How to add and use an SSH key on Cisco via Ansible and Ascender
Greg Sowell shows how to push an SSH public key to a Cisco Nexus switch with Ansible and Ascender so that automation can authenticate without passwords. He starts with his account model for network gear: a local admin account for emergencies when RADIUS or TACACS is unreachable, a dedicated automation account that no human uses, and alerts to a logging server whenever the admin account logs in.
In Ascender, credentials are stored securely and never displayed after saving. He creates a machine credential for the admin account, another holding the automation account's private key, and a custom credential type that injects the public key into the playbook as an extra variable. The job template ties an inventory, a Git project, the playbook, and those credentials together.
The playbook disables fact gathering, which breaks network devices, sets key content from the injected credential when it is defined, and uses the nxos_user module to create the automation user with that key. A PuTTY login then succeeds without a username or password prompt. He closes by noting the no_log task parameter for hiding sensitive output and suggests keeping secrets out of playbooks in favor of Ansible Vault or Ascender credential storage.
Key takeaways
- Keep a local admin account for when RADIUS or TACACS is down, plus a separate automation account that no human logs into.
- Ascender machine credentials store passwords or private keys securely and never display them again once saved.
- A custom credential type holds the SSH public key and injects it into the playbook as an extra variable.
- Set gather_facts to false for network devices; the default fact gathering is built for Linux hosts and breaks network elements.
- The nxos_user module creates the automation user with the supplied SSH key using state present.
- Add no_log true to tasks that handle sensitive data so Ascender obfuscates the output.
Questions this video answers
How do I add an SSH key to a Cisco Nexus switch with Ansible?
Use the nxos_user module from the NX-OS collection with a username, the sshkey parameter carrying the public key, and state present. Run it with gather_facts disabled and an existing admin credential so Ansible can log in to create the account. Afterwards SSH clients holding the matching private key authenticate without a password.
How should SSH keys be stored for Ascender network automation?
Greg recommends against placing keys directly in playbooks. In Ascender, store the private key in a machine credential and put the public key in a custom credential type that injects it as an extra variable. For command-line Ansible, use a vault instead. Credentials in Ascender cannot be viewed after saving.
Why have separate admin and automation accounts on network devices?
A local admin account with local login rights lets you fix a device when the RADIUS or TACACS server is unreachable. The automation account exists purely for Ascender to administer the device with key authentication. Sending logins on the admin account to a logging server with alerts flags anyone using the back door.
This video is part of the Ascender Pro playlist. Browse every CIQ video by product and topic.
Transcript
hey everybody I'm Greg Sowell and welcome to another ciq demo today I'm going to be showing you how to add SSH keys to your network elements right so it allows you to authentication via SSH Keys it's the new hotness although it's not it's been really a long time but most of us Network folks are accustomed to username and password right um in my environments I always maintained a minimum of two accounts generally it was going to be more than that so one is I would have kind of an admin account that had local login privileges right you're going to be using username and password
right there um that being said we would always have an authentication server like um a radius or tackx right something like that that you know you could put in your username password and it would dial back and and authenticate there the problem with that is that often times when you know you're working on the network something will break you won't have access to that authentication server anymore and you still need to be able to log in to fix this piece of network equipment right it's kind of the nature of the Beast well if you don't have local login privileges you're kind of sunk right so
we would generally have kind of your local admin account but then also an automation account right the automation account is used just purely for uh Ascender here to be able to log in to administer this device no human should be logging into that and also you know just to keep track of all this stuff you should have this ship off to um a logging server where if somebody logs in with that admin account it sends an alert right just so everybody knows hey Somebody went in kind of the back door on this piece of equipment right so that's kind of how you could sort
of get around kind of the safety or security implications of having that to me it's a must have your mileage may vary your environment May different uh rather be different but uh that's how it works for me so anyway I've talked enough let's show you how to actually add it in there so I'm going to be doing it via automation because honestly I'm lazy so in my automation uh inside of Ascender here right your Enterprise automation platform it's going to have all of your uh cool stuff stored in here so I like something about the credential section is that it's going to securely maintain
View full transcriptHide full transcript
all of my stuff in here right so I can look at um I don't know let's say this one right here this Basics credential I'll take a look at that I'll click the edit button and no matter how many times I click the view it's not going to show it to me right so it's going to securely maintain my passwords inside of my system so having said that I can create one that's for my admin account right the one that nobody should really be using but right it's chicken or egg I have to be able to log in first before I can add the uh
SSH public key into this for an account right to create that account so I'll go ahead and add it in here so that I can use that for my initial login to do this configuration and and then I'll also create another uh machine credential so machine credentials are what you're going to use most of the time when you're logging into Network elements uh Windows servers Linux servers so it's it's pretty much the universal catch all and so if I'm adding credential I'll go to machine credential right here it lets me put in username and password and again for that admin account I have to have
it in here so that I can authenticate to add the actual key in so I can put those in here but for the uh automation account right that's actually going to be using key right here I can put in my private key right so you have the difference between a public key and a private key that public key is what I'm going to be putting on all my network elements the private key is what I have to have to authenticate to those hosts so I would be putting my private key right in here I would be clicking save and then that credentials in there and
