5

Just starting out with Ansible, I have set up an Asible user on the client machine and created a set of keys from OpenSSL. I am running Ansible under my own account. I have specified the user and private key file in the Ansible configuration. I want the remote commands to run as this user and this user to sudo to do commands requiring elevation.

/etc/ansible/ansible.cfg

private_key_file = /etc/ansible/pka/confman.crt
remote_user = confman

Commands such as this do not ask for passphrases after initial entry of passphrase:

ansible all -m ping

The following prompt for a passphrase every time I run them:

ansible all -m ping -b
Enter passphrase for key '/etc/ansible/private_keys/confman.crt':
(success)

ansible all -m ping --sudo
Enter passphrase for key '/etc/ansible/private_keys/confman.crt':
(success)

ansible all -a "cat /etc/redhat-release"
Enter passphrase for key '/etc/ansible/private_keys/confman.crt':
(success)

Why?

Is there any way to set the passphrase? Is there a more secure way? I plan to run ansible remotely and via cron and via other automation tools where entering a passphrase is not an option.

As context, I have never needed to SSH between Linux servers, always from a Windows machine using tools such as putty, RoyalTS and mRemoteNG so my ssh knowledge is... sparse. I assume I am missing something obvious.

1 Answer 1

8

The feature is called ssh-agent:

$ eval `ssh-agent`  # you might have agent already running so this might not be needed
$ ssh-add /etc/ansible/private_keys/confman.crt

now ansible should be able to find the key in agent and authenticate without asking for passphrase every time. From: Documentation: Your first commands

3
  • Hindsight makes this looks wonderfully simple. But I googled the hell out of this expecting it to be an ansible variable. Still no explanation why it was cached for some commands and not others.
    – ZZ9
    Feb 19, 2016 at 20:00
  • 1
    So in a typical real-life scenario you need to configure Vagrant to configure ansible to configure and use ssh-agent? JESUS CHRIST WHY May 25, 2017 at 20:21
  • @SzczepanHołyszewski no. You configure ssh to use a key. What is in the stack above really does not matter.
    – Jakuje
    May 26, 2017 at 5:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .