<p>If your git repos is a private github, you can use <a href="https://developer.github.com/v3/guides/managing-deploy-keys/" rel="nofollow noreferrer">github methods</a> (deploy keys is very powerful).</p>
<p>If your repos are not hosted on github or they don't provide read-only deploy key feature, The two options you mentioned are both valuable.</p>
<h2>Single DevOps guy</h2>
<p>If you are the only person working on the project and Your machine/machines are the only you will run ansible from (no CD tools like jenkins and friends) you're good to go with the agent forwarding option: is likely less possible that you forget your private key unencrypted around.</p>
<h2>Small Team</h2>
<p>If you are a team of people working on the same Ansible playbook or multiple people that run the playbook then you have both options:</p>
<ul>
<li><p>keep the agent-forwarding option; every teammate run the script from his machine.</p>
</li>
<li><p>create a deployer key-pair, upload the pub-key and encrypt the private with vault as suggested by <a href="https://devops.stackexchange.com/users/342/berlin">Berlin</a>. The key is encrypted and the scope of the private key is restricted to only 1 or few repos. The problem with this approach is that you have to rotate the vault password every time a teammate leave the team.</p>
</li>
</ul>
<p>I would never put my personal private key, which has a wide scope, in any possibly unsafe place. Vault encryption is as good as the people that uses it and there's a lot of keys/passwords in cleartext out there :)</p>

CC BY-SA 3.0
2017-09-16T09:07:46.610Z
2018-01-26T08:40:38.863Z
2020-06-18T08:28:10.803Z
j0lly
<p>You can also consider to encrypt the file containing your private SSH key using Ansible Vault.</p>

<p>Some links:</p>

<p><a href="http://docs.ansible.com/ansible/latest/playbooks_vault.html" rel="nofollow noreferrer">http://docs.ansible.com/ansible/latest/playbooks_vault.html</a></p>

<p><a href="https://therealmarv.com/ansible-vault-file-handling/" rel="nofollow noreferrer">https://therealmarv.com/ansible-vault-file-handling/</a></p>

<p><a href="https://www.calazan.com/how-to-deploy-encrypted-copies-of-your-ssl-keys-and-other-files-with-ansible-and-openssl/" rel="nofollow noreferrer">https://www.calazan.com/how-to-deploy-encrypted-copies-of-your-ssl-keys-and-other-files-with-ansible-and-openssl/</a></p>

CC BY-SA 3.0
2017-09-15T22:38:13.167Z
2017-09-15T22:38:13.167Z
Berlin
<blockquote>
  <p>Should I be using SSH agent forwarding (this way I can use my local
  SSH keys)</p>
</blockquote>

<p>Yes, that could be an option</p>

<blockquote>
  <p>should I store private SSH key (encrypted, added to source control)
  within my ansible project and copy it using Ansible to my target node?</p>
</blockquote>

<p>no</p>

<p><a href="https://serverfault.com/questions/823956/ansible-security-best-practices">https://serverfault.com/questions/823956/ansible-security-best-practices</a></p>

<blockquote>
  <p>For servers, don't allow root access via ssh at all. Many audits scoff
  at this.</p>
  
  <p>For ansible, let every admin use their own personal account on each
  target server, and let them sudo with passwords. This way no password
  is shared between two people. You can check who did what on each
  server. It's up to you if personal accounts allow login on password,
  ssh key only, or require both.</p>
</blockquote>

<p>In summary, use an ssh key with password. Let every user use their own ssh keys. Never allow sudo access via ssh.</p>

CC BY-SA 3.0
2017-09-17T16:14:39.917Z
hmm, I'm not sure if this applies to the context. I asked about SSH keys used to pull (read-only) code from repository when deploying an app. With SSH agent I need each public key (each user) to be added to repository as deployment key.
pzaj
CC BY-SA 3.0
2017-09-17T14:09:40.133Z
2017-09-18T06:20:59.393Z
2017-09-18T06:20:59.393Z
030
<p>You can story your private key in one circumstance: if you configure your repository so that it only allows read access for that particular key, and you don't bother about the repository being publicly readable. In this case, you can easily store your private key - obviously make a throwaway key without passphrase. But as I said, only if you are fine with public access to that repository.</p>

<p>If that is not the case, then you are probably stuck with the SSH agent. It is not ideal, as <code>root</code> can take the socket, but if you are in a kind of benevolent environment (i.e., no attackable webserver anywhere near), then it should be OK.</p>

