How to set up Ansible SSH keys #1033

dLobatog · 2018-03-01T11:44:02Z

No description provided.

ares · 2018-03-02T10:31:07Z

plugins/foreman_ansible/1.x/index.md

+
+You may need do the same for the `foreman` user, so that it can run Ansible directly from the Foreman host without a Foreman Proxy.
+
+If you have Foreman Remote Execution already, it is likely you have a ssh key in `/usr/share/foreman-proxy/.ssh/id_rsa_foreman_proxy`. You may copy it to `/usr/share/foreman-proxy/.ssh/id_rsa` so that Ansible is able to use it (ensure that the file is readable by the `foreman-proxy` user)


does ansible require it to be named id_rsa? can't it also use id_rsa_foreman_proxy? and it might be useful to mentione that for ansible, the key can't be protected with passphrase.

I tried using ansible_private_key_file=/usr/share/foreman-proxy/.ssh/id_rsa_foreman_proxy on /usr/share/foreman-proxy/.ansible.cfg, to no avail, if you know how to make that work that'd be a good thing to put in https://github.com/theforeman/puppet-foreman_proxy/blob/master/templates/plugin/ansible.cfg.erb

I thought ansible would use any ssh key available to the user, like ssh does but I could be wrong, the option accroding to man should be key_file or private_keyso I'd tryansible_private_key=...`

and looking at forklift's ansible.cfg, I see private_key_file = $HOME/.vagrant.d/insecure_private_key so I guess it should be possible

🤦‍♂️ I just saw we're sending a ansible_private_key_file = nil on the inventory when the setting is empty. Therefore it just points to ~.ssh/id_rsa by default. When I change ansible_private_key_file at the setting or at the host level, it's fine.

I should be documenting this here - for some reason the setting does not show up in Settings > Ansible, local blip or are you unable to see the setting too @ares ?

I don't see it either even though I see the definition in ./app/models/setting/ansible.rb

theforeman/foreman_ansible#142

ekohl · 2018-03-02T11:17:57Z

plugins/foreman_ansible/1.x/index.md

@@ -87,8 +89,22 @@ The project is not packaged, but you can find the sources here at [theforeman/fo

 In Foreman, you should add whatever Ansible hosts you want to submit facts from to the setting `trusted_puppetmaster_hosts`. Change it at Administer > Settings, Auth tab.

+Ansible will run using the SSH key of the smart-proxy or Foreman. These keys are automatically set by Foreman Remote Execution, so you may see them at /usr/share/foreman-proxy/.ssh . The foreman-proxy user needs write access to '/usr/share/foreman-proxy/.ansible' at least to create the '.ansible' local directory. We are working on making the instller automatically do this, but if it didn't do it.


Can we move that to /etc/foreman-proxy/ssh and only install a symlink in /usr/share/foreman-proxy?

We can do that, but for 1.16 users this is not an option

I don't like putting promises of a change in documentation. Either refer to a redmine issue or leave it out IMHO.

dLobatog

@ares @ekohl Anything blocking this? I've updated the section to include a line about ansible_private_key_file

ares

leaving for @ekohl to ack, if he does not add comment I'll merge after a while

ekohl · 2018-03-06T15:21:01Z

plugins/foreman_ansible/1.x/index.md

 * FOREMAN_SSL_CERT: The public key when using SSL client certificates (default "/etc/foreman/client_cert.pem")
 * FOREMAN_SSL_KEY: The private key when using SSL client certificates (default  "/etc/foreman/client_key.pem")
 * FOREMAN_SSL_VERIFY: wether to verify SSL certificates. Use *False*
  to disable certificate checks. You can also set it to CA bundle (default is "True").

+If you are using the Katello plugin, the SSL certificate and key are set at `/etc/httpd/conf.d/05-katello-ssl.conf`. SSLCertificateFile, SSLCertificateKeyFile contain the values for FOREMAN_SSL_CERT and FOREMAN_SSL_KEY. By default these are at `/etc/pki/katello/certs/katello-default-ca.crt` and `/etc/pki/katello/private/katello-default-ca.key`.


Are you sure this is true? On my katello nightly box /etc/httpd/conf.d/05-katello-ssl.conf doesn't exist. AFAIK katello uses the same apache file, but different values.

ekohl · 2018-03-06T15:21:47Z

plugins/foreman_ansible/1.x/index.md

@@ -87,8 +89,22 @@ The project is not packaged, but you can find the sources here at [theforeman/fo

 In Foreman, you should add whatever Ansible hosts you want to submit facts from to the setting `trusted_puppetmaster_hosts`. Change it at Administer > Settings, Auth tab.

