# Understanding security - "your keys are still locked and no one can take control of your nodes." **URL:** \ **Category:** Ansible Project\ **Created:** [January 10, 2013, 5:56am UTC](https://forum.ansible.com/t/understanding-security-your-keys-are-still-locked-and-no-one-can-take-control-of-your-nodes/12192 "2013-01-10T05:56:45Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Rhea](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@Rhea](https://forum.ansible.com/u/Rhea)\ **Post date:** [January 10, 2013, 5:56am UTC](https://forum.ansible.com/t/understanding-security-your-keys-are-still-locked-and-no-one-can-take-control-of-your-nodes/12192/1 "2013-01-10T05:56:45Z")
All, Please help me with this: From the FAQ section: "**If your central server is taken over (or even logged into by a malicious employee), provided you were using SSH-agent and encrypted keys (and/or sudo with a password), your keys are still locked and no one can take control of your nodes"** It means if I have setup passwordless login to all my nodes the user can take control over all the nodes, if he has control of the central server. Right? If I want to automate the management (Example: Software updates) the system will need a privileged user rights, how can we automate but still secure the nodes? Thanks in advance! Rhea ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [January 10, 2013, 6:10am UTC](https://forum.ansible.com/t/understanding-security-your-keys-are-still-locked-and-no-one-can-take-control-of-your-nodes/12192/2 "2013-01-10T06:10:30Z")
If using sudo passwords, getting your keys will give them login but not admin privileges (unless you put your keys in root's authorized\_keys file). They also need to know the password on each node. if you want automated system updates it is easier to cron at the node, ansible-pull can work this way. Then central server won't need unprotected key and passwordless sudo or root login. ---
**Author:** ![Rhea](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@Rhea](https://forum.ansible.com/u/Rhea)\ **Post date:** [January 10, 2013, 6:49am UTC](https://forum.ansible.com/t/understanding-security-your-keys-are-still-locked-and-no-one-can-take-control-of-your-nodes/12192/3 "2013-01-10T06:49:35Z")
I get it now. Thank you very much. (solved) -Rhea ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [January 10, 2013, 1:20pm UTC](https://forum.ansible.com/t/understanding-security-your-keys-are-still-locked-and-no-one-can-take-control-of-your-nodes/12192/4 "2013-01-10T13:20:18Z")
That's not what this means, Brian 🙂 What this means is by using SSH keys with passwords (not sudo with a password, we mean about encrypted SSH keys) gaining root access to the central build server in any way doesn't give you any ability to change what is happening on the nodes. You still have to use ssh-agent and enter your password, or otherwise supply your password, in order to make the key useful, and you are still limited by the node's decision to let you in. Sudo is of course a layer beyond that, but not the primary protection system. This is not true of other config management systems that are based on PKI systems. ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [January 10, 2013, 2:35pm UTC](https://forum.ansible.com/t/understanding-security-your-keys-are-still-locked-and-no-one-can-take-control-of-your-nodes/12192/5 "2013-01-10T14:35:23Z")
Michael, sorry I should have been more explicit, I wasn't trying to explain the FAQ. Just to address what I inferred was a misunderstanding and to give him a way to attain (again, what I inferred) was his purpose (unattended ansible driven updates). ---
**Author:** ![Rhea](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@Rhea](https://forum.ansible.com/u/Rhea)\ **Post date:** [January 12, 2013, 6:45am UTC](https://forum.ansible.com/t/understanding-security-your-keys-are-still-locked-and-no-one-can-take-control-of-your-nodes/12192/6 "2013-01-12T06:45:00Z")
Thank you Michael, this really helped me understand much better. Brian: It’s She/Her here 🙂 On my way building OpenStack Proof-of-Concept setup with Ansible. I really like Ansible. Thanks again for all your support! -Rhea ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [January 12, 2013, 2:26pm UTC](https://forum.ansible.com/t/understanding-security-your-keys-are-still-locked-and-no-one-can-take-control-of-your-nodes/12192/7 "2013-01-12T14:26:01Z")
> On my way building OpenStack Proof-of-Concept setup with Ansible. I really > like Ansible. Excellent, I'm doing OpenStack things at work now (not with Ansible -- but that's ok), so I would be very interested in seeing if you get to a point where you can publish your playbooks. I'd much rather grok what is in a good OpenStack installation from reading a series of Ansible playbooks than looking at devstack shell scripts. Lorin Hochenstein also has some earlier work done with Vagrant here ( [https://github.com/lorin/openstack-ansible](https://github.com/lorin/openstack-ansible) ) -- I'd really like to see a multi-server deployment, and also including Quantum. I would assume the Vagrant pieces can be skipped over for those not using Vagrant. --Michael ---
**Author:** ![Lorin\_Hochstein1](https://avatars.discourse-cdn.com/v4/letter/l/ce73a5/32.png) [@Lorin\_Hochstein1](https://forum.ansible.com/u/Lorin_Hochstein1)\ **Post date:** [January 13, 2013, 2:31am UTC](https://forum.ansible.com/t/understanding-security-your-keys-are-still-locked-and-no-one-can-take-control-of-your-nodes/12192/8 "2013-01-13T02:31:04Z")
Rhea: If you do look at the OpenStack Ansible scripts I wrote, note that they were written for Essex, not Folsom, and so they don’t include things like Quantum and Cinder. (They do, however, support multi-node, if you run under Vagrant it will actually launch two VMs, a cloud controller and a compute node). Also, if you run into any problems with the official OpenStack documentation as you go, please submit a documentation bug at [https://bugs.launchpad.net/openstack-manuals/+filebug](https://bugs.launchpad.net/openstack-manuals/+filebug) (I’m a member of the OpenStack doc team). Some day, I’d like to write some OpenStack modules for Ansible to make it easier to do things like manage users, services, and projects/tenants in keystone. One of those days… Take care, Lorin ---
**Author:** ![Rhea](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@Rhea](https://forum.ansible.com/u/Rhea)\ **Post date:** [January 13, 2013, 4:44am UTC](https://forum.ansible.com/t/understanding-security-your-keys-are-still-locked-and-no-one-can-take-control-of-your-nodes/12192/9 "2013-01-13T04:44:32Z")
Thanks Michael and Lorin. This group is very helpful 🙂 I’ll surely make use of the your existing playbooks and will keep you guys updated. Thanks again!