CC BY-SA 3.0
2017-09-15T22:04:43.027Z
2017-09-15T22:04:43.027Z
AnoE
<p>I recently started playing around with Ansible and it seems very nice. I don't have much experience in DevOps stuff and never really had to handle any complex scenarios. I started creating my Ansible playbook to replace my current deployment tool - Deployer PHP. I'm stuck at cloning git repository unfortunately. Now, I know I need a public key added to enable access to git repository and here comes my question. </p>

<p>Should I be using SSH agent forwarding (this way I can use my local SSH keys) or should I store private SSH key (encrypted, added to source control) within my ansible project and copy it using Ansible to my target node? I know the question may be very broad, so what interests me is security implications of both approaches.</p>

<ansible><git><security>
Ansible - private git repositories - SSH agent forwarding vs copying private SSH key
pzaj
# Ansible - private git repositories - SSH agent forwarding vs copying private SSH key

(Asked by: username_0 on 2017-09-15)

I recently started playing around with Ansible and it seems very nice. I don't have much experience in DevOps stuff and never really had to handle any complex scenarios. I started creating my Ansible playbook to replace my current deployment tool - Deployer PHP. I'm stuck at cloning git repository unfortunately. Now, I know I need a public key added to enable access to git repository and here comes my question.

Should I be using SSH agent forwarding (this way I can use my local SSH keys) or should I store private SSH key (encrypted, added to source control) within my ansible project and copy it using Ansible to my target node? I know the question may be very broad, so what interests me is security implications of both approaches.

**Tags:** ansible, git, security


---

## 4 answers

### Answer by username_1 on 2017-09-16. Score: 4

If your git repos is a private github, you can use [github methods](https://developer.github.com/v3/guides/managing-deploy-keys/) (deploy keys is very powerful).

If your repos are not hosted on github or they don't provide read-only deploy key feature, The two options you mentioned are both valuable.

## Single DevOps guy

If you are the only person working on the project and Your machine/machines are the only you will run ansible from (no CD tools like jenkins and friends) you're good to go with the agent forwarding option: is likely less possible that you forget your private key unencrypted around.

## Small Team

If you are a team of people working on the same Ansible playbook or multiple people that run the playbook then you have both options:

* keep the agent-forwarding option; every teammate run the script from his machine.
* create a deployer key-pair, upload the pub-key and encrypt the private with vault as suggested by [username_2](https://devops.stackexchange.com/users/342/berlin). The key is encrypted and the scope of the private key is restricted to only 1 or few repos. The problem with this approach is that you have to rotate the vault password every time a teammate leave the team.

I would never put my personal private key, which has a wide scope, in any possibly unsafe place. Vault encryption is as good as the people that uses it and there's a lot of keys/passwords in cleartext out there :)


---

### Answer by username_2 on 2017-09-15. Score: 4

You can also consider to encrypt the file containing your private SSH key using Ansible Vault.

Some links:

<http://docs.ansible.com/ansible/latest/playbooks_vault.html>

<https://therealmarv.com/ansible-vault-file-handling/>

<https://www.calazan.com/how-to-deploy-encrypted-copies-of-your-ssl-keys-and-other-files-with-ansible-and-openssl/>


---

### Answer by username_3 on 2017-09-17. Score: 2

> Should I be using SSH agent forwarding (this way I can use my local
> SSH keys)

Yes, that could be an option

> should I store private SSH key (encrypted, added to source control)
> within my ansible project and copy it using Ansible to my target node?

no

<https://serverfault.com/questions/823956/ansible-security-best-practices>

> For servers, don't allow root access via ssh at all. Many audits scoff
> at this.
>
> For ansible, let every admin use their own personal account on each
> target server, and let them sudo with passwords. This way no password
> is shared between two people. You can check who did what on each
> server. It's up to you if personal accounts allow login on password,
> ssh key only, or require both.

In summary, use an ssh key with password. Let every user use their own ssh keys. Never allow sudo access via ssh.

> **Comments:**
> **username_0**: hmm, I'm not sure if this applies to the context. I asked about SSH keys used to pull (read-only) code from repository when deploying an app. With SSH agent I need each public key (each user) to be added to repository as deployment key.  

---

### Answer by username_4 on 2017-09-15. Score: 0

You can story your private key in one circumstance: if you configure your repository so that it only allows read access for that particular key, and you don't bother about the repository being publicly readable. In this case, you can easily store your private key - obviously make a throwaway key without passphrase. But as I said, only if you are fine with public access to that repository.

If that is not the case, then you are probably stuck with the SSH agent. It is not ideal, as `root` can take the socket, but if you are in a kind of benevolent environment (i.e., no attackable webserver anywhere near), then it should be OK.


---