+Ansible will run using the SSH key of the smart-proxy or Foreman. These keys are automatically set by Foreman Remote Execution, so you may see them at /usr/share/foreman-proxy/.ssh . The foreman-proxy user needs write access to '/usr/share/foreman-proxy/.ansible' at least to create the '.ansible' local directory. We are working on making the instller automatically do this, but if it didn't do it.


I don't like putting promises of a change in documentation. Either refer to a redmine issue or leave it out IMHO.

ekohl · 2018-03-06T15:22:52Z

plugins/foreman_ansible/1.x/index.md

+```
+sudo mkdir /usr/share/foreman-proxy/.ansible
+sudo chown foreman-proxy.foreman-proxy /usr/share/foreman-proxy/.ansible
+sudo chown foreman-proxy.foreman-proxy /usr/share/foreman-proxy


Is this line actually needed? From a security perspective it undesirable and a yum upgrade might just reset it for you (since it's not a config file).

ekohl · 2018-03-06T15:30:20Z

plugins/foreman_ansible/1.x/index.md

 If the Foreman setting `create_new_host_when_facts_are_uploaded` (Puppet tab) is true, and $HOSTNAME doesn't exist in Foreman, it will autocreate that host in Foreman. If it already exists, it will update the facts.

+If you want to use Ansible and submit facts/reports to Foreman, through the callback, you should add whatever hosts (again, except Smart Proxies) you want to submit facts **from** to the setting `trusted_puppetmaster_hosts`. Change it at Administer > Settings, Auth tab. e.g: If you're running Ansible from host 'A', which SSHs into host 'B', you need to add host 'A'


s/whatever/the/

ekohl · 2018-03-06T15:34:55Z

plugins/foreman_ansible/1.x/index.md

+sudo chown foreman-proxy.foreman-proxy /usr/share/foreman-proxy
+```
+
+You may need do the same for the `foreman` user, so that it can run Ansible directly from the Foreman host without a Foreman Proxy.


Personally I dislike this general design pattern that we can run it both with and without a proxy. It complicates the stack and IMHO we should avoid ever implementing it in the first place.

dLobatog

@ekohl Updated according to your comments, let me know what you think

dLobatog · 2018-03-07T08:28:24Z

plugins/foreman_ansible/1.x/index.md

 * FOREMAN_SSL_CERT: The public key when using SSL client certificates (default "/etc/foreman/client_cert.pem")
 * FOREMAN_SSL_KEY: The private key when using SSL client certificates (default  "/etc/foreman/client_key.pem")
 * FOREMAN_SSL_VERIFY: wether to verify SSL certificates. Use *False*
  to disable certificate checks. You can also set it to CA bundle (default is "True").

+If you're using Foreman without Katello, the SSL certificate and key are set at `/etc/httpd/conf.d/foreman.conf`. SSLCertificateFile, SSLCertificateKeyFile contain the values for FOREMAN_SSL_CERT and FOREMAN_SSL_KEY.
+
+If you are using the Katello plugin, the SSL certificate and key are set at `/etc/httpd/conf.d/05-foreman-ssl.conf`. SSLCertificateFile, SSLCertificateKeyFile contain the values for FOREMAN_SSL_CERT and FOREMAN_SSL_KEY. By default these are at `/etc/pki/katello/certs/katello-apache.crt` and `/etc/pki/katello/private/katello-apache.key`.


I checked on 1.16 and the keys are at /etc/httpd/conf.d/foreman.conf and /etc/httpd/conf.d/05-foreman.conf respectively, let me know if you think that is wrong and should instead point to some other file

It should always be 05-foreman-ssl.conf. Both with and without katello since puppet-foreman sets that up. In the katello scenario we just change the default answers from puppet locations to katello locations.

