authorized_key - Adds or removes an SSH authorized key

Synopsis

  • Adds or removes SSH authorized keys for particular user accounts

Parameters

Parameter Choices/Defaults Comments
comment
(added in 2.4)
Change the comment on the public key. Rewriting the comment is useful in cases such as fetching it from GitHub or GitLab.
If no comment is specified, the existing comment will be kept.
exclusive
bool

(added in 1.9)
    Choices:
  • no
  • yes
Whether to remove all other non-specified keys from the authorized_keys file. Multiple keys can be specified in a single key string value by separating them by newlines.
This option is not loop aware, so if you use with_ , it will be exclusive per iteration of the loop, if you want multiple keys in the file you need to pass them all to key in a single batch as mentioned above.
key
required
The SSH public key(s), as a string or (since 1.9) url (https://github.com/username.keys)
key_options
(added in 1.4)
A string of ssh key options to be prepended to the key in the authorized_keys file
manage_dir
bool
    Choices:
  • no
  • yes
Whether this module should manage the directory of the authorized key file. If set, the module will create the directory, as well as set the owner and permissions of an existing directory. Be sure to set manage_dir=no if you are using an alternate directory for authorized_keys, as set with path, since you could lock yourself out of SSH access. See the example below.
path Default:
"(homedir)+/.ssh/authorized_keys"
Alternate path to the authorized_keys file
state
    Choices:
  • present
  • absent
Whether the given key (with the given key_options) should or should not be in the file
user
required
The username on the remote host whose authorized_keys file will be modified
validate_certs
bool

(added in 2.1)
    Choices:
  • no
  • yes
This only applies if using a https url as the source of the keys. If set to no, the SSL certificates will not be validated.
This should only set to no used on personally controlled sites using self-signed certificates as it avoids verifying the source site.
Prior to 2.1 the code worked as if this was set to yes.

Examples

- name: Set authorized key taken from file
  authorized_key:
    user: charlie
    state: present
    key: "{{ lookup('file', '/home/charlie/.ssh/id_rsa.pub') }}"

- name: Set authorized keys taken from url
  authorized_key:
    user: charlie
    state: present
    key: https://github.com/charlie.keys

- name: Set authorized key in alternate location
  authorized_key:
    user: charlie
    state: present
    key: "{{ lookup('file', '/home/charlie/.ssh/id_rsa.pub') }}"
    path: /etc/ssh/authorized_keys/charlie
    manage_dir: False

- name: Set up multiple authorized keys
  authorized_key:
    user: deploy
    state: present
    key: '{{ item }}'
  with_file:
    - public_keys/doe-jane
    - public_keys/doe-john

- name: Set authorized key defining key options
  authorized_key:
    user: charlie
    state: present
    key: "{{ lookup('file', '/home/charlie/.ssh/id_rsa.pub') }}"
    key_options: 'no-port-forwarding,from="10.0.1.1"'

- name: Set authorized key without validating the TLS/SSL certificates
  authorized_key:
    user: charlie
    state: present
    key: https://github.com/user.keys
    validate_certs: False

- name: Set authorized key, removing all the authorized keys already set
  authorized_key:
    user: root
    key: '{{ item }}'
    state: present
    exclusive: True
  with_file:
    - public_keys/doe-jane

- name: Set authorized key for user ubuntu copying it from current user
  authorized_key:
    user: ubuntu
    state: present
    key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key Returned Description
exclusive
boolean
success
If the key has been forced to be exclusive or not.

key
string
success
The key that the module was running against.

Sample:
https://github.com/user.keys
key_option
string
success
Key options related to the key.

keyfile
string
success
Path for authorized key file.

Sample:
/home/user/.ssh/authorized_keys
manage_dir
boolean
success
Whether this module managed the directory of the authorized key file.

Sample:
True
path
string
success
Alternate path to the authorized_keys file

state
string
success
Whether the given key (with the given key_options) should or should not be in the file

Sample:
present
unique
boolean
success
Whether the key is unique

user
string
success
The username on the remote host whose authorized_keys file will be modified

Sample:
user
validate_certs
boolean
success
This only applies if using a https url as the source of the keys. If set to no, the SSL certificates will not be validated.

Sample:
True


Status

This module is flagged as preview which means that it is not guaranteed to have a backwards compatible interface.

Maintenance

This module is flagged as core which means that it is maintained by the Ansible Core Team. See Module Maintenance & Support for more info.

For a list of other modules that are also maintained by the Ansible Core Team, see here.

Support

For more information about Red Hat’s support of this module, please refer to this Knowledge Base article

Author

  • Ansible Core Team

Hint

If you notice any issues in this documentation you can edit this document to improve it.

© 2012–2018 Michael DeHaan
© 2018–2019 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/2.6/modules/authorized_key_module.html