<p>One approach would be to use multiple authorized keys files, authorized_keys2 <a href="https://serverfault.com/questions/116177/whats-the-difference-between-authorized-keys-and-authorized-keys2">is deprecated</a> but there's no reason you can't use it and you can specify multiple authorized keys files in sshd config</p>
<blockquote>
<pre><code>AuthorizedKeysFile

     Specifies the file that contains the public keys used for
     user authentication.  The format is described in the
     AUTHORIZED_KEYS FILE FORMAT section of sshd(8).  Arguments
     to AuthorizedKeysFile accept the tokens described in the
     TOKENS section.  After expansion, AuthorizedKeysFile is
     taken to be an absolute path or one relative to the user's
     home directory.  Multiple files may be listed, separated by
     whitespace.  Alternately this option may be set to none to
     skip checking for user keys in files.  The default is
     &quot;.ssh/authorized_keys .ssh/authorized_keys2&quot;.
</code></pre>
</blockquote>
<p>this might not be the optimal solution to your problem, but I think you're going to have to hack on ansible yourself to get it to do what you want.</p>

CC BY-SA 4.0
2022-12-01T15:37:27.617Z
2022-12-01T15:37:27.617Z
Peter Turner
<p>The <code>#ansible</code> IRC channel noted that key options can be included in the multiline <code>key</code> field. When doing so, <code>key_options</code> can be left unset and things work.</p>
<p>Having to construct this multiline <code>key</code> field including options is pretty close to generating content for <code>ansible.builtin.file</code>. A minor benefit of doing this is that <code>ansible.builtin.authorized_key</code> actually parses the content and errors out when it does not parse before deploying it.</p>

CC BY-SA 4.0
2022-12-02T07:31:16.457Z
2022-12-02T07:31:16.457Z
Helmut Grohne
<p>Ansible provides a <a href="https://docs.ansible.com/ansible/latest/collections/ansible/posix/authorized_key_module.html" rel="nofollow noreferrer">ansible.builtin.authorized_key</a> module which provides a lot of functionality:</p>
<ul>
<li>You can set <code>exclusive: true</code> to delete all other keys.</li>
<li>You can set <code>key_options: ...</code>.</li>
<li>You can list multiple keys in <code>key</code> by separating them with new lines.</li>
</ul>
<p>Is there a way to combine all of the above?</p>
<p>The naive approach results in the <code>key_options</code> to be applied to all keys rather than having key options per key.</p>
<p>Is this a case of generating <code>authorized_keys</code> using <code>ansible.builtin.file</code> given the exclusiveness?</p>

<ansible><ssh><key-management>
Is there a way to exclusively manage multiple ssh keys with differing per-key options using ansible?
Helmut Grohne
# Is there a way to exclusively manage multiple ssh keys with differing per-key options using ansible?

(Asked by: username_0 on 2022-11-25)

Ansible provides a [ansible.builtin.authorized\_key](https://docs.ansible.com/ansible/latest/collections/ansible/posix/authorized_key_module.html) module which provides a lot of functionality:

* You can set `exclusive: true` to delete all other keys.
* You can set `key_options: ...`.
* You can list multiple keys in `key` by separating them with new lines.

Is there a way to combine all of the above?

The naive approach results in the `key_options` to be applied to all keys rather than having key options per key.

Is this a case of generating `authorized_keys` using `ansible.builtin.file` given the exclusiveness?

**Tags:** ansible, ssh, key-management


---

## 2 answers

### Answer by username_1 on 2022-12-01. Score: 1

One approach would be to use multiple authorized keys files, authorized_keys2 is deprecated but there's no reason you can't use it and you can specify multiple authorized keys files in sshd config

AuthorizedKeysFile

     Specifies the file that contains the public keys used for
     user authentication.  The format is described in the
     AUTHORIZED_KEYS FILE FORMAT section of sshd(8).  Arguments
     to AuthorizedKeysFile accept the tokens described in the
     TOKENS section.  After expansion, AuthorizedKeysFile is
     taken to be an absolute path or one relative to the user's
     home directory.  Multiple files may be listed, separated by
     whitespace.  Alternately this option may be set to none to
     skip checking for user keys in files.  The default is
     ".ssh/authorized_keys .ssh/authorized_keys2".


this might not be the optimal solution to your problem, but I think you're going to have to hack on ansible yourself to get it to do what you want.


---

### Answer by username_0 on 2022-12-02. Score: 1

The `#ansible` IRC channel noted that key options can be included in the multiline `key` field. When doing so, `key_options` can be left unset and things work.

Having to construct this multiline `key` field including options is pretty close to generating content for `ansible.builtin.file`. A minor benefit of doing this is that `ansible.builtin.authorized_key` actually parses the content and errors out when it does not parse before deploying it.


---

