Answers: <p>One approach would be to use multiple authorized keys files, authorized_keys2 <a href="https://serverfault.com/questions/116177/whats-the-difference-between-authorized-keys-and-authorized-keys2">is deprecated</a> but there's no reason you can't use it and you can specify multiple authorized keys files in sshd config</p>
  <blockquote>
  <pre><code>AuthorizedKeysFile
  
       Specifies the file that contains the public keys used for
       user authentication.  The format is described in the
       AUTHORIZED_KEYS FILE FORMAT section of sshd(8).  Arguments
       to AuthorizedKeysFile accept the tokens described in the
       TOKENS section.  After expansion, AuthorizedKeysFile is
       taken to be an absolute path or one relative to the user's
       home directory.  Multiple files may be listed, separated by
       whitespace.  Alternately this option may be set to none to
       skip checking for user keys in files.  The default is
       &quot;.ssh/authorized_keys .ssh/authorized_keys2&quot;.
  </code></pre>
  </blockquote>
  <p>this might not be the optimal solution to your problem, but I think you're going to have to hack on ansible yourself to get it to do what you want.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-12-01T15:37:27.617Z
Answers: 2022-12-01T15:37:27.617Z
Answers: Peter Turner
Answers: <p>The <code>#ansible</code> IRC channel noted that key options can be included in the multiline <code>key</code> field. When doing so, <code>key_options</code> can be left unset and things work.</p>
  <p>Having to construct this multiline <code>key</code> field including options is pretty close to generating content for <code>ansible.builtin.file</code>. A minor benefit of doing this is that <code>ansible.builtin.authorized_key</code> actually parses the content and errors out when it does not parse before deploying it.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-12-02T07:31:16.457Z
Answers: 2022-12-02T07:31:16.457Z
Answers: Helmut Grohne
Body: <p>Ansible provides a <a href="https://docs.ansible.com/ansible/latest/collections/ansible/posix/authorized_key_module.html" rel="nofollow noreferrer">ansible.builtin.authorized_key</a> module which provides a lot of functionality:</p>
  <ul>
  <li>You can set <code>exclusive: true</code> to delete all other keys.</li>
  <li>You can set <code>key_options: ...</code>.</li>
  <li>You can list multiple keys in <code>key</code> by separating them with new lines.</li>
  </ul>
  <p>Is there a way to combine all of the above?</p>
  <p>The naive approach results in the <code>key_options</code> to be applied to all keys rather than having key options per key.</p>
  <p>Is this a case of generating <code>authorized_keys</code> using <code>ansible.builtin.file</code> given the exclusiveness?</p>
  
Tags: <ansible><ssh><key-management>
Title: Is there a way to exclusively manage multiple ssh keys with differing per-key options using ansible?
UserDisplayName: Helmut Grohne
ThreadText: # Is there a way to exclusively manage multiple ssh keys with differing per-key options using ansible?
  
  (Asked by: username_0 on 2022-11-25)
  
  Ansible provides a [ansible.builtin.authorized\_key](https://docs.ansible.com/ansible/latest/collections/ansible/posix/authorized_key_module.html) module which provides a lot of functionality:
  
  * You can set `exclusive: true` to delete all other keys.
  * You can set `key_options: ...`.
  * You can list multiple keys in `key` by separating them with new lines.
  
  Is there a way to combine all of the above?
  
  The naive approach results in the `key_options` to be applied to all keys rather than having key options per key.
  
  Is this a case of generating `authorized_keys` using `ansible.builtin.file` given the exclusiveness?
  
  **Tags:** ansible, ssh, key-management
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2022-12-01. Score: 1
  
  One approach would be to use multiple authorized keys files, authorized\_keys2 [is deprecated](https://serverfault.com/questions/116177/whats-the-difference-between-authorized-keys-and-authorized-keys2) but there's no reason you can't use it and you can specify multiple authorized keys files in sshd config
  
  > ```
  > AuthorizedKeysFile
  >
  >      Specifies the file that contains the public keys used for
  >      user authentication.  The format is described in the
  >      AUTHORIZED_KEYS FILE FORMAT section of sshd(8).  Arguments
  >      to AuthorizedKeysFile accept the tokens described in the
  >      TOKENS section.  After expansion, AuthorizedKeysFile is
  >      taken to be an absolute path or one relative to the user's
  >      home directory.  Multiple files may be listed, separated by
  >      whitespace.  Alternately this option may be set to none to
  >      skip checking for user keys in files.  The default is
  >      ".ssh/authorized_keys .ssh/authorized_keys2".
  >
  > ```
  
  this might not be the optimal solution to your problem, but I think you're going to have to hack on ansible yourself to get it to do what you want.
  
  
  ---
  
  ### Answer by username_0 on 2022-12-02. Score: 1
  
  The `#ansible` IRC channel noted that key options can be included in the multiline `key` field. When doing so, `key_options` can be left unset and things work.
  
  Having to construct this multiline `key` field including options is pretty close to generating content for `ansible.builtin.file`. A minor benefit of doing this is that `ansible.builtin.authorized_key` actually parses the content and errors out when it does not parse before deploying it.
  
  
  ---
  
  