# Ssh-rsa preconfiguration for host

**URL:** <https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693>\
**Category:** Get Help\
**Tags:** awx\
**Created:** [February 6, 2024, 9:16am UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693 "2024-02-06T09:16:45Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\
**Post date:** [February 6, 2024, 9:16am UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/1 "2024-02-06T09:16:45Z")

</div>

Hello!  
im new to AWX.  
I have for testing everything in a GitHub Repo.  
I have a pretty old Suse server which i just can SSH into if i use -oHostKeyAlgorithms=+ssh-rsa.  
I want to import this host with this settings preconfigured, because its the only one.  
The yml ChatGPT tried to sell me , doesnt get accepted by AWX:

```auto
---
ansible_host: 192.168.150.20
ansible_ssh_common_args: '-oHostKeyAlgorithms=+ssh-rsa'

```

```auto
host_list declined parsing /runner/project/nagios.yml as it did not pass its verify_file() method
script declined parsing /runner/project/nagios.yml as it did not pass its verify_file() method

```

Thank you in advance for your help!

---

<div class="post-metadata">

**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\
**Post date:** [February 7, 2024, 1:09pm UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/2 "2024-02-07T13:09:36Z")

</div>

My current yaml after some testing, but still wrong:

```auto
- hosts: localhost
  tasks:
    - name: Nagios_3
      add_host:
        name: "192.168.150.20"
        groups: main
        ansible_ssh_common_args: "-o HostKeyAlgorithms=ssh-rsa"

```

---

<div class="post-metadata">

**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\
**Post date:** [February 7, 2024, 10:22pm UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/3 "2024-02-07T22:22:45Z")

</div>

Chat GPT just regurgitates common patterns, so anything it says has to be fact-checked, making it less efficient than just reading the documentation.

The inventory format is determined by the [inventory plugin](https://docs.ansible.com/ansible/latest/collections/index_inventory.html) you want to use.

The [intro to inventory](https://docs.ansible.com/ansible/latest/inventory_guide/intro_inventory.html) contains some examples of YAML inventory files as does the [yaml inventory plugin](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/yaml_inventory.html).

For example:

```auto
group0:
  hosts:
    host0:
      ansible_host: 192.168.150.20
      ansible_ssh_common_args: '-oHostKeyAlgorithms=+ssh-rsa'

```

```auto
$ ansible-inventory -i inv.yml --list
{
    "_meta": {
        "hostvars": {
            "host0": {
                "ansible_host": "192.168.150.20",
                "ansible_ssh_common_args": "-oHostKeyAlgorithms=+ssh-rsa"
            }
        }
    },
    "all": {
        "children": [
            "ungrouped",
            "group0"
        ]
    },
    "group0": {
        "hosts": [
            "host0"
        ]
    }
}

```

---

<div class="post-metadata">

**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\
**Post date:** [February 8, 2024, 10:42am UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/4 "2024-02-08T10:42:14Z")

</div>

Thank you!  
I could just for addin inventory find examples for the ssh-rsa in yml in the guide.

---

<div class="post-metadata">

**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\
**Post date:** [February 8, 2024, 1:13pm UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/5 "2024-02-08T13:13:00Z")

</div>

> [@shertel](#):
>
> ```auto
> group0:
> hosts:
> host0:
> ansible_host: 192.168.150.20
> ansible_ssh_common_args: '-oHostKeyAlgorithms=+ssh-rsa'
> 
> ```

I cant test tosday - i let my other tickets unattended too long for a while 😆

---

<div class="post-metadata">

**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\
**Post date:** [February 8, 2024, 1:22pm UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/6 "2024-02-08T13:22:58Z")

</div>

No worries. I have a hard time navigating the docs too, but if you google a query like `inventory site:docs.ansible.com` the intro to inventory will be one of the top results (the first for me).

---

<div class="post-metadata">

**Author:** ![j-oss2023](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/j-oss2023/32/2260_2.png) [@j-oss2023](https://forum.ansible.com/u/j-oss2023)\
**Post date:** [February 11, 2024, 4:29am UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/7 "2024-02-11T04:29:05Z")

</div>

There are other options to tackle your issue… depending on your needs / use case

**Add custom SSH client config allowing the deprecated algo,**

either in ~/.ssh/config (per host / match)

```bash
Host 192.168.150.20
   KexAlgorithms +diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
   Ciphers +aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
   HostKeyAlgorithms +ssh-rsa
   PubkeyAcceptedAlgorithms +ssh-rsa

```

For instance, in our environment, it’s likely there are many machines with old ssh server, so rather than specify per host

set globally in /etc/ssh/ssh\_config.d/deprecated.conf:

```bash
KexAlgorithms +diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
Ciphers +aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
HostKeyAlgorithms +ssh-rsa
PubkeyAcceptedKeyTypes +ssh-rsa

```

The way you’ve chosen to do it is probably best… just sharing other available options…

Also if you are new to AWX, there will be a time (probably soon) where you’ll have to build your own execution environment to handle more specific cases / tasks

for this, you should look at ansible-builder to build a customized container (runner)  
There are a million and one ways to configure it, it can be difficult to get started,  
I’ve put together a template that can help get you started

[https://github.com/j-oss2023/ansible-builder-template](https://github.com/j-oss2023/ansible-builder-template)

Good luck !

