My team has an Ansible hub, from which we manage several nodes. To do so, we ssh to the hub, and sudo to a shared "ansible" user. This user has an ssh keypair, which all the nodes have in their authorized_keys file.

This works, but it means that everyone has access to all nodes at all times.

What I'd like is some approach that lets us restrict users so they can only access certain nodes. We could add/remove individuals' keys from each node's authorized_keys as needed, but this seems like a lot to manage. I'd like something that's easy to manage, so that we can quickly authorize/deauthorize a user for different nodes.

Does anyone have a strategy like this? I was thinking of using signed ssh keys to grant temporary access, but haven't really explored it.

  • It's time to move to AWX/Tower. – Michael Hampton Mar 17 '18 at 20:22
  • Rundeck could be a good, cheap open-source solution to this too. – Bruce Becker Nov 8 '18 at 9:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.