Answers: <p>If your git repos is a private github, you can use <a href="https://developer.github.com/v3/guides/managing-deploy-keys/" rel="nofollow noreferrer">github methods</a> (deploy keys is very powerful).</p>
  <p>If your repos are not hosted on github or they don't provide read-only deploy key feature, The two options you mentioned are both valuable.</p>
  <h2>Single DevOps guy</h2>
  <p>If you are the only person working on the project and Your machine/machines are the only you will run ansible from (no CD tools like jenkins and friends) you're good to go with the agent forwarding option: is likely less possible that you forget your private key unencrypted around.</p>
  <h2>Small Team</h2>
  <p>If you are a team of people working on the same Ansible playbook or multiple people that run the playbook then you have both options:</p>
  <ul>
  <li><p>keep the agent-forwarding option; every teammate run the script from his machine.</p>
  </li>
  <li><p>create a deployer key-pair, upload the pub-key and encrypt the private with vault as suggested by <a href="https://devops.stackexchange.com/users/342/berlin">Berlin</a>. The key is encrypted and the scope of the private key is restricted to only 1 or few repos. The problem with this approach is that you have to rotate the vault password every time a teammate leave the team.</p>
  </li>
  </ul>
  <p>I would never put my personal private key, which has a wide scope, in any possibly unsafe place. Vault encryption is as good as the people that uses it and there's a lot of keys/passwords in cleartext out there :)</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-09-16T09:07:46.610Z
Answers: 2018-01-26T08:40:38.863Z
Answers: 2020-06-18T08:28:10.803Z
Answers: j0lly
Answers: <p>You can also consider to encrypt the file containing your private SSH key using Ansible Vault.</p>
  
  <p>Some links:</p>
  
  <p><a href="http://docs.ansible.com/ansible/latest/playbooks_vault.html" rel="nofollow noreferrer">http://docs.ansible.com/ansible/latest/playbooks_vault.html</a></p>
  
  <p><a href="https://therealmarv.com/ansible-vault-file-handling/" rel="nofollow noreferrer">https://therealmarv.com/ansible-vault-file-handling/</a></p>
  
  <p><a href="https://www.calazan.com/how-to-deploy-encrypted-copies-of-your-ssl-keys-and-other-files-with-ansible-and-openssl/" rel="nofollow noreferrer">https://www.calazan.com/how-to-deploy-encrypted-copies-of-your-ssl-keys-and-other-files-with-ansible-and-openssl/</a></p>
  
Answers: CC BY-SA 3.0
Answers: 2017-09-15T22:38:13.167Z
Answers: 2017-09-15T22:38:13.167Z
Answers: Berlin
Answers: <blockquote>
    <p>Should I be using SSH agent forwarding (this way I can use my local
    SSH keys)</p>
  </blockquote>
  
  <p>Yes, that could be an option</p>
  
  <blockquote>
    <p>should I store private SSH key (encrypted, added to source control)
    within my ansible project and copy it using Ansible to my target node?</p>
  </blockquote>
  
  <p>no</p>
  
  <p><a href="https://serverfault.com/questions/823956/ansible-security-best-practices">https://serverfault.com/questions/823956/ansible-security-best-practices</a></p>
  
  <blockquote>
    <p>For servers, don't allow root access via ssh at all. Many audits scoff
    at this.</p>
    
    <p>For ansible, let every admin use their own personal account on each
    target server, and let them sudo with passwords. This way no password
    is shared between two people. You can check who did what on each
    server. It's up to you if personal accounts allow login on password,
    ssh key only, or require both.</p>
  </blockquote>
  
  <p>In summary, use an ssh key with password. Let every user use their own ssh keys. Never allow sudo access via ssh.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-09-17T16:14:39.917Z
Answers: hmm, I'm not sure if this applies to the context. I asked about SSH keys used to pull (read-only) code from repository when deploying an app. With SSH agent I need each public key (each user) to be added to repository as deployment key.
Answers: pzaj
Answers: CC BY-SA 3.0
Answers: 2017-09-17T14:09:40.133Z
Answers: 2017-09-18T06:20:59.393Z
Answers: 2017-09-18T06:20:59.393Z
Answers: 030
Answers: <p>You can story your private key in one circumstance: if you configure your repository so that it only allows read access for that particular key, and you don't bother about the repository being publicly readable. In this case, you can easily store your private key - obviously make a throwaway key without passphrase. But as I said, only if you are fine with public access to that repository.</p>
  
  <p>If that is not the case, then you are probably stuck with the SSH agent. It is not ideal, as <code>root</code> can take the socket, but if you are in a kind of benevolent environment (i.e., no attackable webserver anywhere near), then it should be OK.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-09-15T22:04:43.027Z
Answers: 2017-09-15T22:04:43.027Z
Answers: AnoE
Body: <p>I recently started playing around with Ansible and it seems very nice. I don't have much experience in DevOps stuff and never really had to handle any complex scenarios. I started creating my Ansible playbook to replace my current deployment tool - Deployer PHP. I'm stuck at cloning git repository unfortunately. Now, I know I need a public key added to enable access to git repository and here comes my question. </p>
  
