Add ssh_config module option for identities_only (#7704)

* Add ssh_config module option for identities_only

* Add changelog fragment for 7704

* remove trailing whitespace

* Apply suggestions from code review

Documentation change suggestions from felixfontein

Co-authored-by: Felix Fontein <felix@fontein.de>

---------

Co-authored-by: Michael Finney <michael.finney@tpwd.texas.gov>
Co-authored-by: Felix Fontein <felix@fontein.de>

changelogs/fragments/7704-ssh_config_identities_only_option.yml

@@ -0,0 +1,2 @@
+minor_changes:
+  - ssh_config - new feature to set ``IdentitiesOnly`` option to ``yes`` or ``no`` (https://github.com/ansible-collections/community.general/pull/7704).

plugins/modules/ssh_config.py

@@ -72,6 +72,15 @@ options:
         when connecting to this host.
       - File need to exist and have mode V(0600) to be valid.
     type: path
+  identities_only:
+    description:
+      - Specifies that SSH should only use the configured authentication
+        identity and certificate files (either the default files, or
+        those explicitly configured in the C(ssh_config) files or passed on
+        the ssh command-line), even if ssh-agent or a PKCS11Provider or
+        SecurityKeyProvider offers more identities.
+    type: bool
+    version_added: 8.2.0
   user_known_hosts_file:
     description:
       - Sets the user known hosts file option.
@@ -250,6 +259,7 @@ class SSHConfig(object):
             hostname=self.params.get('hostname'),
             port=self.params.get('port'),
             identity_file=self.params.get('identity_file'),
+            identities_only=convert_bool(self.params.get('identities_only')),
             user=self.params.get('remote_user'),
             strict_host_key_checking=self.params.get('strict_host_key_checking'),
             user_known_hosts_file=self.params.get('user_known_hosts_file'),
@@ -348,6 +358,7 @@ def main():
             hostname=dict(type='str'),
             host_key_algorithms=dict(type='str', no_log=False),
             identity_file=dict(type='path'),
+            identities_only=dict(type='bool'),
             port=dict(type='str'),
             proxycommand=dict(type='str', default=None),
             proxyjump=dict(type='str', default=None),

