# Lookup plugin that uses SSH agent for decrypting data **URL:** \ **Category:** Ansible Project\ **Created:** [April 8, 2014, 6:29am UTC](https://forum.ansible.com/t/lookup-plugin-that-uses-ssh-agent-for-decrypting-data/14965 "2014-04-08T06:29:57Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![anatoly\_techtonik](https://avatars.discourse-cdn.com/v4/letter/a/c67d28/32.png) [@anatoly\_techtonik](https://forum.ansible.com/u/anatoly_techtonik)\ **Post date:** [April 8, 2014, 6:29am UTC](https://forum.ansible.com/t/lookup-plugin-that-uses-ssh-agent-for-decrypting-data/14965/1 "2014-04-08T06:29:57Z")
Hi, Is it technically possible to encrypt some sensitive data using available SSH public key, so that only the owner of private key could read them with the help of SSH agent? Why? 1. No need to remember one more password. 2. No need to send the password to a person who needs to read the file. 3. No need to run one more agent. ---
**Author:** ![Dag\_Wieers](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@Dag\_Wieers](https://forum.ansible.com/u/Dag_Wieers)\ **Post date:** [April 8, 2014, 8:33am UTC](https://forum.ansible.com/t/lookup-plugin-that-uses-ssh-agent-for-decrypting-data/14965/2 "2014-04-08T08:33:14Z")
That is an interesting idea 🙂 It would mean as a team you would need to add a specific (team) key to your agent (and ensure this key is suficiently protected) in order to execute the playbook. So some way to test if the key is loaded before starting the playbook (or as part of the playbook) would be useful. ---
**Author:** ![anatoly\_techtonik](https://avatars.discourse-cdn.com/v4/letter/a/c67d28/32.png) [@anatoly\_techtonik](https://forum.ansible.com/u/anatoly_techtonik)\ **Post date:** [April 8, 2014, 7:19pm UTC](https://forum.ansible.com/t/lookup-plugin-that-uses-ssh-agent-for-decrypting-data/14965/3 "2014-04-08T19:19:14Z")
The initial idea was to have the same data encrypted by multiple keys, so that any from the team can open it, and you don’t need to give everybody some team key or team password - just add all public keys to the chain. Of course this is possible only when the basic problem of reusing SSH agent for decryption can be solved. ---
**Author:** ![drybjed](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drybjed](https://forum.ansible.com/u/drybjed)\ **Post date:** [April 8, 2014, 7:21pm UTC](https://forum.ansible.com/t/lookup-plugin-that-uses-ssh-agent-for-decrypting-data/14965/4 "2014-04-08T19:21:47Z")
You can encrypt data using GPG keys for multiple recipients - each recipient can access the data using his/her GPG key. GPG keys can also be used to authorize SSH access via Monkeysphere Project. - [http://web.monkeysphere.info/](http://web.monkeysphere.info/). ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [April 9, 2014, 1:58pm UTC](https://forum.ansible.com/t/lookup-plugin-that-uses-ssh-agent-for-decrypting-data/14965/5 "2014-04-09T13:58:44Z")
It’s been suggested that vault be taught to use GPG keys in addition to passwords, which is something I’m open to. No pull requests have been submitted just yet - unless I’m misremembering. Not against the option, by any means. (Using SSH keys feels a little weird?) ---
**Author:** ![anatoly\_techtonik](https://avatars.discourse-cdn.com/v4/letter/a/c67d28/32.png) [@anatoly\_techtonik](https://forum.ansible.com/u/anatoly_techtonik)\ **Post date:** [April 15, 2014, 1:02pm UTC](https://forum.ansible.com/t/lookup-plugin-that-uses-ssh-agent-for-decrypting-data/14965/6 "2014-04-15T13:02:10Z")
Good pointer. It seems like there is no way to reuse SSH agent to decrypt the vault. I need to read more about how GPG handles this, and I am somewhat concerned about security of Monkeysphere. ---
**Author:** ![drybjed](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drybjed](https://forum.ansible.com/u/drybjed)\ **Post date:** [April 15, 2014, 1:04pm UTC](https://forum.ansible.com/t/lookup-plugin-that-uses-ssh-agent-for-decrypting-data/14965/7 "2014-04-15T13:04:38Z")
You can keep your GPG keys in a private keyserver (sks for example), and distribute them to your servers that way. ---
**Author:** ![Till\_Maas](https://avatars.discourse-cdn.com/v4/letter/t/9f8e36/32.png) [@Till\_Maas](https://forum.ansible.com/u/Till_Maas)\ **Post date:** [April 15, 2014, 4:17pm UTC](https://forum.ansible.com/t/lookup-plugin-that-uses-ssh-agent-for-decrypting-data/14965/8 "2014-04-15T16:17:53Z")
It is super easy to do this with GPG, but afaik impossible to use this for e.g. the sudo password: [http://paste.fedoraproject.org/94407/78404139](http://paste.fedoraproject.org/94407/78404139) It might not be be error free due to ansible's bad encoding behaviour and I stopped using it once I found out I cannot use it for sudo passwords. Regards Till ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [April 15, 2014, 9:41pm UTC](https://forum.ansible.com/t/lookup-plugin-that-uses-ssh-agent-for-decrypting-data/14965/9 "2014-04-15T21:41:33Z")
If modifying vault to include GPG, the sudo password could be set with ansible\_sudo\_pass and then encoded with vault.