# Management of multiple exclusive authorized\_keys entries, for multiple users

**URL:** <https://forum.ansible.com/t/management-of-multiple-exclusive-authorized-keys-entries-for-multiple-users/19990>\
**Category:** Ansible Project\
**Created:** [December 11, 2015, 3:11pm UTC](https://forum.ansible.com/t/management-of-multiple-exclusive-authorized-keys-entries-for-multiple-users/19990 "2015-12-11T15:11:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cmacrae](https://avatars.discourse-cdn.com/v4/letter/c/2acd7d/32.png) [@cmacrae](https://forum.ansible.com/u/cmacrae)\
**Post date:** [December 11, 2015, 3:11pm UTC](https://forum.ansible.com/t/management-of-multiple-exclusive-authorized-keys-entries-for-multiple-users/19990/1 "2015-12-11T15:11:27Z")

</div>

Hi everyone.

I’ve been mulling something over in my head, I’ve got something I want to tackle, but I’m not sure how to go about doing so.

Here’s the scenario: I want to put together a tiny role that manages user’s authorized keys. Keys defined in the inventory (host\_vars/group\_vars/playbook vars, etc.) should be the only ones present in the user’s authorized\_keys file.

I have some keys specified like so:

`

```auto
root_ssh_public_keys:
  member1:
    pubkey: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAvVO3ULx8fNGgInHCFQV6w/gEARBWyS9eA1qRaTEu4njawEjiqSGFHgPuvmgtKlft2MqbnCG3cokFKRAEOZEzy+jUMES8IQEHuSsJuZFnlUC4yzm1mI1OjJk9PwTLDD6OGJDL1gIkz37CYITbsaufS6gFrpoMBZhkVcVKk0JBnmwF/QZUD1uHKFLMtyVwvw8pzWcBcAYBBw5O6hjo2pRIX100bCdMxDrXwFp4yFiJPG6LCya4701whZpqgwk3d/RakJdZLA3pgAlVPZswz8ezj2U5PIYJl+LrUaPE57ZR/eVwNnBE7QPsKCCurIy1bLR0KXiqOmUzdzWDphYCelRurQ== member1
  member2:
    pubkey: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAtkScC/o1aDxaXFJdyTMhlF4UewNO/tdQf6EIYJzikSBNKECBjmvrM6bNaIkWA/AzB2dgTS0mug2aVomsBeyN8gAGfV/Wi3bO1kXuI23BmkPUn36OgE5ppQ0O2Gp8VjJaffV9EiYeEY/QlwnshAS9gfDPeTO+u5f0ZP0TZw29m+F3CKIJWPruDJJvXMkyc5qokh5kUpm0qYlhGyDi596st3Gsh/9LF/I2sEJH3LTP0gs0bWjbHN9XcIw8gbPT50zNZvqv9FGvgsMCErYC5lwPVN1670cpOpqLYV4PgU77t751CE9RsmASeB6Elwh0pAKlfxzITBx4W6aVxkl8Utlblw== member2
  member3:
    pubkey: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA2nyE+baFvebdFqiuEEjGYtLHxgduypfBg1laG8DP9Re0ln0lIJRsTw2HoB1giKRpkLXUdYkS+QVkzP0oZCNRZWuEgIuJnL8vl6c0S53UaFTNbZliIuSQLSPsEbQfIu1lQ9voZG2pwJQTj4yICnr29dSPs6ef4n8pox7hhDZSf6LBrrWWc51WYrZwXCSeDstqq53goCKLeujSZ6Ww3T7Ac17OzyhIQCl0x1w8LlcMshaczPKbFLxgLltIF8OmX9PLHuX0enFOVGKyRW66MIIyHuK65gxY/+8mjrzTw9aWOiQVvYZsjuzqBIBQy4h85ex8wF0xztR50D2ylvrbXSNl2w== member3

```

`

Currently, I have this task that deploys them and ensures they’re the only keys in the root user’s authorized\_keys list:

`

- name: “Ensure team pubkeys are in root’s authorized\_keys”  
authorized\_key:  
user: root  
manage\_dir: yes  
exclusive: yes  
key: |  
{% for \_, user in root\_ssh\_public\_keys.items()%}  
{% for \_, key in user.items() %}  
{{ key }}  
{% endfor %}  
{% endfor %}  
tags: ssh\_keys

