I need to generate ssh-keys(public/private pair) for a user say helen. This user is already in all my salt minions. How do I generate ssh keys for this user from my salt master?

For root user I generated the keys using this command and it worked fine:

salt '*application-server-*' cmd.run "ssh-keygen -q -N '' -f /root/.ssh/id_rsa"

I can issue the following command which can generate ssh-keys for helen; but the permissions and ownerships will be different; so need to issue commands again to correct permissions and ownerships:

salt '*application-server-*' cmd.run "ssh-keygen -q -N '' -f /home/helen/.ssh/id_rsa"

Is there any way in salt to run this command as user helen instead of root?

In general, is there a way in salt to run a command as a non root user?


Using the salt command

salt '*application-server-*' cmd.run \
    "ssh-keygen -q -N '' -f /home/helen/.ssh/id_rsa" \


Using a state

You can specify the user when using the cmd state by setting the runas to the user name to run the command as:

    - name: ssh-keygen -q -N '' -f /home/helen/.ssh/id_rsa
    - runas: helen
    - unless: test -f /home/helen/.ssh/id_rsa


  • 1
    I look at the salt state of your answer. AFAIK this generates a new key every time this state gets called. Is there a way to create they key only if it does not exist yet? – guettli Jul 29 '16 at 12:21
  • You're absolutely right. You need to make sure this state is executed only once, by setting a specific grain, for example. You can set a grain with another state that depends on this one, then check if the grain exists in your sls file to enable or disable the state. – Christophe Drevet-Droguet Aug 1 '16 at 19:02
  • In versions prior than 2016.3, the state parameter wasn't runas but user. – Christophe Drevet-Droguet Oct 4 '16 at 6:39
  • You can also do: - creates: /home/helen/.ssh/id_rsa – OrangeDog Feb 26 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.