- Docs »
- authorized_key – Adds or removes an SSH authorized key
-
authorized_key – Adds or removes an SSH authorized key
Parameter |
Choices/Defaults |
Comments |
comment
string
added in 2.4 |
|
Change the comment on the public key.
Rewriting the comment is useful in cases such as fetching it from GitHub or GitLab.
If no comment is specified, the existing comment will be kept.
|
exclusive
boolean
|
|
Whether to remove all other non-specified keys from the authorized_keys file.
Multiple keys can be specified in a single key string value by separating them by newlines.
This option is not loop aware, so if you use with_ , it will be exclusive per iteration of the loop.
If you want multiple keys in the file you need to pass them all to key in a single batch as mentioned above.
|
follow
boolean
added in 2.7 |
|
Follow path symlink instead of replacing it.
|
key
string
/ required
|
|
The SSH public key(s), as a string or (since Ansible 1.9) url (https://github.com/username.keys).
|
key_options
-
|
|
A string of ssh key options to be prepended to the key in the authorized_keys file.
|
manage_dir
boolean
|
|
Whether this module should manage the directory of the authorized key file.
If set to yes , the module will create the directory, as well as set the owner and permissions of an existing directory.
Be sure to set manage_dir=no if you are using an alternate directory for authorized_keys, as set with path , since you could lock yourself out of SSH access.
See the example below.
|
path
path
|
|
Alternate path to the authorized_keys file.
When unset, this value defaults to ~/.ssh/authorized_keys.
|
state
string
|
Choices:
- absent
present ←
|
Whether the given key (with the given key_options) should or should not be in the file.
|
user
string
/ required
|
|
The username on the remote host whose authorized_keys file will be modified.
|
validate_certs
boolean
|
|
This only applies if using a https url as the source of the keys.
If set to no , the SSL certificates will not be validated.
This should only set to no used on personally controlled sites using self-signed certificates as it avoids verifying the source site.
Prior to 2.1 the code worked as if this was set to yes .
|
- name: Set authorized key taken from file
authorized_key:
user: charlie
state: present
key: "{{ lookup('file', '/home/charlie/.ssh/id_rsa.pub') }}"
- name: Set authorized keys taken from url
authorized_key:
user: charlie
state: present
key: https://github.com/charlie.keys
- name: Set authorized key in alternate location
authorized_key:
user: charlie
state: present
key: "{{ lookup('file', '/home/charlie/.ssh/id_rsa.pub') }}"
path: /etc/ssh/authorized_keys/charlie
manage_dir: False
- name: Set up multiple authorized keys
authorized_key:
user: deploy
state: present
key: '{{ item }}'
with_file:
- public_keys/doe-jane
- public_keys/doe-john
- name: Set authorized key defining key options
authorized_key:
user: charlie
state: present
key: "{{ lookup('file', '/home/charlie/.ssh/id_rsa.pub') }}"
key_options: 'no-port-forwarding,from="10.0.1.1"'
- name: Set authorized key without validating the TLS/SSL certificates
authorized_key:
user: charlie
state: present
key: https://github.com/user.keys
validate_certs: False
- name: Set authorized key, removing all the authorized keys already set
authorized_key:
user: root
key: '{{ item }}'
state: present
exclusive: True
with_file:
- public_keys/doe-jane
- name: Set authorized key for user ubuntu copying it from current user
authorized_key:
user: ubuntu
state: present
key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}"
Common return values are documented here, the following are the fields unique to this module:
Key |
Returned |
Description |
exclusive
boolean
|
success |
If the key has been forced to be exclusive or not.
|
key
string
|
success |
The key that the module was running against.
Sample:
https://github.com/user.keys
|
key_option
string
|
success |
Key options related to the key.
|
keyfile
string
|
success |
Path for authorized key file.
Sample:
/home/user/.ssh/authorized_keys
|
manage_dir
boolean
|
success |
Whether this module managed the directory of the authorized key file.
Sample:
True
|
path
string
|
success |
Alternate path to the authorized_keys file
|
state
string
|
success |
Whether the given key (with the given key_options) should or should not be in the file
Sample:
present
|
unique
boolean
|
success |
Whether the key is unique
|
user
string
|
success |
The username on the remote host whose authorized_keys file will be modified
Sample:
user
|
validate_certs
boolean
|
success |
This only applies if using a https url as the source of the keys. If set to no , the SSL certificates will not be validated.
Sample:
True
|
Authors
Hint
If you notice any issues in this documentation, you can edit this document to improve it.