That said, I think in the katello scenario the correct certificate is the one we install for puppet server to talk back to foreman. It's guaranteed to be signed by the correct CA (remember there can be custom certificates signed by a diffferent CA). It's also the same function: report callbacks. See https://github.com/theforeman/puppet-certs#certificates-overview

Maybe @stbenjam has some good insight here, but I think it would make sense to implement this in the installer.

dLobatog · 2018-03-07T08:28:36Z

plugins/foreman_ansible/1.x/index.md

+
+```
+sudo mkdir /usr/share/foreman-proxy/.ansible
+sudo chown foreman-proxy.foreman-proxy /usr/share/foreman-proxy/.ansible


Removed /usr/share/foreman-proxy from here

dLobatog · 2018-03-07T08:28:50Z

plugins/foreman_ansible/1.x/index.md

+
+You may need do the same for the `foreman` user, so that it can run Ansible directly from the Foreman host without a Foreman Proxy.
+
+The SSH key used for the execution can be set by the `ansible_private_key_file` setting (find it under Administer > Settings > Ansible tab). If you leave that field empty, `/usr/share/foreman/.ssh/id_rsa` or `/usr/share/foreman-proxy/.ssh/id_rsa` will be used by default.


Removed the promise to fix this in the installer

dLobatog · 2018-03-07T08:29:10Z

plugins/foreman_ansible/1.x/index.md

+
+The SSH key used for the execution can be set by the `ansible_private_key_file` setting (find it under Administer > Settings > Ansible tab). If you leave that field empty, `/usr/share/foreman/.ssh/id_rsa` or `/usr/share/foreman-proxy/.ssh/id_rsa` will be used by default.
+
+If you have Foreman Remote Execution already, it is likely you have a ssh key in `/usr/share/foreman-proxy/.ssh/id_rsa_foreman_proxy`. You may copy it to `/usr/share/foreman-proxy/.ssh/id_rsa` so that Ansible is able to use it (ensure that the file is readable by the `foreman-proxy` user), or change the Setting `ansible_private_key_file` to point to it.


I added the last bit about using the setting

dLobatog

@ares @ekohl anything missing here?

ares · 2018-03-12T07:56:13Z

quick read -> good from my side, waiting on @ekohl to confirm

dLobatog · 2018-03-12T10:35:59Z

theforeman/puppet-foreman_proxy#415

bastilian · 2018-03-12T11:19:00Z

plugins/foreman_ansible/2.x/index.md

+
+The SSH key used for the execution can be set by the `ansible_private_key_file` setting (find it under Administer > Settings > Ansible tab). If you leave that field empty, `/usr/share/foreman/.ssh/id_rsa` or `/usr/share/foreman-proxy/.ssh/id_rsa` will be used by default.
+
+If you have Foreman Remote Execution already, it is likely you have a ssh key in `/usr/share/foreman-proxy/.ssh/id_rsa_foreman_proxy`. You may copy it to `/usr/share/foreman-proxy/.ssh/id_rsa` so that Ansible is able to use it (ensure that the file is readable by the `foreman-proxy` user), or change the Setting `ansible_private_key_file` to point to it.


A link to the Remote Execution Manual here or above would make sense.

ekohl · 2018-03-12T11:22:01Z

@dLobatog Right now I don't know where I could set these variables so I can just run ansible without having to think about setting those variables. Is there a way to configure this?

dLobatog

@ekohl Which variables, FOREMAN_HOST & friends (used by the Ansible callback)? You may use /etc/environment if you just want to call ansible from your CLI (explained in line 36 of the new docs / 32 in the old docs)

ekohl · 2018-04-11T14:20:44Z

With the packaging change in nightly and theforeman/puppet-foreman_proxy#424 I think we should have a decent out of the box experience. The known hosts is still a problem and even though we have host_key_checking = False in the default config, it appears to be ignored.

ekohl

Could you revisit this? I think we should be promoting ansible.cfg over environment variables. In nightly we should now set this up automatically though a warning that 2.5 is broken would be good.

GregSutcliffe · 2018-05-23T10:24:09Z

Bump, are we still needing this? Seems like yes ;)

ekohl · 2018-06-02T19:58:30Z

I think it was replaced by #1093

dLobatog

Yup, not needed anymore I would say.

ares reviewed Mar 2, 2018

View reviewed changes

ekohl reviewed Mar 2, 2018

View reviewed changes

dLobatog force-pushed the ansible-docs branch from 2e92f1f to 28bd7aa Compare March 6, 2018 13:09

dLobatog commented Mar 6, 2018

View reviewed changes

ares approved these changes Mar 6, 2018

View reviewed changes

ekohl requested changes Mar 6, 2018

View reviewed changes

dLobatog force-pushed the ansible-docs branch 3 times, most recently from da441bb to 8b811c8 Compare March 7, 2018 08:27

dLobatog commented Mar 7, 2018

View reviewed changes

dLobatog commented Mar 9, 2018

View reviewed changes

bastilian reviewed Mar 12, 2018

View reviewed changes

How to set up Ansible SSH keys

7394701

dLobatog force-pushed the ansible-docs branch from 8b811c8 to 7394701 Compare March 21, 2018 20:30

