# Key exchange approaches, drawbacks.

**URL:** <https://forum.ansible.com/t/key-exchange-approaches-drawbacks/11694>\
**Category:** Ansible Project\
**Created:** [July 17, 2012, 4:13pm UTC](https://forum.ansible.com/t/key-exchange-approaches-drawbacks/11694 "2012-07-17T16:13:40Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brad\_Olson](https://avatars.discourse-cdn.com/v4/letter/b/779978/32.png) [@Brad\_Olson](https://forum.ansible.com/u/Brad_Olson)\
**Post date:** [July 17, 2012, 4:13pm UTC](https://forum.ansible.com/t/key-exchange-approaches-drawbacks/11694/1 "2012-07-17T16:13:40Z")

</div>

SSH key pairs are great, as we all know. Besides using them to control Ansible connections, I also use them with git for certain software deployments and with rsync and other sync tools to get production data to my QA and developer machines.

It’s always a bit painful, especially when I have to spin up a bunch of new test or QA machines, to carry out those important steps for non-interactive logins.

1. Create a non-privileged sync user and it’s key pair.

2. Get that user’s public key to the source server’s authorized\_keys (usually a non-privileged user on the production server).

3. Get the source server’s public host key into that user’s known\_hosts.  
I see a couple ways to do that. The first is to just pregenerate some key pairs and just use the copy or template module to push them to servers. Simple, yes? Secure enough?

Another way is to do something like this (I have some custom modules that assist this job, none ready for prime time–just asking for feedback now). Not sure I like it, especially for transient test machines, but the prototype works.

- hosts: sync\_source  
user: root  
vars\_files:

- vars/sync.yaml  
tasks:

- name: create read-only sync user  
action: user name=${sync\_user} shell=/bin/bash comment=“Read only access to data for remote systems to sync from.”

- name: create sync data directory  
action: file state=directory dest=${sync\_data} owner=${sync\_user}

- name: get host fingerprint  
#Fetches all public keys (host, root, and every user)  
action: public\_keys

- hosts: sync\_dest  
user: root  
vars\_files:

- vars/sync.yaml  
tasks:

- name: create sync dest user (a.k.a. mirror user)  
action: user name=$mirror\_user

- name: create mirror user ssh keys  
action: command su $mirror\_user -c ‘ssh-keygen -f $mirror\_key -N “”’ creates=$mirror\_key

- name: fetch ssh public keys from sync dest  
action: public\_keys

- hosts: sync\_source  
user: root  
vars\_files:

- vars/sync.yaml  
tasks:

- name: insert sync client authorized\_keys  
action: authorized\_key user=${sync\_user} key=${hostvars.for each host in sync dest  
#only\_if: “The dest host has been reached and has public keys for the sync user.”

- hosts: sync\_dest  
user: root  
vars\_files:

- vars/sync.yaml  
tasks:

- name: insert sync source host key  
action: known\_hosts user=${sync\_user} key=${hostvars.synchostsource.host}  
#only\_if: “The dest host has been reached and has public keys for the sync user.”