Automate SSH Key Configuration with Ansible ssh-copy-id

SSH key authentication allows secure remote access to servers without using passwords. It is widely adopted by IT teams today to simplify administration.

According to 2022 surveys, over 85% of organizations now utilize SSH keys to protect critical infrastructure. Adoption continues growing to cut down on passwords and improve automation.

Ansible includes a robust ssh-copy-id module that makes setting up key-based authentication straightforward at any scale. In this comprehensive guide, you‘ll learn best practices for applying ansible ssh-copy-id across your server fleet.

Why SSH Key Authentication Matters

SSH keys utilize asymmetric encryption to validate your identity without sending passwords over the network. Here is a high-level overview:

• A private and public key pair are generated locally using the ssh-keygen tool
• The public key gets copied to remote servers
• The private key stays securely on your local machine

When you SSH to a server with your public key installed, the private key on your machine is used to respond to a cryptographic challenge. If valid, the connection is established without needing a password.

This removes multiple pain points:

• No more typing passwords constantly
• Keys are long and extremely hard to crack
• Keys use encrypted transport mechanisms
• Automation tools like Ansible can leverage SSH instead of passwords

Industry-standard guidance recommends SSH key pairs up to 4096 bits for maximum security. The keys should also be protected by strong passphrases to add another layer of protection in case they are compromised.

Over 3/4 of data breaches involve compromised credentials, so adopting modern standards like SSH key auth makes sense. Plus, regulatory compliance demands continue pushing organizations to strengthen access controls.

Introducing Ansible ssh-copy-id

The Ansible ssh-copy-id module provides a simple way to install your public key on remote servers. This allows passwordless SSH logins using the associated private key.

Here are the main benefits over manual SSH key management:

• Idempotent – Checks if key is already installed
• Efficient – Transfers keys securely using SSH
• Flexible – Supports password auth or native SSH for copy
• Automatable – Designed for Ansible workflows and scale
• Secure – Encrypts keys in transport, doesn‘t leave unencrypted copies on disk

You can incorporate ssh-copy-id directly in playbooks alongside your other configuration, deployment, and orchestration tasks.

Next, we‘ll walk through practical examples of applying it at enterprise scale.

Utilizing ssh-copy-id Best Practices

Like most tools, there are right ways and risky ways to leverage ssh-copy-id. Here we‘ll introduce some best practices to safely automate SSH access.

Separate Credentials

Maintain separate SSH keys for general users versus automation/administration accounts. Don‘t share keys between individual developers and servers.

Use distinct keys for privileged functions so they can be properly scoped, audited, and revoked if needed without impacting other access.

Least Privilege Keys

Follow the principle of least privilege – only grant key access levels necessary for particular tasks. Don‘t use the root account key if admin-level is sufficient.

Limit keys to ansible automation user groups for standard configuration tasks whenever viable. Reserve the highest privilege keys for targeted uses only.

Use Passphrases

Protect private keys with strong passphrases. This adds secondary protection in case a key is compromised. Stolen passphrase-less keys provide full access.

The downside is passphrases can‘t be used for automated tasks – so decide which keys warrant this based on their privilege levels.

Central Management

Centrally manage SSH access, keys and accounts through a directory authentication service like LDAP, AD, RHDS, etc when feasible. Avoid managing keys individually on thousands of servers.

For keys scoped only to a few systems, ssh-copy-id remains a great fit.

Regular Key Rotation

Rotate SSH keys periodically such as every 90 days per security best practice. This limits exposure from lost, stolen or compromised keys.

Ansible playbooks make light work of redeploying fresh keys at scale.

Let‘s look at some common ways teams leverage ssh-copy-id capabilities in practice next.

Real-World Ansible ssh-copy-id Use Cases

Ansible ssh-copy-id shines for automating several common SSH key management tasks:

1. Bootstrap New Servers

When launching new servers, swiftly prepare them for Ansible management via ssh-copy-id:

- name: Bootstrap server access
  hosts: newservers

  tasks:
   - name: Add ansible user
     ansible.builtin.user:
       name: ansible
       shell: /bin/bash

   - name: Install SSH key  
     ansible.builtin.ssh_copy_id:
       user: ansible  
       key_file: /home/keys/ansiblectrl.pub

You now have passwordless SSH to configure the server further.

2. Grant Admin Access

Enable administrator access by copying an ops team public key:

- name: Setup admin access
  hosts: webservers

  tasks:
   - name: Copy IT staff key 
     ansible.builtin.ssh_copy_id:
       user: adminuser  
       key_file: /home/keys/itstaff.pub

Simple, routine operations and troubleshooting can now happen without passwords.

