# reading the key file contents **URL:** \ **Category:** Ansible Project\ **Created:** [August 7, 2023, 11:01am UTC](https://forum.ansible.com/t/reading-the-key-file-contents/38307 "2023-08-07T11:01:41Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Veera](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/veera/32/4107_2.png) [@Veera](https://forum.ansible.com/u/Veera)\ **Post date:** [August 7, 2023, 11:01am UTC](https://forum.ansible.com/t/reading-the-key-file-contents/38307/1 "2023-08-07T11:01:41Z")
In a playbook , I gathered the user key into the variable “user\_key” and using a add\_host module to login to the server and execute the required tasks . - name: Writing the key to a file ansible.builtin.copy: content: “{{ user\_key }}” dest: /tmp/new\_inst.pem mode: ‘0600’ follow: yes register: keyfile - name: create a temp inventory ansible.builtin.add\_host: hostname: ‘{{ servera }}’ groups: mygroup ansible\_ssh\_private\_key\_file: “{{ keyfile.dest }}” ansible\_ssh\_user: “root” ansible\_ssh\_extra\_args: ‘-o StrictHostKeyChecking=no’ - name: validate the httpd in new hosts hosts: mygroup gather\_facts: true become: yes environment: ANSIBLE\_HOST\_KEY\_CHECKING: “False” tasks: - name: Start service httpd, if not started service: name: httpd state: started All works fine using the above. However is there an option to read the content of the key directly , read the contents of the keyfile to the add\_host module with something like “ansible\_ssh\_private\_key” ?? I want to avoid writing the key to a file, chmod 600 and then remove it after execution. Also , is there a way to read the variable “user\_key” when manually feed during the ansible-playbook command , like for the same above codes usage . # ansible-playbook playbook -e “user\_key={{ssh\_content}}” where ssh\_content is a python variable which have the exact key\_value details from another program output . ---
**Author:** ![Pierre\_TOURON](https://avatars.discourse-cdn.com/v4/letter/p/b5a626/32.png) [@Pierre\_TOURON](https://forum.ansible.com/u/Pierre_TOURON)\ **Post date:** [August 7, 2023, 5:06pm UTC](https://forum.ansible.com/t/reading-the-key-file-contents/38307/2 "2023-08-07T17:06:50Z")
Hi, Unfortunately, ansible\_ssh\_private\_key\_file requires a file and I don’t see a proper way to assemble a file from a string in an inline manner. You could probably do some jinja magic to that end, though it won’t be very elegant. I’ll try to wrap my head about it a bit more and come back to you if I find something. As for your second question, are you trying to read ssh\_content from a file or stdin ? Here is an example for both scenarios using [lookup plugin](https://docs.ansible.com/ansible/latest/plugins/lookup.html) : 19:02|ptn@BENDER:~/conf (main // U:1 M(u):1) (default)$ cat ~/TEMP/truc truc 19:02|ptn@BENDER:~/conf (main // U:1 M(u):1) (default)$ ansible -c local localhost -m debug -a ‘var=foo’ -e foo=“{{ lookup(‘file’, ‘~/TEMP/truc’) }}” localhost | SUCCESS =\> { “foo”: “truc” } 19:03|ptn@BENDER:~/conf (main // U:1 M(u):1) (default)$ echo “truc” | ansible -c local localhost -m debug -a ‘var=foo’ -e foo=“{{ lookup(‘file’, ‘/dev/stdin’) }}” localhost | SUCCESS =\> { “foo”: “truc” } ---
**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\ **Post date:** [August 7, 2023, 5:31pm UTC](https://forum.ansible.com/t/reading-the-key-file-contents/38307/3 "2023-08-07T17:31:25Z")
Where does this "user\_key" originate from? > In a playbook , I gathered the user key into the variable "user\_key" and using a add\_host module to login to the server and execute the required tasks . > > - name: Writing the key to a file >       ansible.builtin.copy: >         content: "{{ user\_key }}" >         dest: /tmp/new\_inst.pem >         mode: '0600' >         follow: yes >       register: keyfile > >     - name: create a temp inventory >       ansible.builtin.add\_host: >         hostname: '{{ servera }}' >         groups: mygroup >         ansible\_ssh\_private\_key\_file: "{{ keyfile.dest }}" >         ansible\_ssh\_user: "root" Are you sure this is necessary? What about an unpriviliged user + sudo? >         ansible\_ssh\_extra\_args: '-o StrictHostKeyChecking=no' > > - name: validate the httpd in new hosts >   hosts: mygroup >   gather\_facts: true >   become: yes >   environment: >     ANSIBLE\_HOST\_KEY\_CHECKING: "False" >   tasks: >     - name: Start service httpd, if not started >       service: >         name: httpd >        state: started > > All works fine using the above. > However is there an option to read the content of the key directly , read the contents of the keyfile to the add\_host module with something like "ansible\_ssh\_private\_key" ?? > I want to avoid writing the key to a file, chmod 600 and then remove it after execution. Also, I think if you write the key to the filesystem, and then later remove it, it is not really gone, but merely unlinked. So that is an extra reason to careful to handle the user's private key data that way. > Also , is there a way to read the variable "user\_key" when manually feed during the ansible-playbook command , like for the same above codes usage . > > # ansible-playbook playbook -e "user\_key={{ssh\_content}}" > where ssh\_content is a python variable which have the exact key\_value details from another program output . Are you sure you want to use sensitive materials like that? I think this will leak the content into the shell history, process output etc. ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [August 7, 2023, 10:30pm UTC](https://forum.ansible.com/t/reading-the-key-file-contents/38307/4 "2023-08-07T22:30:24Z")
You cannot use a string for an ssh key, it is a file as ansible must pass a file to `ssh` command line client (which does not accept a string). If you only have a string, you have to write the string to a file before the connection starts and remove it once it ends. doing this securely is not trivial and the reason the ssh connection plugin does not attempt to do so. ---
**Author:** ![Veera](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/veera/32/4107_2.png) [@Veera](https://forum.ansible.com/u/Veera)\ **Post date:** [August 8, 2023, 3:02pm UTC](https://forum.ansible.com/t/reading-the-key-file-contents/38307/5 "2023-08-08T15:02:20Z")
Hi all, Thanks for the valuable inputs and directions . I was looking for a new approach which I was failing and you all confirmed the best and secure way is to have the key as a file with appropriate permissions . I will be proceeding with the same setup which I already have …