# validate a file's content and reporting

**URL:** <https://forum.ansible.com/t/validate-a-files-content-and-reporting/25415>\
**Category:** Ansible Project\
**Created:** [September 6, 2017, 10:43am UTC](https://forum.ansible.com/t/validate-a-files-content-and-reporting/25415 "2017-09-06T10:43:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ask\_21](https://avatars.discourse-cdn.com/v4/letter/a/71e660/32.png) [@Ask\_21](https://forum.ansible.com/u/Ask_21)\
**Post date:** [September 6, 2017, 10:43am UTC](https://forum.ansible.com/t/validate-a-files-content-and-reporting/25415/1 "2017-09-06T10:43:20Z")

</div>

Hi everybody,

does anybody know what will be the best approach to read and validate a remote-files content?

background: I’m managing linux servers with ansible and have to validate on hundrets of linux servers if any user with sudo permission has changed the content of /root/.ssh/authorized\_keys2.  
There shouldn’t be any public keys inside, just two which are known and are allowed login as root.

I didn’t created a playbook yet because i don’t know which way/module will be best - is there any option like using a “negotiate” lineinfile operation or maybe using shell/fetch and doing a diff with a template authorized\_keys2 file?

What do you think - how will you challenge this?

Thanks  
Stefan

---

<div class="post-metadata">

**Author:** ![Cev\_Ing](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@Cev\_Ing](https://forum.ansible.com/u/Cev_Ing)\
**Post date:** [September 6, 2017, 12:08pm UTC](https://forum.ansible.com/t/validate-a-files-content-and-reporting/25415/2 "2017-09-06T12:08:54Z")

</div>

I have a vault file containing all ssh keys and then I use the authorized\_key module to manage the keys.

[http://docs.ansible.com/ansible/latest/authorized\_key\_module.html](http://docs.ansible.com/ansible/latest/authorized_key_module.html)

But you can use also the copy module to make sure that the remote file has the required content.

---

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [September 6, 2017, 2:52pm UTC](https://forum.ansible.com/t/validate-a-files-content-and-reporting/25415/3 "2017-09-06T14:52:45Z")

</div>

As said the authorized\_key module is a good approach.  
I wouldn't use a vault because they're public keys, which are, well, public.  
And from what you tell you should probably use the 'exclusive' parameter.  
And finally use '--check' to only get a report on what hosts have  
their authorized\_keys2 file changes.  
BTW the default file is authorized\_keys, so you;d have to configure a  
custom 'path' parameter as well.

Note that depending on your sshd configuration, people might have left  
authorized\_keys2 intact, and added authorized\_key file.  
So I think you should also take that into account, but this probably  
requires some more logic.

Dick

---

<div class="post-metadata">

**Author:** ![Ask\_21](https://avatars.discourse-cdn.com/v4/letter/a/71e660/32.png) [@Ask\_21](https://forum.ansible.com/u/Ask_21)\
**Post date:** [September 7, 2017, 7:22am UTC](https://forum.ansible.com/t/validate-a-files-content-and-reporting/25415/4 "2017-09-07T07:22:40Z")

</div>

Thanks to all,

i wasn’t searching for authorized\_key module but as Dick said - check is the option i prefer.  
Also thanks for the hint about authorized\_keys - still found some servers where users added their key in that file.

regards  
Stefan