fix(tasks): avoid logging of private ssh keys

Replace a private key while retaining its public key file to detect stale derived keys.
Verify the replacement public key, ownership and file permissions.

Co-authored-by: Copilot <copilot@github.com>

.gitea/workflows/ansible-linters.yml

@@ -16,7 +16,7 @@ jobs:
     - name: Run ansible-lint
       uses: ansible/ansible-lint@9bce2bfb8f4a984e6b13767bc0d6bf0a49492164 # v26.10.1
       with:
-        args: "--config-file .ansible-lint"
+        args: "--config-file .ansible-lint.yml"
         # The molecule scenario is linted as well, so its collections are required beside the ones of the role.
         requirements_file: "molecule/default/collections.yml"
         setup_python: "true"

molecule/default/create.yml

@@ -37,10 +37,22 @@
     - "{{ _authorized_key }}"
 
   # The key pair is generated instead of committed, private key material does not belong into a repository.
-  - name: Generate the ssh key pair the role is fed with
+  - name: Generate the SSH key pairs for initial configuration and rotation
     ansible.builtin.command:
-      cmd: "ssh-keygen -t ed25519 -N '' -C molecule -f {{ _private_key }}"
+      argv:
-      creates: "{{ _private_key }}"
+      - ssh-keygen
+      - -t
+      - ed25519
+      - -N
+      - ''
+      - -C
+      - molecule
+      - -f
+      - "{{ item }}"
+      creates: "{{ item }}"
+    loop:
+    - "{{ _private_key }}"
+    - "{{ _private_key }}.replacement"
 
   - name: Offer the public key as authorized key fixture
     ansible.builtin.copy:

molecule/default/verify.yml

@@ -142,3 +142,57 @@
       - _bob_files.results[0].stat.exists
       - not _bob_files.results[1:] | map(attribute='stat.exists') | select | list
       fail_msg: "molecule-bob has files that were never declared for him"
+
+- name: Verify SSH key rotation
+  hosts: all
+  vars:
+    _replacement_key: "{{ molecule_scenario_directory }}/files/ssh/private_keys/molecule.ed25519.key.replacement"
+    unix_groups: {}
+    unix_users:
+      molecule-alice:
+        group: molecule-alice
+        password: alice
+        ssh:
+          private_keys:
+          - filename: alice.ed25519.key
+            content: "{{ lookup('ansible.builtin.file', _replacement_key, rstrip=false) }}"
+        state: present
+  tasks:
+  - name: Replace the private key while keeping the existing public key file
+    ansible.builtin.include_role:
+      name: unix-users
+
+  - name: Read the public key after rotation
+    ansible.builtin.slurp:
+      src: /home/molecule-alice/.ssh/alice.ed25519.key.pub
+    register: _rotated_public_key
+
+  - name: Assert the existing public key matches the replacement key and differs from the original
+    vars:
+      _expected_public_key: "{{ lookup('ansible.builtin.file', _replacement_key + '.pub') }}"
+    ansible.builtin.assert:
+      that:
+      - (_rotated_public_key.content | b64decode).split()[1] == _expected_public_key.split()[1]
+      - _rotated_public_key.content != _alice_keys.results[1].content
+
+  - name: Stat the rotated private and public keys
+    ansible.builtin.stat:
+      path: "{{ item.path }}"
+    loop:
+    - path: /home/molecule-alice/.ssh/alice.ed25519.key
+      mode: '0600'
+    - path: /home/molecule-alice/.ssh/alice.ed25519.key.pub
+      mode: '0644'
+    loop_control:
+      label: "{{ item.path }}"
+    register: _rotated_key_files
+
+  - name: Assert rotated keys retain their owner and permissions
+    ansible.builtin.assert:
+      that:
+      - item.stat.pw_name == 'molecule-alice'
+      - item.stat.gr_name == 'molecule-alice'
+      - item.stat.mode == item.item.mode
+    loop: "{{ _rotated_key_files.results }}"
+    loop_control:
+      label: "{{ item.item.path }}"

tasks/create_unix_user.yml

@@ -108,25 +108,26 @@
   when: unix_user.value.ssh.private_keys is defined and unix_user.value.ssh.private_keys | length > 0
 
 - name: "Extract public SSH keys from private keys for unix user: {{ unix_user.key }}"
-  ansible.builtin.shell:
+  ansible.builtin.command:
-    cmd: "ssh-keygen -y -f {{ (_unix_users_home + '/.ssh/' + item.filename) | quote }} > {{ (_unix_users_home + '/.ssh/' + item.filename + '.pub') | quote }}"
+    argv: [ "ssh-keygen", "-y", "-f", "{{ _unix_users_home }}/.ssh/{{ item.filename }}" ]
-    creates: "{{ _unix_users_home }}/.ssh/{{ item.filename }}.pub"
+  changed_when: false
+  register: _unix_users_ssh_pub_key_extraction
   loop_control:
     label: "{{ item.filename }}"
   with_items:
   - "{{ unix_user.value.ssh.private_keys }}"
   when: unix_user.value.ssh.private_keys is defined and unix_user.value.ssh.private_keys | length > 0
 
-- name: "Correct permissions of public SSH keys for unix user: {{ unix_user.key }}"
+- name: "Write derived public SSH keys for unix user: {{ unix_user.key }}"
-  ansible.builtin.file:
+  ansible.builtin.copy:
-    path: "{{ _unix_users_home }}/.ssh/{{ item.filename }}.pub"
+    content: "{{ item.stdout }}\n"
+    dest: "{{ _unix_users_home }}/.ssh/{{ item.item.filename }}.pub"
     owner: "{{ unix_user.key }}"
     group: "{{ unix_user.value.group | default('users') }}"
     mode: "0644"
   loop_control:
-    label: "{{ item.filename }}"
+    label: "{{ item.item.filename }}"
-  with_items:
+  loop: "{{ _unix_users_ssh_pub_key_extraction.results }}"
-  - "{{ unix_user.value.ssh.private_keys }}"
   when: unix_user.value.ssh.private_keys is defined and unix_user.value.ssh.private_keys | length > 0
 
 - name: "Create custom SSH client config for unix user: {{ unix_user.key }}"

tasks/main.yml

@@ -2,6 +2,7 @@
 
 - name: Remove unix user
   ansible.builtin.include_tasks: remove_unix_user.yml
+  no_log: true
   with_dict: "{{ unix_users }}"
   loop_control:
     loop_var: unix_user
@@ -22,6 +23,7 @@
 
 - name: Create unix groups
   ansible.builtin.include_tasks: create_unix_group.yml
+  no_log: true
   with_dict: "{{ unix_groups }}"
   loop_control:
     loop_var: unix_group