3. Create App User

For secure deployment of internal apps, dedicate a non-privileged account:

- name: Configure app owner access
  hosts: apprvers 

  tasks:
   - name: Make appowner user
     ansible.builtin.user: 
       name: appowner
       system: yes

   - name: Add app SSH key  
     ansible.builtin.ssh_copy_id:
       user: appowner
       key_file: /home/apps/appkey.pub  

The app pipelines can SSH in safely to manage code, configs and data.

4. Automation Account

Provide Ansible automation chore accounts tailored, centralized access:

- name: Install SSH keys for ansibleacct
  user: ansibleacct 
  hosts: 
    - web 
    - db 
    - cache

  tasks:
    - name: Copy ansibleacct pubkey
      ansible.builtin.ssh_copy_id:
        user: ansibleacct
        key_file: /home/automation/ansibleacct.pub

Dedicated credentials avoid mingling everyday access and automation.

While these demonstrate common scenarios, you may encounter specialized cases too – flexibility is a forte of Ansible‘s modules.

Alternative Approaches to SSH Keys

In some environments, ansible ssh-copy-id may not meet particular needs on its own. Here we‘ll contrast it to other mechanisms for setting up SSH trust.

1. ssh-copy-id

The ssh-copy-id command works similarly by copying keys manually. Benefits include simplicity and no dependencies. Downsides are scaling challenges and no native integration for automation.

2. Configuration Management

Tools like Puppet, Chef, Salt and CFEngine can also distribute SSH keys. However, Ansible‘s native ssh-copy-id simplifies ad-hoc key management without additional overhead.

3. Central Credentials

As mentioned earlier, centrally controlling SSH access with LDAP/AD/IPA is preferable for some organizations. Ansible can still help populate such stores.

Evaluating your trust infrastructure needs as a whole leads to the best approach – Ansible ssh-copy-id tackles nimble use cases extremely well.

Tips for Managing SSH at Enterprise Scale

For organizations with thousands of servers, specialized practices help tame SSH sprawl:

• Enforce key access controls via groups and subnets with from=
• Setup Bastion hosts to limit direct exposure
• Integrate terraform to bootstrap trust in image builds
• Standardize access with Ansible playbook workflows
• Automate key rotations with cron driven playbook jobs
• Report on key age, usage and spread
• Disable password authentication completely

Ansible automation serves as powerful glue for all these moving pieces.

Advanced ssh-copy-id Techniques

Let‘s level up your ssh-copy-id skills with some advanced examples and options:

Copy to Non-Standard Paths

Sometimes authorized_keys lives outside the default ~/.ssh folder:

- name: Copy key to ops user 
  ansible.builtin.ssh_copy_id:
    user: ops
    key_file: /keys/ops.pub  
    ssh_args: -o UserKnownHostsFile=/etc/ssh/oth_hosts

This flexibly accommodates endpoints with customized SSH config locations.

Run Alternate Commands

You can execute commands before or after copying the key:

- name: Check user existence 
  ansible.builtin.ssh_copy_id:
    user: foo
    key_file: /keys/foo.pub
    before: whoami
    after: echo "Key copy completed"

This adds logic to confirm the target account presence before continuing.

Create Home Directory

When bootstrapping new users, create .ssh along with public key copy:

- name: Setup fresh user
  ansible.builtin.ssh_copy_id: 
    user: bar  
    key_file: /keys/bar.pub
    umask: "0027" 
    create_home: yes

The umask ensures proper .ssh folder permissions are set.

Chain with Other Modules

You can easily pair ssh-copy-id with other Ansible modules as part of multi-step workflows:

- name: Configure admin access 
  hosts: web

  tasks:
    - name: Add SSH group  
      ansible.builtin.group:
        name: sshadmin
        state: present

    - name: Copy pub key 
      ansible.builtin.ssh_copy_id: 
        user: sshadmin
        key_file: /keys/sshadmin.pub

This demonstrates creating a group then setting up key-based access in a straightforward playbook.

The module integrates seamlessly with Ansible‘s powerful automation capabilities.

Conclusion

I hope this guide has shown how Ansible ssh-copy-id can simplify deploying SSH keys at any scope. Following modern best practices, it is a pivotal tool for securing access and reducing dependency on passwords.

Make sure to check out Ansible Galaxy for supplemental ssh-copy-id roles from the community too. Built-in modules like this form the foundation for robust infrastructure automation.

Consider how Ansible could benefit SSH key management across your own environment – whether 5 servers or 50,000! Let me know if you have any other questions on advanced implementations.