# SSH key generation vs. warnings

**URL:** <https://forum.ansible.com/t/ssh-key-generation-vs-warnings/43220>\
**Category:** Get Help\
**Created:** [June 7, 2025, 6:31am UTC](https://forum.ansible.com/t/ssh-key-generation-vs-warnings/43220 "2025-06-07T06:31:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![microlinux](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/microlinux/32/2968_2.png) [@microlinux](https://forum.ansible.com/u/microlinux)\
**Post date:** [June 7, 2025, 6:31am UTC](https://forum.ansible.com/t/ssh-key-generation-vs-warnings/43220/1 "2025-06-07T06:31:59Z")

</div>

Hi,

I have an Ansible role to setup the `root` account on AlmaLinux 9.x. Here’s what the task looks like:

```auto
- name: Set password and generate SSH key pair for root
  ansible.builtin.user:
    name: root
    password: >-
      {{root_passwd|
      password_hash('sha512', 65534|
      random(seed=inventory_hostname)|
      string)}}
    generate_ssh_key: true
    ssh_key_bits: 4096

```

When I run the corresponding playbook the first time, everything is OK and the SSH key pair is generated as expected.

But on subsequent runs, I get the following warning:

```auto
TASK [almalinux9_setup_root : Set password and generate SSH key pair for root] ****************************
[WARNING]: Found existing ssh key private file "/root/.ssh/id_rsa", no force, so skipping ssh-keygen
generation
ok: [localhost]

```

Shouldn’t this be silent and completely green, without a warning? After all, this is the expected behavior. The first run creates the SSH key pair for root, and subsequent runs just ignore SSH key pair creation since it’s already present.

Any suggestions ?

---

<div class="post-metadata">

**Author:** ![chris](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/chris/32/293_2.png) [@chris](https://forum.ansible.com/u/chris)\
**Post date:** [June 7, 2025, 11:08am UTC](https://forum.ansible.com/t/ssh-key-generation-vs-warnings/43220/2 "2025-06-07T11:08:47Z")

</div>

Is the [password](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/user_module.html#parameter-password) changing each time causing the task to be run each time because [force](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/user_module.html#parameter-force) is not set?

---

<div class="post-metadata">

**Author:** ![microlinux](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/microlinux/32/2968_2.png) [@microlinux](https://forum.ansible.com/u/microlinux)\
**Post date:** [June 7, 2025, 11:29am UTC](https://forum.ansible.com/t/ssh-key-generation-vs-warnings/43220/3 "2025-06-07T11:29:22Z")

</div>

No, it’s not. Password is stored in `vars/secret.yml` and doesn’t change. I’m puzzled.

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [June 8, 2025, 12:22pm UTC](https://forum.ansible.com/t/ssh-key-generation-vs-warnings/43220/4 "2025-06-08T12:22:21Z")

</div>

Maybe the user module wants to tell you that it doesn’t really check the SSH keys, it only creates them when asked to (when not existing by default, or always if `force=true`), but it won’t check whether it matches your settings (like `ssh_key_bits=4096`).

---

<div class="post-metadata">

**Author:** ![U880D](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/u880d/32/10032_2.png) [@U880D](https://forum.ansible.com/u/U880D)\
**Post date:** [December 23, 2025, 12:15pm UTC](https://forum.ansible.com/t/ssh-key-generation-vs-warnings/43220/5 "2025-12-23T12:15:56Z")

</div>

> [@microlinux](#):
>
> Shouldn’t this be silent and completely green, without a warning? … Any suggestions?

No, as you already mentioned, that is the expected behavior. You may have a look into the similar question about [Module user WARNING:Found existing ssh key](https://forum.ansible.com/t/module-user-warning-found-existing-ssh-key/45021/2) here.

I think the only option is to disable in [Ansible Configuration Settings](https://docs.ansible.com/projects/ansible/latest/reference_appendices/config.html) the [`ACTION_WARNINGS`](https://docs.ansible.com/projects/ansible/latest/reference_appendices/config.html#action-warnings)

> By default, Ansible will issue a `WARNING` when received from a task action (module or action plugin). These warnings can be silenced by adjusting this setting to `False`.

by setting in example

```auto
grep 'defaults\|warnings' ansible.cfg
[defaults]
deprecation_warnings = False
action_warnings = False

```

and then resulting into an output of

```yaml
TASK [ansible.builtin.user] ******************
ok: [localhost]

PLAY RECAP ***********************************
localhost : ok=1 changed=0

```