How To Add & Remove SSH Public Key From authorized_keys File Using Ansible

Halo, kalau kamu merasa tulisan saya ngebantu, kamu bisa ucapkan terima kasih lewat saweria .

If you feel this website help you, you can donate at saweria .

Contoh Kasus

“Sysadmin lama saya masih bisa akses server karena pub key dia masih terdaftar di authorized_keys, Gimana cara hapusnya di semua server secara cepat??”

Hapus pub key di Semua Server dengan Ansible

1. Buat file hosts

[server]
192.168.1.2

[server:vars]
ansible_user=admin
ansible_port=123
ansible_ssh_private_key_file=/home/ipang/.ssh/do/id_rsa
ansible_ssh_common_args='-o StrictHostKeyChecking=no'
host_key_checking=False

2. Buat file yml, remove-and-add-key.yml

---
- hosts: server


  tasks:
  #first, we need to add new key
  #or you can skip this, if you key already there
  - name: Add new key
    authorized_key:
      user: admin
      key: "{{ lookup('file', '/home/ipang/.ssh/do/new/id_rsa.pub') }}"
 
  - name: Remove old key
    authorized_key:
      user: admin
      path: /home/admin/.ssh/authorized_keys
      state: absent
      key: "{{ lookup('file', '/home/ipang/.ssh/do/old_id_rsa.pub') }}"

3. Run ansible-playbook -i hosts remove-and-add-key.yml

Notes:

1. Bagaimana jika kamu mau menghapus beberapa key sekaligus

---
- hosts: server


  tasks:
  - name: Remove old key 1
    authorized_key:
      user: admin
      path: /home/admin/.ssh/authorized_keys
      state: absent
      key: "{{ lookup('file', '/home/ipang/.ssh/do/old_id_rsa1.pub') }}"

  - name: Remove old key 2
    authorized_key:
      user: admin
      path: /home/admin/.ssh/authorized_keys
      state: absent
      key: "{{ lookup('file', '/home/ipang/.ssh/do/old_id_rsa2.pub') }}"

  - name: Remove old key 3
    authorized_key:
      user: admin
      path: /home/admin/.ssh/authorized_keys
      state: absent
      key: "{{ lookup('file', '/home/ipang/.ssh/do/old_id_rsa3.pub') }}"

2. Menghapus pub key beberapa user sekaligus? Bisa dengan 1 file yaml kalau kamu mengizinkan root login, jika tidak, lebih mudah membuat 2 file yaml terpisah

---
- hosts: server
   # remove-admin-key.yml
   # remove old key on admin
  tasks:
  - name: Remove old key 1
    authorized_key:
      user: admin
      path: /home/admin/.ssh/authorized_keys
      state: absent
      key: "{{ lookup('file', '/home/ipang/.ssh/do/old_id_rsa1.pub') }}"

Untuk user lain kamu bisa buat 1 file lagi

---
- hosts: server
   # remove-mimin-key.yml
   # remove old key on mimin
  tasks:
  - name: Remove old key 1
    authorized_key:
      user: mimin
      path: /home/mimin/.ssh/authorized_keys
      state: absent
      key: "{{ lookup('file', '/home/ipang/.ssh/do/old_mimin.pub') }}"