Didnt find anywhere what is best practise for using Ansible by multiple administrators. We would like to login with SSH keys to both control machine and remotes.

Is the best way to do this:

  1. Create every administrator his own account at control machine and then just use BECOME to SSH to remote hosts with one general account with sudo rights on remotes? With this solution only private key stored at control machine would be one for general user.

  2. Create own account for every administrator on control and remote machines and let them SSH to remotes with their own account? This solution basicly means, we would have to store private keys for each administrator at control machine.

Thank you for your help.


I say Option 1. For auditing you can set your sights on the Tower control server to see which jobs have ran and what they did, and who triggered them.

Option 2 stinks because it:

  • Doesn't scale well, adding & removing admins from your ansible admin team requires you to update every node again.
  • Doesn't increase visibility since you already know who ran what from the control server
  • Doesn't increase security, since every user is passing through the become module before taking action.
  • what if we dont have Tower? Scaling is not a huge problem thanks to Ansible playbooks.
    – helloweenx
    Sep 10 '18 at 6:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.