# SSH ProxyCommand on AWX without writing SSH key in plain text to awx\_task container?

**URL:** <https://forum.ansible.com/t/ssh-proxycommand-on-awx-without-writing-ssh-key-in-plain-text-to-awx-task-container/29691>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [February 15, 2019, 2:30pm UTC](https://forum.ansible.com/t/ssh-proxycommand-on-awx-without-writing-ssh-key-in-plain-text-to-awx-task-container/29691 "2019-02-15T14:30:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\
**Post date:** [February 15, 2019, 2:30pm UTC](https://forum.ansible.com/t/ssh-proxycommand-on-awx-without-writing-ssh-key-in-plain-text-to-awx-task-container/29691/1 "2019-02-15T14:30:02Z")

</div>

In order to support SSH ProxyCommand, awx\_task container needs to have the SSH key of the jump host. I don’t know a way to make the SSH key usable with a passphrase, so I need to pass to AWX a cleartext SSH key to a secure system which doesn’t make our Security department happy.

Is there a way to authenticate against a jump server with a SSH key that has a passphrase in AWX?

Is there a way passing SSH credentials of a jump host and SSH config using an environment variables? If so then maybe it’s possible to create a custom credential within AWX, rather than setting the SSH key and SSH config via files written to the awx\_task container, or am I smoking a pipe of dubious substance?

---

<div class="post-metadata">

**Author:** ![Juan\_A\_S](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@Juan\_A\_S](https://forum.ansible.com/u/Juan_A_S)\
**Post date:** [February 15, 2019, 7:23pm UTC](https://forum.ansible.com/t/ssh-proxycommand-on-awx-without-writing-ssh-key-in-plain-text-to-awx-task-container/29691/2 "2019-02-15T19:23:12Z")

</div>

You can see this thread [https://groups.google.com/forum/?utm\_medium=email&utm\_source=footer#!topic/awx-project/znEbfxBXCLk](https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!topic/awx-project/znEbfxBXCLk) with a similar question asked by me.

What we finally have implemented is to store private keys for jump hosts in the AWX servers (we created an “ansible” user in the jump hosts, so we only need to have 1 SSH key) not in AWX credential store.

Regards.

---

<div class="post-metadata">

**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\
**Post date:** [February 18, 2019, 5:45pm UTC](https://forum.ansible.com/t/ssh-proxycommand-on-awx-without-writing-ssh-key-in-plain-text-to-awx-task-container/29691/3 "2019-02-18T17:45:20Z")

</div>

Hi Juan,

Thanks for the reply!

Unless I misunderstand your solution, it’s the same as mine. You store the jump host’s private key on the AWX host in the awx\_task container. I’m not so happy about the solution as it requires storing the private key in clear text somewhere, even on the awx\_task container.

Rod