.png) [@Lester\_Wade](https://forum.ansible.com/u/Lester_Wade)\ **Post date:** [August 19, 2013, 7:49pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326/13 "2013-08-19T19:49:20Z")
Sorry, clarification probably needed there, by “not accurate” I mean that it only works providing you have your image configured to print the host key to the console. Many people will likely find that such a module wouldn’t work for them and lots of head scratching would ensue 🙂 ---
**Author:** ![phil777x](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@phil777x](https://forum.ansible.com/u/phil777x)\ **Post date:** [August 19, 2013, 8:40pm UTC](https://forum.ansible.com/t/inventory-script-and-ssh-host-keys/13326/14 "2013-08-19T20:40:36Z")
Quite interesting, thanks for the link. However, I think this information relates more to the inventory part (list of machines and how to connect to them) than on the fact harvesting part (what is the state of the system) and on the system configuration part (how the system should be like) Trust bootstrapping is a very hard problem and, regarding AWS, I think Amazon did half the job. AFAIK, the only trusted out of band channel is the instance console. Parsing it to look for an ssh host key is far from convenient (and old images echoed only the fingerprint and people checked it was correct using ssh-keyscan, which is completely dumb when you could have echoed the complete key). However I don’t know a better way to do it.