It seems that there are only two reasonable approaches for the primary Ansible user:
- Using
root
- Using another user (e.g.,
ansible
) withNOPASSWD
sudo
access
The first option is a no-go since I cringe at the thought of keeping PermitRootLogin
on. So, by default, the 2nd option seems to be the way to go.
I was thinking, at the very least, in /etc/ssh/sshd_config
:
Match User ansible
PasswordAuthentication No
And limiting key usage to the Ansible host by using the from
option in authorized_keys
:
from="192.168.100/24"
Any other ideas or issues/concerns with my thoughts so far?