What's the recommended approach for passphrase protected SSH keys?

[mathieumd]

Global Credentials allow to define the SSH Private Key, but AFAIK it's incompatible with encrypted keys, right?

[superstes]

Encrypted keys are not supported.
The pk will be stored encrypted inside the DB.
I do not see a benefit in providing a enc-pk and the passphrase for it in the same form.

[mathieumd]

Isn't the Private Key stored unencrypted on disk (/tmp/ansible-webui/2024-09-19_08-55-2997484/.aw_ssh_key) during every jobs?

[ansibleguy]

Yeah - I have not yet found a better way of passing the secrets to the ansible-execution.
This is pretty much the way the official ansible-runner library does it. (see https://ansible.readthedocs.io/projects/runner/en/latest/intro/)

If we encrypted the ssh-key - we probably would need to write its passphrase to a fie too. What would open up the same security issue :/

If you find a better way of doing this - I'm happy to refactor this projects secret-handling.

[ansibleguy]

As I've needed it at work in the last weeks.
Maybe using named pipes could be useful.
Example of how we use it with ansible-vault for read-once files: https://gist.github.com/NiceRath/67d9fd819a0a088ce34eab7a767dff3a

[mathieumd]

Isn't using ssh-agent the most secure choice? That's what ansible-runner does, no? But I'm not sure they are supporting encrypted keys either, and it looks like they write them on disk too.

[ansibleguy]

Yeah.. As far as I've seen it's because the secrets need to be passed to the new Ansible (sub-)processes.
Process-isolation would add another layer of security as Ansible is basically executed inside a temporary container/pod. Thus no other processes of the service-user can (easily) read the file contents.

But I can take some time and look into the pipes for a start..