tests/integration/targets/ssh_config/tasks/options.yml

@@ -17,6 +17,7 @@
     forward_agent: true
     add_keys_to_agent: true
     host_key_algorithms: "+ssh-rsa"
+    identities_only: true
     controlmaster: "auto"
     controlpath: "~/.ssh/sockets/%r@%h-%p"
     controlpersist: yes
@@ -50,6 +51,7 @@
     forward_agent: true
     add_keys_to_agent: true
     host_key_algorithms: "+ssh-rsa"
+    identities_only: true
     controlmaster: "auto"
     controlpath: "~/.ssh/sockets/%r@%h-%p"
     controlpersist: yes
@@ -72,6 +74,7 @@
     forward_agent: true
     add_keys_to_agent: true
     host_key_algorithms: "+ssh-rsa"
+    identities_only: true
     controlmaster: "auto"
     controlpath: "~/.ssh/sockets/%r@%h-%p"
     controlpersist: yes
@@ -98,6 +101,7 @@
       - "'forwardagent yes' in slurp_ssh_config['content'] | b64decode"
       - "'addkeystoagent yes' in slurp_ssh_config['content'] | b64decode"
       - "'hostkeyalgorithms +ssh-rsa' in slurp_ssh_config['content'] | b64decode"
+      - "'identitiesonly yes' in slurp_ssh_config['content'] | b64decode"
       - "'controlmaster auto' in slurp_ssh_config['content'] | b64decode"
       - "'controlpath ~/.ssh/sockets/%r@%h-%p' in slurp_ssh_config['content'] | b64decode"
       - "'controlpersist yes' in slurp_ssh_config['content'] | b64decode"
@@ -110,6 +114,7 @@
     forward_agent: false
     add_keys_to_agent: false
     host_key_algorithms: "+ssh-ed25519"
+    identities_only: false
     controlmaster: no
     controlpath: "~/.ssh/new-sockets/%r@%h-%p"
     controlpersist: "600"
@@ -134,6 +139,7 @@
     forward_agent: false
     add_keys_to_agent: false
     host_key_algorithms: "+ssh-ed25519"
+    identities_only: false
     controlmaster: no
     controlpath: "~/.ssh/new-sockets/%r@%h-%p"
     controlpersist: "600"
@@ -161,6 +167,7 @@
       - "'forwardagent no' in slurp_ssh_config['content'] | b64decode"
       - "'addkeystoagent no' in slurp_ssh_config['content'] | b64decode"
       - "'hostkeyalgorithms +ssh-ed25519' in slurp_ssh_config['content'] | b64decode"
+      - "'identitiesonly no' in slurp_ssh_config['content'] | b64decode"
       - "'controlmaster no' in slurp_ssh_config['content'] | b64decode"
       - "'controlpath ~/.ssh/new-sockets/%r@%h-%p' in slurp_ssh_config['content'] | b64decode"
       - "'controlpersist 600' in slurp_ssh_config['content'] | b64decode"
@@ -193,6 +200,7 @@
       - "'forwardagent no' in slurp_ssh_config['content'] | b64decode"
       - "'addkeystoagent no' in slurp_ssh_config['content'] | b64decode"
       - "'hostkeyalgorithms +ssh-ed25519' in slurp_ssh_config['content'] | b64decode"
+      - "'identitiesonly no' in slurp_ssh_config['content'] | b64decode"
       - "'controlmaster no' in slurp_ssh_config['content'] | b64decode"
       - "'controlpath ~/.ssh/new-sockets/%r@%h-%p' in slurp_ssh_config['content'] | b64decode"
       - "'controlpersist 600' in slurp_ssh_config['content'] | b64decode"
@@ -243,6 +251,7 @@
       - "'forwardagent no' not in slurp_ssh_config['content'] | b64decode"
       - "'addkeystoagent no' not in slurp_ssh_config['content'] | b64decode"
       - "'hostkeyalgorithms +ssh-ed25519' not in slurp_ssh_config['content'] | b64decode"
+      - "'identitiesonly no' not in slurp_ssh_config['content'] | b64decode"
       - "'controlmaster auto' not in slurp_ssh_config['content'] | b64decode"
       - "'controlpath ~/.ssh/sockets/%r@%h-%p' not in slurp_ssh_config['content'] | b64decode"
       - "'controlpersist yes' not in slurp_ssh_config['content'] | b64decode"
@@ -263,6 +272,7 @@
     forward_agent: true
     add_keys_to_agent: true
     host_key_algorithms: "+ssh-rsa"
+    identities_only: true
     controlmaster: "auto"
     controlpath: "~/.ssh/sockets/%r@%h-%p"
     controlpersist: yes
@@ -296,6 +306,7 @@
     forward_agent: true
     add_keys_to_agent: true
     host_key_algorithms: "+ssh-rsa"
+    identities_only: true
     controlmaster: "auto"
     controlpath: "~/.ssh/sockets/%r@%h-%p"
     controlpersist: yes
@@ -318,6 +329,7 @@
     forward_agent: true
     add_keys_to_agent: true
     host_key_algorithms: "+ssh-rsa"
+    identities_only: true
     controlmaster: "auto"
     controlpath: "~/.ssh/sockets/%r@%h-%p"
     controlpersist: yes
@@ -344,6 +356,7 @@
       - "'forwardagent yes' in slurp_ssh_config['content'] | b64decode"
       - "'addkeystoagent yes' in slurp_ssh_config['content'] | b64decode"
       - "'hostkeyalgorithms +ssh-rsa' in slurp_ssh_config['content'] | b64decode"
+      - "'identitiesonly yes' in slurp_ssh_config['content'] | b64decode"
       - "'controlmaster auto' in slurp_ssh_config['content'] | b64decode"
       - "'controlpath ~/.ssh/sockets/%r@%h-%p' in slurp_ssh_config['content'] | b64decode"
       - "'controlpersist yes' in slurp_ssh_config['content'] | b64decode"
@@ -356,6 +369,7 @@
     forward_agent: false
     add_keys_to_agent: false
     host_key_algorithms: "+ssh-ed25519"
+    identities_only: false
     controlmaster: no
     controlpath: "~/.ssh/new-sockets/%r@%h-%p"
     controlpersist: "600"
@@ -380,6 +394,7 @@
     forward_agent: false
     add_keys_to_agent: false
     host_key_algorithms: "+ssh-ed25519"
+    identities_only: false
     controlmaster: no
     controlpath: "~/.ssh/new-sockets/%r@%h-%p"
     controlpersist: "600"
@@ -407,6 +422,7 @@
       - "'forwardagent no' in slurp_ssh_config['content'] | b64decode"
       - "'addkeystoagent no' in slurp_ssh_config['content'] | b64decode"
       - "'hostkeyalgorithms +ssh-ed25519' in slurp_ssh_config['content'] | b64decode"
+      - "'identitiesonly no' in slurp_ssh_config['content'] | b64decode"
       - "'controlmaster no' in slurp_ssh_config['content'] | b64decode"
       - "'controlpath ~/.ssh/new-sockets/%r@%h-%p' in slurp_ssh_config['content'] | b64decode"
       - "'controlpersist 600' in slurp_ssh_config['content'] | b64decode"
@@ -439,6 +455,7 @@
       - "'forwardagent no' in slurp_ssh_config['content'] | b64decode"
       - "'addkeystoagent no' in slurp_ssh_config['content'] | b64decode"
       - "'hostkeyalgorithms +ssh-ed25519' in slurp_ssh_config['content'] | b64decode"
+      - "'identitiesonly no' in slurp_ssh_config['content'] | b64decode"
       - "'controlmaster no' in slurp_ssh_config['content'] | b64decode"
       - "'controlpath ~/.ssh/new-sockets/%r@%h-%p' in slurp_ssh_config['content'] | b64decode"
       - "'controlpersist 600' in slurp_ssh_config['content'] | b64decode"
@@ -489,6 +506,7 @@
       - "'forwardagent no' not in slurp_ssh_config['content'] | b64decode"
       - "'addkeystoagent no' not in slurp_ssh_config['content'] | b64decode"
       - "'hostkeyalgorithms +ssh-ed25519' not in slurp_ssh_config['content'] | b64decode"
+      - "'identitiesonly no' not in slurp_ssh_config['content'] | b64decode"
       - "'controlmaster auto' not in slurp_ssh_config['content'] | b64decode"
       - "'controlpath ~/.ssh/sockets/%r@%h-%p' not in slurp_ssh_config['content'] | b64decode"
       - "'controlpersist yes' not in slurp_ssh_config['content'] | b64decode"