Ansible User Module Generate_ssh_key

Posted on 09.12.2020by admin

Ansible User Module Generate_ssh_key Average ratng: 4,9/5 4467 votes

Ansible Module Generate Ssh Key
Ansible User Module Generate_ssh_key 9
Ansible Add Public Ssh Key
Ansible User Module Generate_ssh_key 4
Set Up Ssh Key Ansible
Ansible Create Public Ssh Key
Ansible User Generate_ssh_key

The ansible user will login via ssh-key, and the pass phrase for this user will need to be protected and trusted to a few individuals. Access to systems by the ansible user can be restricted to connections originating from a predetermined IP address (via the authorizedkeys file and/or Match options in sshdconfig ). Oct 12, 2018 In this blog we will Setup SSH Key and initial user using Ansible Playbook. To create new user on ubuntu system, you need the following things: Username/Password. Public Key of the user. You will first create a user on one machine. Machine can be your local workstation also. Generate ssh-key for this.

Adds or removes SSH authorized keys for particular user accounts.

Ansible Module Generate Ssh Key

Parameter	Choices/Defaults	Comments
comment string	Change the comment on the public key. Rewriting the comment is useful in cases such as fetching it from GitHub or GitLab. If no comment is specified, the existing comment will be kept.
exclusive boolean	Choices: yes	Whether to remove all other non-specified keys from the authorized_keys file. Multiple keys can be specified in a single `key` string value by separating them by newlines. This option is not loop aware, so if you use `with_` , it will be exclusive per iteration of the loop. If you want multiple keys in the file you need to pass them all to `key` in a single batch as mentioned above.
follow boolean	Choices: no ← yes
key	The SSH public key(s), as a string or (since Ansible 1.9) url (https://github.com/username.keys).
key_options -	A string of ssh key options to be prepended to the key in the authorized_keys file.
manage_dir boolean	Choices: no	Whether this module should manage the directory of the authorized key file. If set to `yes`, the module will create the directory, as well as set the owner and permissions of an existing directory. Be sure to set `manage_dir=no` if you are using an alternate directory for authorized_keys, as set with `path`, since you could lock yourself out of SSH access.
path	Alternate path to the authorized_keys file. When unset, this value defaults to ~/.ssh/authorized_keys.
state string	Choices: absent	Whether the given key (with the given key_options) should or should not be in the file.
user string / required	The username on the remote host whose authorized_keys file will be modified.
validate_certs boolean	Choices: no	This only applies if using a https url as the source of the keys. If set to `no`, the SSL certificates will not be validated. This should only set to `no` used on personally controlled sites using self-signed certificates as it avoids verifying the source site. Prior to 2.1 the code worked as if this was set to `yes`.

Common return values are documented here, the following are the fields unique to this module:

Key	Returned	Description
exclusive boolean	success	If the key has been forced to be exclusive or not.
key string	success	Sample:
key_option	success	Key options related to the key.
keyfile string	success	Sample:
manage_dir	success	Whether this module managed the directory of the authorized key file. True
path string	success
state	success	Whether the given key (with the given key_options) should or should not be in the file present
unique boolean	success
user	success	The username on the remote host whose authorized_keys file will be modified user
validate_certs boolean	success	This only applies if using a https url as the source of the keys. If set to `no`, the SSL certificates will not be validated. True

This module is not guaranteed to have a backwards compatible interface. [preview]
This module is maintained by the Ansible Core Team. [core]

Red Hat Support¶

More information about Red Hat’s support of this module is available from this Red Hat Knowledge Base article.

Authors¶

Ansible Core Team

Hint

If you notice any issues in this documentation, you can edit this document to improve it.

Manage user accounts and user attributes.
For Windows targets, use the win_user module instead.

