2

What is the best practice for handling local and remote users in ansible?

My current understand is we have a local and remote machine with a default local user and default admin user on the remote machine. In the standard case, joe will generate a SSH key pair and copy his public key to the remote '.ssh/authorised_keys'.

localhost                                           remotehost
=========                                           ==========
                                                    // sudo root user
user:joe                                            user:admin
passsword:xxx                                       password:admin123
.ssh/id_rsa.pub ----------------------------------> ./ssh/authorised_keys

Am i correct to say that the standard ansible.cfg settings would be

[defaults]
ansible_user=joe
ansible_ssh_user=admin
private_key_file=/home/pauloconnell/.ssh/id_rsa.pem

I came across this ticket which recommends creating an ansible specific user for running the remote commands https://stackoverflow.com/questions/29392369/ansible-ssh-private-key-in-source-control

Again, the picture would look like this with a new 'ansible_ssh_user' created on the local machine, its password saved to a vault and then the same user created on the remote server with the correct group permissions

localhost                                           remotehost
=========                                           ==========
                                                    // sudo root user
user:joe                                            user:admin
passsword:xxx                                       password:admin123
~~.ssh/id_rsa.pub ----------------------------------> ./ssh/authorised_keys~~
user:ansible_ssh_user                               user:ansible_ssh_user    
.ssh/id_rsa.pub ----------------------------------> ./ssh/authorised_keys

I'd like to confirm how the config file would change in this case?

[defaults]
ansible_user=ansible_ssh_user
ansible_ssh_user=ansible_ssh_user
private_key_file=??
1

Yes and no.

  • you don't need ansible_ssh_user and ansible_user as the use of ansible_ssh_* variables is deprecated since version 2.0. See this note:

Ansible 2.0 has deprecated the “ssh” from ansible_ssh_user, ansible_ssh_host, and ansible_ssh_port to become ansible_user, ansible_host, and ansible_port. If you are using a version of Ansible prior to 2.0, you should continue using the older style variables (ansible_ssh_*). These shorter variables are ignored, without warning, in older versions of Ansible.

  • In most cases you don't need to set private_key_file.

  • You don't need to have ansible_user on the control machine. You just need to make sure that your regular user on the control machine can login as ansible_user on the remote host, which means you need to copy the ssh key to the remote host. ssh-copy-id ansible_user@remote-host should be all you need.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.