Manage ansible authentication settings

Ansible works best if

  • you use ssh keys, not passwords

  • the user you use to ssh is either root or can become root (can run sudo su -) without entering a password

However, other options are possible, see below:

How to use password authentication when you ssh to a machine with ansible

If, instead of using ssh keys to ssh to a remote machine, you want to use passwords:

sudo apt install sshpass

  • in hosts.ini, uncomment the ‘ansible_user = …’ line, and change ‘…’ to the user you want to login as.

  • in hosts.ini, uncomment the ‘ansible_ssh_pass = …’ line, and change ‘…’ to the password for the user you are logging in as.

  • in hosts.ini, uncomment the ‘ansible_become_pass = …’ line, and change the … to the password you’d enter to sudo.

Configuring SSH keys

(from https://linoxide.com/how-tos/ssh-login-with-public-key/) If you want a bit higher security, you can copy SSH keys between the machine you are administrating with, and the machines you are managing with ansible.

  • Create an SSH key.

ssh-keygen -t rsa

  • Install your SSH key on each of the machines you are managing with ansible, so that you can SSH into them without a password:

ssh-copy-id -i ~/.ssh/id_rsa.pub $USERNAME@$IP

Replace $USERNAME with the username of the account you set up when you installed the machine.

Sudo without password

Ansible can be configured to use a password for switching from the unpriviledged $USERNAME to the root user. This involves having the password lying about, so has security problems. If you want ansible to not be prompted for any administrative command (a different security problem!):

  • As root on each of the nodes, add the following line at the end of the /etc/sudoers file:

<ANSIBLE_LOGIN_USERNAME>     ALL=(ALL) NOPASSWD:ALL

Replace <ANSIBLE_LOGIN_USERNAME> with the username of the account you set up when you installed the machine.