Skip to content

Ansible module to add or to remove SSH authorized keys for particular user accounts on Windows-based systems.

License

Notifications You must be signed in to change notification settings

informatique-cdc/ansible-role-win_authorized_key

Repository files navigation

win_authorized_key - Adds or removes an SSH authorized key

Synopsis

  • Ansible module to add or to remove SSH authorized keys for particular user accounts on Windows-based systems.

Requirements

The below requirements are needed on the host that executes this module.

  • Win32 OpenSSH

Parameters

Parameter Choices/Defaults Comments
user
string / required
The username on the remote host whose authorized_keys file will be modified
key
string / required
The SSH public key(s), as a string or (since 1.9) url https://github.com/username.keys
path
string
Default:
(homedir)+/.ssh/authorized_keys
Alternate path to the authorized_keys file
manage_dir
boolean
Choices:
  • no
  • yes ←
Whether this module should manage the directory of the authorized key file.
If set, the module will create the directory, as well as set the owner and permissions of an existing directory.
Be sure to set manage_dir=no if you are using an alternate directory for authorized_keys, as set with path, since you could lock yourself out of SSH access. See the example below.
state
string
Choices:
  • present ←
  • absent
Whether the given key (with the given key_options) should or should not be in the file
key_options
string
A string of ssh key options to be prepended to the key in the authorized_keys file
exclusive
boolean
Choices:
  • no ←
  • yes
Whether to remove all other non-specified keys from the authorized_keys file. Multiple keys can be specified in a single key string value by separating them by newlines.
This option is not loop aware, so if you use with_ , it will be exclusive per iteration of the loop, if you want multiple keys in the file you need to pass them all to key in a single batch as mentioned above.
validate_certs
boolean
Choices:
  • no
  • yes ←
This only applies if using a https url as the source of the keys.
If set to no, the SSL certificates will not be validated.
This should only set to no used on personally controlled sites using self-signed certificates as it avoids verifying the source site.
comment
string
Change the comment on the public key. Rewriting the comment is useful in cases such as fetching it from GitHub or GitLab.
If no comment is specified, the existing comment will be kept.
follow
boolean
Choices:
  • no ←
  • yes
Follow path symlink instead of replacing it

Examples

---
roles:
  - win_authorized_key

tasks:

  - name: Set authorized key taken from file
    win_authorized_key:
      user: charlie
      state: present
      key: "{{ lookup('file', 'c:/users/charlie/.ssh/id_rsa.pub') }}"

  - name: Set authorized keys taken from url
    win_authorized_key:
      user: charlie
      state: present
      key: https://github.com/charlie.keys

  - name: Set authorized key in alternate location
    win_authorized_key:
      user: charlie
      state: present
      key: "{{ lookup('file', 'c:/users/charlie/.ssh/id_rsa.pub') }}"
      path: c:/ProgramData/ssh/administrators_authorized_key
      manage_dir: False

  - name: Set up multiple authorized keys
    win_authorized_key:
      user: deploy
      state: present
      key: '{{ item }}'
    with_file:
      - public_keys/doe-jane
      - public_keys/doe-john

  - name: Set authorized key defining key options
    win_authorized_key:
      user: charlie
      state: present
      key: "{{ lookup('file', 'c:/users/charlie/.ssh/id_rsa.pub') }}"
      key_options: 'no-port-forwarding,from="10.0.1.1"'

  - name: Set authorized key without validating the TLS/SSL certificates
    win_authorized_key:
      user: charlie
      state: present
      key: https://github.com/user.keys
      validate_certs: False

  - name: Set authorized key, removing all the authorized keys already set
    win_authorized_key:
      user: administrator
      key: '{{ item }}'
      state: present
      exclusive: True
    with_file:
      - public_keys/doe-jane

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key Returned Description
exclusive
boolean
success If the key has been forced to be exclusive or not.

Sample:
False
key
string
success The key that the module was running against.

Sample:
https://github.com/user.keys
key_option
string
success Key options related to the key.
keyfile
string
success Path for authorized key file.

Sample:
C:/users/charlie/.ssh/authorized_keys
manage_dir
boolean
success Whether this module managed the directory of the authorized key file.

Sample:
True
path
string
success Alternate path to the authorized_keys file.
state
string
success Whether the given key (with the given key_options) should or should not be in the file.

Sample:
present
unique
boolean
success Whether the key is unique.

Sample:
False
user
string
success The username on the remote host whose authorized_keys file will be modified.

Sample:
user
validate_certs
boolean
success This only applies if using a https url as the source of the keys. If set to no, the SSL certificates will not be validated.

Sample:
True

Authors

  • Stéphane Bilqué (@sbilque) - Translation in PowerShell
  • Brad Olson ([email protected]) - Initial work in Python

License

This project is licensed under the GNU General Public License v3.0.

See LICENSE to see the full text.

About

Ansible module to add or to remove SSH authorized keys for particular user accounts on Windows-based systems.

Topics

Resources

License

Code of conduct

Stars

Watchers

Forks

Packages

No packages published