authorized_key - Adds or removes an SSH authorized key
Synopsis
- Adds or removes SSH authorized keys for particular user accounts
Options
parameter | required | default | choices | comments |
---|---|---|---|---|
comment (added in 2.4)
| no | None | Change the comment on the public key. Rewriting the comment is useful in cases such as fetching it from GitHub or GitLab. If no comment is specified, the existing comment will be kept. | |
exclusive (added in 1.9)
| no | no |
| Whether to remove all other non-specified keys from the authorized_keys file. Multiple keys can be specified in a single key string value by separating them by newlines.This option is not loop aware, so if you use with_ , it will be exclusive per iteration of the loop, if you want multiple keys in the file you need to pass them all to key in a single batch as mentioned above. |
key | yes | The SSH public key(s), as a string or (since 1.9) url (https://github.com/username.keys) | ||
key_options (added in 1.4)
| no | A string of ssh key options to be prepended to the key in the authorized_keys file | ||
manage_dir | no | yes |
| Whether this module should manage the directory of the authorized key file. If set, the module will create the directory, as well as set the owner and permissions of an existing directory. Be sure to set manage_dir=no if you are using an alternate directory for authorized_keys, as set with path , since you could lock yourself out of SSH access. See the example below. |
path | no | (homedir)+/.ssh/authorized_keys | Alternate path to the authorized_keys file | |
state | no | present |
| Whether the given key (with the given key_options) should or should not be in the file |
user | yes | The username on the remote host whose authorized_keys file will be modified | ||
validate_certs (added in 2.1)
| no | yes |
| This only applies if using a https url as the source of the keys. If set to no , the SSL certificates will not be validated.This should only set to no used on personally controlled sites using self-signed certificates as it avoids verifying the source site.Prior to 2.1 the code worked as if this was set to yes . |
Examples
- name: Set authorized key took from file authorized_key: user: charlie state: present key: "{{ lookup('file', '/home/charlie/.ssh/id_rsa.pub') }}" - name: Set authorized key took from url authorized_key: user: charlie state: present key: https://github.com/charlie.keys - name: Set authorized key in alternate location authorized_key: user: charlie state: present key: "{{ lookup('file', '/home/charlie/.ssh/id_rsa.pub') }}" path: /etc/ssh/authorized_keys/charlie manage_dir: False - name: Set up multiple authorized keys authorized_key: user: deploy state: present key: '{{ item }}' with_file: - public_keys/doe-jane - public_keys/doe-john - name: Set authorized key defining key options authorized_key: user: charlie state: present key: "{{ lookup('file', '/home/charlie/.ssh/id_rsa.pub') }}" key_options: 'no-port-forwarding,from="10.0.1.1"' - name: Set authorized key without validating the TLS/SSL certificates authorized_key: user: charlie state: present key: https://github.com/user.keys validate_certs: False - name: Set authorized key, removing all the authorized key already set authorized_key: user: root key: '{{ item }}' state: present exclusive: True with_file: - public_keys/doe-jane - name: Set authorized key for user ubuntu copying it from current user authorized_key: user: ubuntu state: present key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}"
Return Values
Common return values are documented here Return Values, the following are the fields unique to this module:
name | description | returned | type | sample |
---|---|---|---|---|
exclusive | If the key has been forced to be exclusive or not. | success | boolean | False |
key | The key that the module was running against. | success | string | https://github.com/user.keys |
key_option | Key options related to the key. | success | string | None |
keyfile | Path for authorized key file. | success | string | /home/user/.ssh/authorized_keys |
manage_dir | Whether this module managed the directory of the authorized key file. | success | boolean | True |
path | Alternate path to the authorized_keys file | success | string | None |
state | Whether the given key (with the given key_options) should or should not be in the file | success | string | present |
unique | Whether the key is unique | success | boolean | False |
user | The username on the remote host whose authorized_keys file will be modified | success | string | user |
validate_certs | This only applies if using a https url as the source of the keys. If set to no , the SSL certificates will not be validated. | success | boolean | True |
Status
This module is flagged as preview which means that it is not guaranteed to have a backwards compatible interface.
Maintenance Info
For more information about Red Hat’s this support of this module, please refer to this knowledge base article<https://access.redhat.com/articles/rhel-top-support-policies>
For help in developing on modules, should you be so inclined, please read Community Information & Contributing, Testing Ansible and Developing Modules.
© 2012–2018 Michael DeHaan
© 2018–2019 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/2.4/authorized_key_module.html