---

<div class="post-metadata">

**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\
**Post date:** [February 12, 2024, 8:57am UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/8 "2024-02-12T08:57:39Z")

</div>

Hello - i added the host with the ssh rsa options set, but it seems its not used:

 ![grafik](https://us1.discourse-cdn.com/ansible/original/2X/d/d6eeafcb40d6764041fe5508e10798a6da21c87e.png)

 ![grafik](https://us1.discourse-cdn.com/ansible/original/2X/3/3af1aef3a9e0494c8d42c634c0b51eadcdba1582.png)

---

<div class="post-metadata">

**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\
**Post date:** [February 12, 2024, 9:00am UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/9 "2024-02-12T09:00:15Z")

</div>

how can i edit the sh config for awx - i dont think its using the settings at the local server, but in the Cubernetes container - i dont know how to get there.

---

<div class="post-metadata">

**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\
**Post date:** [February 12, 2024, 12:28pm UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/10 "2024-02-12T12:28:25Z")

</div>

Should it be something like `ansible_ssh_common_args: '-oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa'`? If you run a ping test on the CLI with extra verbosity, you can see the ssh command being used to connect `ansible -i inv -m ping all -vvv`.

---

<div class="post-metadata">

**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\
**Post date:** [February 13, 2024, 7:45am UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/11 "2024-02-13T07:45:32Z")

</div>

At least it got with the additional ""importet - i can try to remove it and test again.  
I used `ansible_ssh_common_args: '-oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa'` in the yaml and it got like this changed while the import.

---

<div class="post-metadata">

**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\
**Post date:** [February 13, 2024, 8:01am UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/12 "2024-02-13T08:01:15Z")

</div>

The info was weird, because it was shwn in the json view - when i change to yaml exeryting looks okay.

 ![grafik](https://us1.discourse-cdn.com/ansible/original/2X/9/94046aa705827bf5a7ea5a38cee0cd591778303b.png)

---

<div class="post-metadata">

**Author:** ![j-oss2023](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/j-oss2023/32/2260_2.png) [@j-oss2023](https://forum.ansible.com/u/j-oss2023)\
**Post date:** [February 13, 2024, 8:11am UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/13 "2024-02-13T08:11:11Z")

</div>

@gothsome

If you can’t get that var working build your own custom execution environment,

you are right, it doesnt run SSH from the host, but from a specialized “execution environment” container … by default it uses `quay.io/ansible/awx-ee:latest`

But you can build your own custom environment, check out my repo i posted earlier …

Also read:

[https://docs.ansible.com/automation-controller/latest/html/userguide/execution\_environments.html](https://docs.ansible.com/automation-controller/latest/html/userguide/execution_environments.html)

After you’ve built your ee with ansible-builder, you can push it to docker hub:

> **[Part 3: Share the application](https://docs.docker.com/get-started/workshop/04_sharing_app/)**
>
> Sharing your image you built for your example application so you can run it else where and other developers can use it

then in AWX, go to execution environments on the left menu

 ![Screenshot 2024-02-13 at 8.02.49 pm](https://us1.discourse-cdn.com/ansible/original/2X/5/5c343d40daa70a4f4ca3e0ff49f892bbdb87de4a.png)

Then point it to your image that you hosted on docker hub ie.

 ![Screenshot 2024-02-13 at 8.05.07 pm](https://us1.discourse-cdn.com/ansible/original/2X/a/a86d17214ced849849216a78f807b1bc8bdba5a7.png)

Make sure the image is public so you don’t have to setup credentials for the registry …

If you make it private you’ll have to setup a Registry credential …

---

<div class="post-metadata">

**Author:** ![gothsome](https://avatars.discourse-cdn.com/v4/letter/g/278dde/32.png) [@gothsome](https://forum.ansible.com/u/gothsome)\
**Post date:** [February 13, 2024, 11:45am UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/14 "2024-02-13T11:45:05Z")

</div>

Thank you,  
but i slowly think now all this work just for one single host is for me not the time worth to invest.  
I thouht this would be easy with just the right aded code in the details of the host.  
I wont open an issue too, because its an relly old host os from around 2007 and has to be expected that there would be some incopabilities.

Thank you for your infos and the ones you will give me in the future!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [March 14, 2024, 11:46am UTC](https://forum.ansible.com/t/ssh-rsa-preconfiguration-for-host/3693/15 "2024-03-14T11:46:04Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.