`

Now, what I want to be able to do is chuck this into a little role, and have it be usable for any user definitions.  
So, say I had a system with the user ‘example’ on, and I wanted to specify some keys I want that user to have in their authorized\_keys list.  
I could go to that system’s host\_vars and add the following:

`

`

```auto
example_ssh_public_keys:
  someone:
    pubkey: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAvVO3ULx8fNGgInHCFQV6w/gEARBWyS9eA1qRaTEu4njawEjiqSGFHgPuvmgtKlft2MqbnCG3cokFKRAEOZEzy+jUMES8IQEHuSsJuZFnlUC4yzm1mI1OjJk9PwTLDD6OGJDL1gIkz37CYITbsaufS6gFrpoMBZhkVcVKk0JBnmwF/QZUD1uHKFLMtyVwvw8pzWcBcAYBBw5O6hjo2pRIX100bCdMxDrXwFp4yFiJPG6LCya4701whZpqgwk3d/RakJdZLA3pgAlVPZswz8ezj2U5PIYJl+LrUaPE57ZR/eVwNnBE7QPsKCCurIy1bLR0KXiqOmUzdzWDphYCelRurQ== someone
  someone_else:
    pubkey: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAtkScC/o1aDxaXFJdyTMhlF4UewNO/tdQf6EIYJzikSBNKECBjmvrM6bNaIkWA/AzB2dgTS0mug2aVomsBeyN8gAGfV/Wi3bO1kXuI23BmkPUn36OgE5ppQ0O2Gp8VjJaffV9EiYeEY/QlwnshAS9gfDPeTO+u5f0ZP0TZw29m+F3CKIJWPruDJJvXMkyc5qokh5kUpm0qYlhGyDi596st3Gsh/9LF/I2sEJH3LTP0gs0bWjbHN9XcIw8gbPT50zNZvqv9FGvgsMCErYC5lwPVN1670cpOpqLYV4PgU77t751CE9RsmASeB6Elwh0pAKlfxzITBx4W6aVxkl8Utlblw== someone_else  

```

`

`

Notice the variable name is ‘example\_ssh\_public\_keys’.  
In my task above, I need a way of dynamically defining both the ‘user’ parameter value (shown above as ‘root’) and the dictionary I’m operating on (shown above as ‘root\_ssh\_public\_keys’).

My point being I need this to be re-usable for different users.

Am I going about this in a really stupid manner? What would be the best way to approach this?

Thanks in advance for any help!

---

<div class="post-metadata">

**Author:** ![Dylan\_Martin](https://avatars.discourse-cdn.com/v4/letter/d/8797f3/32.png) [@Dylan\_Martin](https://forum.ansible.com/u/Dylan_Martin)\
**Post date:** [December 11, 2015, 5:20pm UTC](https://forum.ansible.com/t/management-of-multiple-exclusive-authorized-keys-entries-for-multiple-users/19990/2 "2015-12-11T17:20:49Z")

</div>

Right of the top of my head, put user specific stuff in a dict in vars file (or conditional include a file for each user), so you have a dict that’s populated differently based on the value of a “user” var.

Then in a dependencies section in a meta/main.yaml, you just do  
{ role: sshrolename, user: username }  
{ role: sshrolename. user: otherusername }

Of course that’s gonna be slow, so you could write your role to want a list of users, and then pass a list in the meta/main.yaml file. You can always pass a list with one item.

---

<div class="post-metadata">

**Author:** ![Daniel\_Nagele](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@Daniel\_Nagele](https://forum.ansible.com/u/Daniel_Nagele)\
**Post date:** [December 11, 2015, 7:06pm UTC](https://forum.ansible.com/t/management-of-multiple-exclusive-authorized-keys-entries-for-multiple-users/19990/3 "2015-12-11T19:06:40Z")

</div>

Hi,

I am using the assemble module, like this:

```yaml
- name: ssh keys for root
  assemble: src=. dest=/root/.ssh/authorized_keys owner=root group=root mode=0600 remote_src=false

```

This ensures a synced set of SSH keys from a dir in my playbook repo, where all stale keys are being removed and all modifications are detected. This makes use of the fact that SSH accepts multiple keys in a single file.

Best regards,  
Daniel