dLobatog commented Mar 21, 2018

View reviewed changes

ekohl requested changes Apr 12, 2018

View reviewed changes

dLobatog commented Jun 7, 2018

View reviewed changes

dLobatog closed this Jun 7, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

How to set up Ansible SSH keys #1033

How to set up Ansible SSH keys #1033

dLobatog commented Mar 1, 2018

ares Mar 2, 2018

dLobatog Mar 2, 2018

ares Mar 2, 2018

ares Mar 2, 2018

dLobatog Mar 2, 2018

ares Mar 2, 2018

dLobatog Mar 6, 2018

ekohl Mar 2, 2018

dLobatog Mar 2, 2018

ekohl Mar 6, 2018

dLobatog left a comment

ares left a comment

ekohl Mar 6, 2018

ekohl Mar 6, 2018

ekohl Mar 6, 2018

ekohl Mar 6, 2018

ekohl Mar 6, 2018

dLobatog left a comment

dLobatog Mar 7, 2018

ekohl Mar 12, 2018

dLobatog Mar 7, 2018

dLobatog Mar 7, 2018

dLobatog Mar 7, 2018

dLobatog left a comment

ares commented Mar 12, 2018

dLobatog commented Mar 12, 2018

bastilian Mar 12, 2018

ekohl commented Mar 12, 2018

dLobatog left a comment

ekohl commented Apr 11, 2018

ekohl left a comment

GregSutcliffe commented May 23, 2018

ekohl commented Jun 2, 2018

dLobatog left a comment


		You may need do the same for the `foreman` user, so that it can run Ansible directly from the Foreman host without a Foreman Proxy.

		If you have Foreman Remote Execution already, it is likely you have a ssh key in `/usr/share/foreman-proxy/.ssh/id_rsa_foreman_proxy`. You may copy it to `/usr/share/foreman-proxy/.ssh/id_rsa` so that Ansible is able to use it (ensure that the file is readable by the `foreman-proxy` user)

		@@ -87,8 +89,22 @@ The project is not packaged, but you can find the sources here at [theforeman/fo

		In Foreman, you should add whatever Ansible hosts you want to submit facts from to the setting `trusted_puppetmaster_hosts`. Change it at Administer > Settings, Auth tab.

		Ansible will run using the SSH key of the smart-proxy or Foreman. These keys are automatically set by Foreman Remote Execution, so you may see them at /usr/share/foreman-proxy/.ssh . The foreman-proxy user needs write access to '/usr/share/foreman-proxy/.ansible' at least to create the '.ansible' local directory. We are working on making the instller automatically do this, but if it didn't do it.

		If the Foreman setting `create_new_host_when_facts_are_uploaded` (Puppet tab) is true, and $HOSTNAME doesn't exist in Foreman, it will autocreate that host in Foreman. If it already exists, it will update the facts.

		If you want to use Ansible and submit facts/reports to Foreman, through the callback, you should add whatever hosts (again, except Smart Proxies) you want to submit facts from to the setting `trusted_puppetmaster_hosts`. Change it at Administer > Settings, Auth tab. e.g: If you're running Ansible from host 'A', which SSHs into host 'B', you need to add host 'A'


		You may need do the same for the `foreman` user, so that it can run Ansible directly from the Foreman host without a Foreman Proxy.

		The SSH key used for the execution can be set by the `ansible_private_key_file` setting (find it under Administer > Settings > Ansible tab). If you leave that field empty, `/usr/share/foreman/.ssh/id_rsa` or `/usr/share/foreman-proxy/.ssh/id_rsa` will be used by default.

How to set up Ansible SSH keys #1033

How to set up Ansible SSH keys #1033

Conversation

dLobatog commented Mar 1, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dLobatog left a comment

Choose a reason for hiding this comment

ares left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dLobatog left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dLobatog left a comment

Choose a reason for hiding this comment

ares commented Mar 12, 2018

dLobatog commented Mar 12, 2018

Choose a reason for hiding this comment

ekohl commented Mar 12, 2018

dLobatog left a comment

Choose a reason for hiding this comment

ekohl commented Apr 11, 2018

ekohl left a comment

Choose a reason for hiding this comment

GregSutcliffe commented May 23, 2018

ekohl commented Jun 2, 2018

dLobatog left a comment

Choose a reason for hiding this comment