Parameter	Choices/Defaults	Comments
append boolean	Choices: yes	If `yes`, add the user to the groups specified in `groups`. If `no`, user will only be added to the groups specified in `groups`, removing them from all other groups.
authorization added in 2.8	Does nothing when used with other platforms. Can set multiple authorizations using comma separation. To delete all authorizations, use `authorization='`.
comment	Optionally sets the description (aka GECOS) of user account.
create_home boolean	Choices: no	Unless set to `no`, a home directory will be made for the user when the account is created or if the home directory does not exist. Changed from `createhome` to `create_home` in Ansible 2.5.
expires	An expiry time for the user in epoch, it will be ignored on platforms that do not support this. Currently supported on GNU/Linux, FreeBSD, and DragonFlyBSD. Since Ansible 2.6 you can remove the expiry time specify a negative value. Currently supported on GNU/Linux and FreeBSD.
force boolean	Choices: yes	This only affects `state=absent`, it forces removal of the user and associated directories on supported platforms. The behavior is the same as `userdel --force`, check the man page for `userdel` on your system for details and support. When used with `generate_ssh_key=yes` this forces an existing key to be overwritten.
generate_ssh_key boolean	Choices: yes	Whether to generate a SSH key for the user in question. This will not overwrite an existing SSH key unless used with `force=yes`.
group string	Optionally sets the user's primary group (takes a group name).
groups list	List of groups user will be added to. When set to an empty string `'`, the user is removed from all groups except the primary group. Before Ansible 2.3, the only input format allowed was a comma separated string.
hidden added in 2.6	Choices: no yes	macOS only, optionally hide the user from the login window and system preferences. The default will be `yes` if the system option is used.
home path
local added in 2.4	Choices: yes	Forces the use of 'local' command alternatives on platforms that implement it. This is useful in environments that use centralized authentification when you want to manipulate the local users (i.e. it uses `luseradd` instead of `useradd`). This will check `/etc/passwd` for an existing account before invoking commands. If the local account database exists somewhere other than `/etc/passwd`, this setting will not work properly. This requires that the above commands as well as `/etc/passwd` must exist on the target host, otherwise it will be a fatal error.
login_class	Optionally sets the user's login class, a feature of most BSD OSs.
move_home boolean	Choices: yes	If set to `yes` when used with `home:` , attempt to move the user's old home directory to the specified directory if it isn't there already and the old home exists.
name string / required	aliases: user
non_unique boolean	Choices: yes	Optionally when used with the -u option, this option allows to change the user ID to a non-unique value.
password string	Optionally set the user's password to this crypted value. On macOS systems, this value has to be cleartext. Beware of security issues. To create a disabled account on Linux systems, set this to `'!'` or `''`. To create a disabled account on OpenBSD, set this to `'************'`. See https://docs.ansible.com/ansible/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module for details on various ways to generate these password values.
password_lock boolean	Choices: no yes	Lock the password (usermod -L, pw lock, usermod -C). BUT implementation differs on different platforms, this option does not always mean the user cannot login via other methods. This option does not disable the user, only lock the password. Do not change the password in the same task. Currently supported on Linux, FreeBSD, DragonFlyBSD, NetBSD, OpenBSD.
profile string	Sets the profile of the user. Can set multiple profiles using comma separation. Currently supported on Illumos/Solaris.
remove boolean	Choices: yes	This only affects `state=absent`, it attempts to remove directories associated with the user. The behavior is the same as `userdel --remove`, check the man page for details and support.
role string	Sets the role of the user. Can set multiple roles using comma separation. Currently supported on Illumos/Solaris.
seuser string	Optionally sets the seuser type (user_u) on selinux enabled systems.
shell string	On macOS, before Ansible 2.5, the default shell for non-system users was `/usr/bin/false`. Since Ansible 2.5, the default shell for non-system users on macOS is `/bin/bash`. On other operating systems, the default shell is determined by the underlying tool being used. See Notes for details.
skeleton string	Requires `create_home` option!
ssh_key_bits integer	Default:	Optionally specify number of bits in SSH key to create.
ssh_key_comment string	Default:	Optionally define the comment for the SSH key.
ssh_key_file path	If this is a relative filename then it will be relative to the user's home directory.
ssh_key_passphrase	Set a passphrase for the SSH key. If no passphrase is provided, the SSH key will default to having no passphrase.
ssh_key_type string	Default:	Optionally specify the type of SSH key to generate. Available SSH key types will depend on implementation present on target host.
state string	Choices: absent	Whether the account should exist or not, taking action if the state is different from what is stated.
system boolean	Choices: yes	When creating an account `state=present`, setting this to `yes` makes the user a system account.
uid	Optionally sets the UID of the user.
update_password string	Choices: on_create	`always` will update passwords if they differ. `on_create` will only set the password for newly created users.