I can utilize that in my automations but I'm going to be creating a job template in here I already have so I'm going to go to my template section this is where we tie in all the various pieces to actually perform automation I've created one in here it's called something like Nexus ad SSH public key I can click edit just to show it to you there's not a whole lot special about it I gave it a name I give it my inventory which is a big list of all the hosts I could probably or rather possibly operate against here's my repository my git repository we
call them projects really just ties to a get repo and then I have my playbook here which is in my public G repository so it's up and available for you so don't try and like type from the screen actually just utilize the link you're going to be able to get access to all that stuff and I have two credentials I've created in here so I've got one that's uh the SSH key this is going to be my admin account right that can use a name and password in and then I also have an SSH public key so uh the SSH uh public key I've created
a custom credential in here that really just lets me take it paste that public key in and then now it gets injected into my playbook as an extra variable and so now it's ready for launch I'm going to go ahead and click launch on that Playbook and while I do I'm going to pop over here to the Playbook itself and just give you a quick rundown it is very simple now I have uh just a single host my test host set up there I have gather facts false you want to do that on all your network elements otherwise it's going to break um gather facts is done by default it's information gathering where it
goes out to kind of a Linux host pulls a whole bunch of variable IED stuff that will break Network elements because it's not designed for them anyway in the VAR section I have an automation username right what's the user account that's going to get created on The Cisco switch and then the key content is the variable that's actually going to be used for that public key you can see here that I just put in some dummy data and in reality even though a public key should be fine to theoretically I mean you don't want to throw it to the internet but um you could have
it kind of in your playbook inside your organization I guess that would probably be all right I don't like to put any kind of quote unquote secret information directly in my playbooks so I wouldn't necessarily recommend this I would say use a vault if you're doing command line anible or if you're doing like a sinder like me just keep it in the credential storage right that way it gets injected in and it doesn't matter well some folks also like to keep their public key in file format so if you uh look right here the ComEd out section I'm kind of emulating that just for testing
purposes I want to be able to like test pulling it from a a file um and then at the very bottom you can see also I have uh kind of commented out where it would look up from uh the _ RSA dob file right so it's actually going to grab the contents of that and use it but I'm not doing it that way because I'm using the credential storage baked into Ascender here now the very first task you can see I'm setting a fact so I am setting that key content based on that search key that's passed in from Ascender so if I
have that uh variable actually being passed in it's going to see it as you see the condition there when cert key is defined so if that variable actually exists it knows hey I passed in a credential go ahead and use that for key content otherwise it's going to try and look up uh key content either here from the VAR section or you could put it in your um variable section in the job template itself right that'll get passed in as extra VAR so it would grab it from there as well but the real uh star of the show is the very last task and honestly
you could bake all this into a single task if you wanted to you could put that key content right in there that's not usually how I try and write it I try and make it a little bit more flexible right because somewhere down the road that key is probably going to change and you're going to want to update that so this is a really easy way to do that but if you take a look right there I'm using the uh the nxs collection NX _ user is the module itself and I'm specifying a name and it's just going to be Automation and then the SSH
key right I'm supplying the key there from uh Ascender and then State present so it's actually going to connect into there it's going to create this user with that specific public key so then I should be able to authenticate so just to test it I will go to putty I do have an account kind of preconfigured in here let me run it authentication yep there you go right see you I didn't have to put in any uh username I didn't have to put in a password I didn't have to tell it what key already had it preset up in the configuration hey use this
username and tie it into this key so it's using username Automation and the uh the key is the private key for this specific connection let me pop back over to sender really quick let's take a look at the output details so here's another interesting piece right here it says module did not set no log for update password so no log means um there's potentially some sensitive information that's actually stored in here and in my playbook I could add an extra task level parameter called uh noore log colon true and if I do that it will obfuscate all the output there right to keep all that
information private as you can see moving forward all of my automations could use that SSH key I would just switch to a different credential for all the rest of my playbooks um also on my uh command line uh connections right whether I'm going from Linux Mac or even Windows using putty I can specify that private key and I can automatically authenticate to all these hosts you can see it's actually pretty simple to set up and take advantage of well at this point I like to say if you have any questions or comments or your tweak or tune or do something different uh I would love
to hear from you I really enjoy feedback so please send it my way if there is a demo you would like to see different right uh something that's uh specific to your environment or something you think would be cool please reach out drop me a comment as well um I'm always looking for new f for this stuff I know networking can be kind of a tricky to get started with so I've been uh doing a few of those as well um also if you are interested in our uh automation plat form here you want some help getting off the ground uh we do support on
it right we will do as much or as little as you like we also have some periphery tools that add so much cool functionality to uh a sinder itself pulling logs and be able to do all kinds of amazing stuff with it so uh thanks for uh watching uh good luck happy uh automating Happy SSH King and we'll see you next time bye
Built for scale. Chosen by the world’s best.
2.75M+
Rocky Linux instances
Being used world wide
90%
Of fortune 100 companies
Use CIQ supported technologies
250k
Avg. monthly downloads
Rocky Linux
9
Enterprise products
Spanning the kernel to the orchestrator
Have questions about your infrastructure?
Talk to a CIQ engineer about Rocky Linux, HPC, and AI infrastructure.