linuxexpert-practice-labs/labs/ex294/3-2-ssh-keys/README.md

EX294 3.2: SSH keys for managed nodes

Make a key pair for the user who runs Ansible, put its public key on every managed node with a playbook, and trust the nodes' host keys properly instead of turning host key checking off.

Before you start

This VM is the control node. The lab creates the user greg (password Lab-Pass-1), who has no SSH key yet, and installs ansible-core and sshpass. Work as greg, in /home/greg/ansible: its ansible.cfg reads the inventory inventory, logs in as devops, becomes root, and has host_key_checking = false.

The managed nodes node1 (10.99.1.11) and node2 (10.99.1.12) are AlmaLinux 10 containers reached over SSH by name. On each, devops has the password Lab-Pass-1 and passwordless sudo, but no authorized keys; root and ansible have the same password. For a root shell on a node, sudo podman exec -it node1 bash.

Tasks

1. As greg, create an Ed25519 key pair with no passphrase in the default place, ~/.ssh/id_ed25519, mode 600.
2. Write /home/greg/ansible/keys.yml, a playbook that installs greg's public key for devops on every managed node, and run it (with -k the first time). Then ssh devops@node1 true doesn't ask for a password, and a second run of keys.yml reports changed=0.
3. Remove host_key_checking = false from ansible.cfg, delete greg's ~/.ssh/known_hosts (SSH filled it in while checking was off), and put the nodes' host keys there with ssh-keyscan instead, so that ansible all -m ping works with no prompt.

Hints

• ssh-keygen -t ed25519 -N '' -f ~/.ssh/id_ed25519.
• ansible.posix.authorized_key needs ansible-galaxy collection install ansible.posix; ansible.builtin.file and lineinfile do the same job.
• lookup('ansible.builtin.file', '/home/greg/.ssh/id_ed25519.pub') reads the key on the control node.
• ssh-keyscan node1 node2 >> ~/.ssh/known_hosts; the names in known_hosts must be the ones in the inventory.