  <p>Should I be using SSH agent forwarding (this way I can use my local SSH keys) or should I store private SSH key (encrypted, added to source control) within my ansible project and copy it using Ansible to my target node? I know the question may be very broad, so what interests me is security implications of both approaches.</p>
  
Tags: <ansible><git><security>
Title: Ansible - private git repositories - SSH agent forwarding vs copying private SSH key
UserDisplayName: pzaj
ThreadText: # Ansible - private git repositories - SSH agent forwarding vs copying private SSH key
  
  (Asked by: username_0 on 2017-09-15)
  
  I recently started playing around with Ansible and it seems very nice. I don't have much experience in DevOps stuff and never really had to handle any complex scenarios. I started creating my Ansible playbook to replace my current deployment tool - Deployer PHP. I'm stuck at cloning git repository unfortunately. Now, I know I need a public key added to enable access to git repository and here comes my question.
  
  Should I be using SSH agent forwarding (this way I can use my local SSH keys) or should I store private SSH key (encrypted, added to source control) within my ansible project and copy it using Ansible to my target node? I know the question may be very broad, so what interests me is security implications of both approaches.
  
  **Tags:** ansible, git, security
  
  
  ---
  
  ## 4 answers
  
  ### Answer by username_1 on 2017-09-16. Score: 4
  
  If your git repos is a private github, you can use [github methods](https://developer.github.com/v3/guides/managing-deploy-keys/) (deploy keys is very powerful).
  
  If your repos are not hosted on github or they don't provide read-only deploy key feature, The two options you mentioned are both valuable.
  
  ## Single DevOps guy
  
  If you are the only person working on the project and Your machine/machines are the only you will run ansible from (no CD tools like jenkins and friends) you're good to go with the agent forwarding option: is likely less possible that you forget your private key unencrypted around.
  
  ## Small Team
  
  If you are a team of people working on the same Ansible playbook or multiple people that run the playbook then you have both options:
  
  * keep the agent-forwarding option; every teammate run the script from his machine.
  * create a deployer key-pair, upload the pub-key and encrypt the private with vault as suggested by [username_2](https://devops.stackexchange.com/users/342/username_2). The key is encrypted and the scope of the private key is restricted to only 1 or few repos. The problem with this approach is that you have to rotate the vault password every time a teammate leave the team.
  
  I would never put my personal private key, which has a wide scope, in any possibly unsafe place. Vault encryption is as good as the people that uses it and there's a lot of keys/passwords in cleartext out there :)
  
  
  ---
  
  ### Answer by username_2 on 2017-09-15. Score: 4
  
  You can also consider to encrypt the file containing your private SSH key using Ansible Vault.
  
  Some links:
  
  <http://docs.ansible.com/ansible/latest/playbooks_vault.html>
  
  <https://therealmarv.com/ansible-vault-file-handling/>
  
  <https://www.calazan.com/how-to-deploy-encrypted-copies-of-your-ssl-keys-and-other-files-with-ansible-and-openssl/>
  
  
  ---
  
  ### Answer by username_3 on 2017-09-17. Score: 2
  
  > Should I be using SSH agent forwarding (this way I can use my local
  > SSH keys)
  
  Yes, that could be an option
  
  > should I store private SSH key (encrypted, added to source control)
  > within my ansible project and copy it using Ansible to my target node?
  
  no
  
  <https://serverfault.com/questions/823956/ansible-security-best-practices>
  
  > For servers, don't allow root access via ssh at all. Many audits scoff
  > at this.
  >
  > For ansible, let every admin use their own personal account on each
  > target server, and let them sudo with passwords. This way no password
  > is shared between two people. You can check who did what on each
  > server. It's up to you if personal accounts allow login on password,
  > ssh key only, or require both.
  
  In summary, use an ssh key with password. Let every user use their own ssh keys. Never allow sudo access via ssh.
  
  > **Comments:**
  > **username_0**: hmm, I'm not sure if this applies to the context. I asked about SSH keys used to pull (read-only) code from repository when deploying an app. With SSH agent I need each public key (each user) to be added to repository as deployment key.  
  
  ---
  
  ### Answer by username_4 on 2017-09-15. Score: 0
  
  You can story your private key in one circumstance: if you configure your repository so that it only allows read access for that particular key, and you don't bother about the repository being publicly readable. In this case, you can easily store your private key - obviously make a throwaway key without passphrase. But as I said, only if you are fine with public access to that repository.
  
  If that is not the case, then you are probably stuck with the SSH agent. It is not ideal, as `root` can take the socket, but if you are in a kind of benevolent environment (i.e., no attackable webserver anywhere near), then it should be OK.
  
  
  ---
  
  