Skip to content

Instantly share code, notes, and snippets.

@nazarewk
Last active August 2, 2021 20:27
Show Gist options
  • Star 16 You must be signed in to star a gist
  • Fork 4 You must be signed in to fork a gist
  • Save nazarewk/c65a1744231b4496b5d44505d49d590f to your computer and use it in GitHub Desktop.
Save nazarewk/c65a1744231b4496b5d44505d49d590f to your computer and use it in GitHub Desktop.
Ansible SSH Agent forwarding with Jump (bastion) host
[defaults]
sudo_flags = SSH_AUTH_SOCK="$SSH_AUTH_SOCK" -H -S -n
[ssh_connection]
ssh_args=-o ForwardAgent=yes
ControlMaster auto
ControlPath ~/.ssh/tmp/control_%h_%p_%r
ControlPersist 1m
Host jump
HostName <jump_ip>
User nazarewk
ForwardAgent yes
Host secured-*
User nazarewk
## ProxyJump works on OpenSSH 7.3+ (newest version as of 16.09.2016)
# ProxyJump jump
ProxyCommand ssh jump -W %h:%p
ForwardAgent yes
- name: Ensuring we can ForwardAgent
lineinfile:
dest: "~/.profile"
line: '[ -n "$SSH_AUTH_SOCK" ] && setfacl -m u:{{ project_user }}:rw "$SSH_AUTH_SOCK" && setfacl -m u:{{ project_user }}:x "$(dirname $SSH_AUTH_SOCK)"'
insertafter: EOF
- name: Ensure we have ForwardAgent
command: ssh-add -l
become: true
become_user: "{{ project_user }}"
@nazarewk
Copy link
Author

nazarewk commented Sep 16, 2016

For whatever reason it also needs a terminal session opened to the target server in another window while deploy is running (so SSH_AUTH_SOCK shared with ansible gets proper permissions)

@nazarewk
Copy link
Author

nazarewk commented Feb 3, 2017

UPDATE: ControlPersist 1m option enables ssh not to drop the connection immediately after closing last session opened for another minute, so ansible is now happily reusing effectively the same connection with the server and don't need separate session opened.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment