Ansible: check whether a file contains only given lines, no more

Question

By using Ansible, I try to make sure that the .ssh/authorized_keys files of our servers contain only a given set of ssh keys. No matter the arrangement.

If one is missing, add it (no problem, lineinfile)
If someone else sneaked in an extra key (which is not in the "with_items" list), remove it and return some warning, or something. Well... "changed" could be acceptable too, but it would be nice to differentiate somehow the "missing" and "sneaked in" lines.

The first part is easy:

- name: Ensure ssh authorized_keys contains the right users
  lineinfile:
    path: /root/.ssh/authorized_keys
    owner: root
    group: root
    mode: 0600
    state: present
    line: '{{ item }}'

  with_items:
    - ssh-rsa AABBCC112233... root@someserver.com
    - ssh-rsa DDEEFF112233... user@anothersomeserver.com

But the second part looks more tricky. At least to get it done with short and elegant code.

Any ideas?

why not just always over-write the target with the source file? — Neil McGuigan, Nov 02 '17 at 18:49
@NeilMcGuigan: That could work, but then I wouldn't know if some key was missing or if there was some extra one. — Julen Larrucea, Nov 02 '17 at 19:49

Konstantin Suvorov · Accepted Answer · 2017-11-03T04:22:42.820

4

There's authorized_key_module and it has exclusive option.
But pay attention that exclusive doesn't work with with_items.

Use something like this:

- name: Ensure ssh authorized_keys contains the right users
  authorized_key:
    user: root
    state: present
    exclusive: yes
    key: '{{ ssh_keys | join("\n") }}'
  vars:
    ssh_keys:
      - ssh-rsa AABBCC112233... root@someserver.com
      - ssh-rsa DDEEFF112233... user@anothersomeserver.com

Test before use!

If you have keys in files, you can find this answer useful.

edited Nov 03 '17 at 04:22

answered Nov 02 '17 at 17:34

Konstantin Suvorov

65,183
9
162
193

Wow! that is nice! But, how do you define the ssh_keys variable? I tried with a multiline string, and it just splits it into characters with newlines... Would that be equivalent to using a key file with the "with_file" option? – Julen Larrucea Nov 02 '17 at 19:47
Sorry, forgot to define it. Also if you have keys in files, I've added a link to other answer. – Konstantin Suvorov Nov 03 '17 at 04:23
Thank you! that is exactly what I wanted. – Julen Larrucea Nov 03 '17 at 09:09
Works like a charm. Thank you! – Balázs Lengyák Aug 23 '19 at 17:10

Ansible: check whether a file contains only given lines, no more

1 Answers1