Ansible user pubkey ssh login

Software SW help
1

Hi Guys,

Ansible supported: Use Ansible by Red Hat to automate also Turris OS devices

I already wanted to automate deployment of my devices a few years ago, but i constantly did not take the first step. So i now have done that.

I already created a script for creating a “ansible” user to fullfill these steps. [OpenWrt Wiki] Secure your router's access

However after after doing the ssh-copy-id, it still is asking for a password for my ansible user. For the root user, i have already done the exact same steps and it works for me not having to put the password of the root-user.

btw, i also already put this in the /etc/ssh/sshd_config (down below). If i put PasswordAuthentication no i get a <USER>@192.168.1.1: Permission denied (publickey,keyboard-interactive). I have tried ed25519 and rsa encryption but no difference.

Match User <USER>
    PubkeyAuthentication yes
    PasswordAuthentication yes
    RSAAuthentication no

What am i doing wrong?

2

You have to put the public key in /root/.ssh/authorized_keys or /home/ansible/.ssh/authorized_keys

1 Like
3

Thanks for the reply and yes i already had done that.

When you do a ssh-copy-id -f <file>.pub <user>@192.168.1.1 it already puts it in that directory. Which is the ansible user that i used to login using the password the first time.

I checked the permissions of that file and also did already give a restart of the service. /etc/init.d/sshd restart

Homefolder: 755
.ssh folder: 700
authorized_keys: 600

Owner:group: [ansible-user]:[ansible-user]

4

Are you using openssh or are you using dropbear. I seem to remember there are some differences.

5

I am using openssh. HOWEVER…there is just an update.

I used it on my desktop (Fedora 36) it worked just fine. What i wanted to do is connected from my SBC (Radxa ROCK 5B - Linux Ubuntu 20.04) as that will be used as my ansible control server. However strangely enough it does not work.

So the culprit is i think not the Turris Omnia, but rather the distro on my SBC. I though at first MAYBE it is OpenWRT/TOS, but i had the same problem on my LXC (Ubuntu 20.04) while from my desktop no problems connecting to it using the same method.

Thanks anyway for trying to help out.

UPDATE: I managed it to get it to work. In the /etc/ssh/ssh_config (so the client config file) i uncommented and changed the line. Did a systemctl restart ssh.service (restarted of the ssh client service)

IdentityFile ~/.ssh/<ansible_user_privatekey>
6

Is user created with useradd ?
You should see line with user in /etc/passwd and shadow

7

Yeah i know. In my professional life i am a Linux Engineer, so yeah :). Here a good one liner to have a good view of all the users.

cat /etc/passwd | awk -F: '$3 > 999 && $3 {print $0}' | column -t -s:
8

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.