# Storing private ssh keys in variables **URL:** \ **Category:** Ansible Project\ **Created:** [July 25, 2014, 3:12pm UTC](https://forum.ansible.com/t/storing-private-ssh-keys-in-variables/15779 "2014-07-25T15:12:29Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Ben\_Stokes](https://avatars.discourse-cdn.com/v4/letter/b/e274bd/32.png) [@Ben\_Stokes](https://forum.ansible.com/u/Ben_Stokes)\ **Post date:** [July 25, 2014, 3:12pm UTC](https://forum.ansible.com/t/storing-private-ssh-keys-in-variables/15779/1 "2014-07-25T15:12:29Z")
I’m trying to store ssh private keys in variables in a vault-protected file, and I’m having problems. The issue is with the variables spanning many lines, when they are injected during the playbook run, on the destination server they end up in a mangled format or the playbook crashes out. So for example, in my vars file (this is a key I just generated and deleted to demo it here): id\_dsa: “-----BEGIN DSA PRIVATE KEY----- MIIBuwIBAAKBgQC4ZqbQspFVSqjJmLbyve+5/NG0oGLa6GMd3pctilZkUcyld/k+ j07TROjQLsSbDiweUa5HKBVSTuoHSLAq7V8vr3DSV2T/bX325STgo/0vkIJeZmcr 1eZiBQyPRMtbVORxbfBI94ofL52C381eRxNhNgr27FUxJPaP0AelmrNtHwIVAI4R MwoEbRbqBFzwC1lPvV4XrkU3AoGANSGsM0gWzFDUL3o3KpKbGehfAXdKDjGms3FN r9itrMVy1klErQ9GHOeyGRD+Pkr4LDP7CUELpR58/Yv9358tkkffSpHqstuvgX1k\n I12214Wk/VqjOBaQhZDa6FwM3wrPAztGAZChvj5BdRQDqh77x9ljBWE8psfZ+TRe SBvMQ7cCgYAOUWMQdc3RYc/+HuKf8d0ke5ecFXSnpkrNt0spJdviMl0ui8n6aPOy rP/5FGpzR8to8/xGnpD6RdEFuSTABDHR85Y9pLmts1Zf1ctGMcxXiPsjunHfX/GI fc6sVh556dgAf7a33aEPjqw7Ll+q9rTq6OFSgL14B1y8Gs2EbyjH6AIVAIQndtm5 YhlFBaJk02PRX3zKorL6 -----END DSA PRIVATE KEY-----” in my playbook: - name: push out ssh private keys shell: ‘echo -e “{{ item.value }}” \> /home/hcom/.ssh/{{ item.name }}’ with\_items: - { name: “id\_dsa”, value: “{{ id\_dsa }}” } - { name: “id\_rsa”, value: “{{ id\_rsa }}” } I’ve tried adding \n on the end of each line in my key, I’ve also tried all on one line with \n separators. I’m getting this error: fatal: [127.0.0.1] =\> A variable inserted a new parameter into the module args. Be sure to quote variables if they contain equal signs (for example: “{{var}}”). Any pointers would be cheerfully accepted. I’m interested to hear how others have tackled this issue. Thanks Ben ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [July 26, 2014, 7:56pm UTC](https://forum.ansible.com/t/storing-private-ssh-keys-in-variables/15779/2 "2014-07-26T19:56:19Z")
It seems better to password protect the key itself IMHO. That way it’s still secure even outside of vault, and you can just use the file lookup to pass to the authorized key module. You can also then use the more obvious “copy” module to move the files around. ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [July 27, 2014, 4:07am UTC](https://forum.ansible.com/t/storing-private-ssh-keys-in-variables/15779/3 "2014-07-27T04:07:08Z")
This is the use case for which I added vault support to the file lookup plugin [https://github.com/ansible/ansible/pull/8110](https://github.com/ansible/ansible/pull/8110) ​ ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [July 27, 2014, 1:18pm UTC](https://forum.ansible.com/t/storing-private-ssh-keys-in-variables/15779/4 "2014-07-27T13:18:41Z")
Yep, this is likely going merged and quite good stuff, but others should be aware lookup plugins evaluate every time the template strings are rendered. You could, depending on usage, make the system do a _LOT_ of math if you aren’t careful. ---
**Author:** ![ramon](https://avatars.discourse-cdn.com/v4/letter/r/34f0e0/32.png) [@ramon](https://forum.ansible.com/u/ramon)\ **Post date:** [July 27, 2014, 7:14pm UTC](https://forum.ansible.com/t/storing-private-ssh-keys-in-variables/15779/5 "2014-07-27T19:14:19Z")
I think we do something similar with SSL certificates. First, we use the multi-line YAML notation ni the vars file: ssl\_private\_key: | -----BEGIN RSA PRIVATE KEY----- ETC… Note the spacing in front of the lines, that’s required. In case you don’t need the actual newlines on the other end, you can also use “\>” instead of “|” And then we have a template “templates/ssl\_private\_key.j2” with just the variable as content: {{ ssl\_private\_key }} ---
**Author:** ![Ben\_Stokes](https://avatars.discourse-cdn.com/v4/letter/b/e274bd/32.png) [@Ben\_Stokes](https://forum.ansible.com/u/Ben_Stokes)\ **Post date:** [July 28, 2014, 7:26am UTC](https://forum.ansible.com/t/storing-private-ssh-keys-in-variables/15779/6 "2014-07-28T07:26:38Z")
Thanks, I guess this is what I am looking for and I’ll wait for this patch to be merged. It resolves another thing I was surprised about, if I encrypt whole files with ansible-vault, during the playbook run with --ask-vault-pass the files are still not parsable because they are still encrypted. I suppose this is by design but doesn’t do what I wanted or expected. Michael I will go with your suggestion for now and use something external to protect the private keys. I did find the authorized keys module but the docs only mention use cases for public keys so I didn’t explore it any further. Cheers ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [July 28, 2014, 2:10pm UTC](https://forum.ansible.com/t/storing-private-ssh-keys-in-variables/15779/7 "2014-07-28T14:10:33Z")
" during the playbook run with --ask-vault-pass the files are still not parsable because they are still encrypted" Ansible-vault only applies to ansible variable files, task files, and handlers. Basically anything Ansible would understand to be natively-understood YAML files. ---
**Author:** ![Stephen\_Gargan](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@Stephen\_Gargan](https://forum.ansible.com/u/Stephen_Gargan)\ **Post date:** [July 31, 2014, 11:24pm UTC](https://forum.ansible.com/t/storing-private-ssh-keys-in-variables/15779/8 "2014-07-31T23:24:28Z")
I do something similar to this to store sensitive files in vault. I base64 encode the data and set the variable with the resulting encoded string. Then in my template I use the b64decode filter when applying the variable. in your vault file private\_key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1J… then in your private\_key template add {{private\_key | b64decode}} This has worked very well for me this far. thanks, Steve.