diff --git a/README.md b/README.md index 20e8dbd..4fcca1b 100644 --- a/README.md +++ b/README.md @@ -138,11 +138,11 @@ environment variables can be espcilitly defined, to consume it during execution > [!IMPORTANT] > To allow consuming environment variables must be set `PermitUserEnvironment yes` in `/etc/ssh/sshd_config`. -Private and public keys are configured directly using `filename` and `content`. The role writes each key to -`~/.ssh/`. Store private key content encrypted with Ansible Vault. +Private keys are configured using `filename` and `content`; the role writes them to `~/.ssh/` and extracts +their public keys to `~/.ssh/.pub`. Store private key content encrypted with Ansible Vault. Entries in `authorized_keys` are also added to `~/.ssh/authorized_keys`, including their optional command and environment -settings. Public keys are still automatically extracted from private keys into `~/.ssh/.pub`. +settings. ```yaml unix_users: @@ -157,13 +157,11 @@ unix_users: StrictHostKeyChecking: "no" UserKnownHostFile: /dev/null authorized_keys: - - filename: claire@claire-pc.pub - content: ssh-ed25519 AAAAC3NzaC... claire + - content: ssh-ed25519 AAAAC3NzaC... claire - command: /usr/local/bin/upload-file.sh envs: - key: SSH_KEY_NAME value: bob@bob-pc - filename: bob@bob-pc.pub content: ssh-ed25519 AAAAC3NzaC... bob private_keys: - filename: toor@toor-pc.ed25519.key diff --git a/defaults/main.yml b/defaults/main.yml index 430eeb0..c18b9ca 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -19,8 +19,7 @@ unix_users: StrictHostKeyChecking: "no" UserKnownHostFile: /dev/null authorized_keys: - - filename: alice@alice-pc.pub - content: ssh-ed25519 AAAAC3NzaC... alice + - content: ssh-ed25519 AAAAC3NzaC... alice # command: "" # optional private_keys: - filename: alice@alice-pc.ed25519.key diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml index 489dab3..db645ed 100644 --- a/molecule/default/converge.yml +++ b/molecule/default/converge.yml @@ -28,14 +28,12 @@ - Host: "*" StrictHostKeyChecking: "no" authorized_keys: - - filename: alice.pub - content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/authorized_keys/molecule.pub', rstrip=false) }}" + - content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/authorized_keys/molecule.pub', rstrip=false) }}" command: "/usr/bin/true" envs: - key: EDITOR value: vi - - filename: alice-login.pub - content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/authorized_keys/molecule.pub', rstrip=false) }}" + - content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/authorized_keys/molecule.pub', rstrip=false) }}" private_keys: - filename: alice.ed25519.key content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/private_keys/molecule.ed25519.key', rstrip=false) }}" diff --git a/molecule/default/verify.yml b/molecule/default/verify.yml index b49fd34..173fac2 100644 --- a/molecule/default/verify.yml +++ b/molecule/default/verify.yml @@ -11,8 +11,6 @@ /home/molecule-alice/.ssh/config: "0644" /home/molecule-alice/.ssh/alice.ed25519.key: "0600" /home/molecule-alice/.ssh/alice.ed25519.key.pub: "0644" - /home/molecule-alice/.ssh/alice.pub: "0644" - /home/molecule-alice/.ssh/alice-login.pub: "0644" /home/molecule-alice/.forward: "0644" /home/molecule-alice/.netrc: "0600" /home/molecule-alice/.bashrc.d: "0755" @@ -88,28 +86,6 @@ - (_alice_keys.results[0].content | b64decode).splitlines() | select('match', '^ssh-ed25519 ') | list | length == 1 fail_msg: "the authorized key of molecule-alice does not match the key extracted from its private key" - - name: Read the configured private and public SSH key files - ansible.builtin.slurp: - src: "{{ _alice_home }}/.ssh/{{ item }}" - loop: - - alice.ed25519.key - - alice.pub - - alice-login.pub - no_log: true - register: _alice_key_contents - - - name: Assert that SSH key files contain the exact configured content - vars: - _private_key_content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/private_keys/molecule.ed25519.key', rstrip=false) }}" - _public_key_content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/authorized_keys/molecule.pub', rstrip=false) }}" - ansible.builtin.assert: - that: - - (_alice_key_contents.results[0].content | b64decode) == _private_key_content - - (_alice_key_contents.results[1].content | b64decode) == _public_key_content - - (_alice_key_contents.results[2].content | b64decode) == _public_key_content - - _public_key_content | trim in (_alice_keys.results[0].content | b64decode).splitlines() - no_log: true - - name: Read the user and group database ansible.builtin.getent: database: "{{ item }}" diff --git a/tasks/create_unix_user.yml b/tasks/create_unix_user.yml index 730ebdc..fbab9a4 100644 --- a/tasks/create_unix_user.yml +++ b/tasks/create_unix_user.yml @@ -95,17 +95,6 @@ state: absent when: unix_user.value.ssh.authorized_keys is not defined or unix_user.value.ssh.authorized_keys | length <= 0 -- name: "Create public SSH keys for unix user: {{ unix_user.key }}" - ansible.builtin.copy: - content: "{{ item.content }}" - dest: "{{ _unix_users_home }}/.ssh/{{ item.filename }}" - owner: "{{ unix_user.key }}" - group: "{{ unix_user.value.group | default('users') }}" - mode: "0644" - loop: "{{ unix_user.value.ssh.authorized_keys | default([]) }}" - loop_control: - label: "{{ item.filename }}" - - name: "Create private SSH keys for unix user: {{ unix_user.key }}" ansible.builtin.copy: content: "{{ item.content }}"