improve ssh key managenent

defaults/main.yml

@@ -5,3 +5,6 @@ win_sshd_pubkeys:
   - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAG65EdcM+JLv0gnzT9LcqVU47Pkw0SqiIg7XipXENi8 l3d'
   - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPvvXN33GwkTF4ZOwPgF21Un4R2z9hWUuQt1qIfzQyhC l3d'
   - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAIAQDFziTFj+iUnReuEk6wDabXUN4yuSlqIl+4THEoTYeZ9S/cGqm6/LkchaoIVXy4HpY/CwoKWzbOxh14oRFE7+Ak6PgYt0D8YdhXhEQqV/ZIW7qp/HL25dKIom40xAkSU8Hff/dd0EUeqbSoGqKGPsxY4Hw0u6Wkg48SDorXn2YT9raAolZsJelyR+VQrIpAidXLjvFbSP0k5CQ/aHJg9M6dW+JoF3wl+rPSO1lQRb5OntKLO9/34qNO2311l7N9SmN06LGikTEoWRy8bds3ATeiNYEaRs1OFnc/cK9EH739Haq9bzG2m4EWEbLNT84fdwdWlPbRiCk391h5N/zmTdW5Hlth6GxllI2XQqOnfjXICw+SQQCbX2qMea1Ci94IlrfUOSDaV1aJgVe2Dxl218OXn5I5C81KstVy1GYoEvfXZZFyRf+0EBbiPy2mWb/H//U9fTIjZrHkjG3swEqkVBRM2QqY+5nD959HtjbkJEV0cNPRAF+3deTXPiNafbJepOheBTbiO+G06B0vnT6WiVfW7Qpfl6NEcNrqeb1Ddr93O2y6fvdMJvx/CFtRuFmQKx7tkHC5mDrA8zS+O405i5zpSnYoN7YLGVkpc94XLXOyc00JChF66Zm78EW/65/2R4FuHfwkbmrsTcwyGfGTAE3riKl3OrWI24/TBtN2NZtISxibMnuxKDgz3VawF1WXXArWhZsgQSz+z2wHWpyJfzyrBdmF7WG5058KMSf1WMIS6tY9ZFfRGd+IEHyP4wb2jqXZmDxu9tYWB6naPutZVNULzwK0hkrIYIqnG8U4w2NS+urfOQ/9o3riT6Zan33GH5S5ot9iCLPTQJmB/0detUFp6/aJcvAslyWMLC8eqrzp2lqgRfMPOc0nqLtIVxRN37k9htn1UFyovfETjueICeu8diSSiNLv1W2yHWTPqZTxSKIyqGoLHFq6QwAHGDD9ALj/NPdoAC6ITGOYlVsff3ginX6y3J+RK2B2i9JRGdJZcLmcqqV5nkbRlUjoIGIDe0bXXJooUnNhD9ig6Vp1LeLdVMqdMDkHe0PtQdcfnlhNrLHZsFuJU/2wCdNtiA9f5m94V8k/XFJgX1T5uwq4hFMJH9IFXrj9d+ozZiEHlK/s9kG58toAWkZY33ai74hiCU3grePc+mYFCVe5NECIMXb6dSnEsLmp9noskntLc2jNeEORXCA20VPse8RQ86F5dH3Un5XCaqoB26+63delh5LhHDsIr4tgfQmq4ycJoZeZDz8afD9xyWRbdcmqmvtuJzeoWTbpS7ouuojS/rS3LGhoPZv4bsgPwNNKkJu1fZY1irhkM559Ce00wux/oOJd8MMKHPmEzMgFe9HzzqxwifbKgR0nQo49lCSUhozEhlMr75FSkZWNNaa1W/7MNQOtgv5nsxEZFsRs0uRcG1Gs4kBpaCLNFYuw4c3m/ZuZn2d4YZVRM1cpZuanyDTUR6+025LfqhsesB7ui6UikTLaeGGvRG/MkVoZVu4TluYrqyjiF589NNMRKBrENz4FLjo7zx01rIUrEvqLgUvxciD1NrYqPRWwCfvQ8SCGd5urCO8TbDnU0RywykvFJlybKQndiTReh/gtso3TyZYZ237NZlNcFuWjEO4U5JMZI7oE58yt33UE9GPDrTib3rjPyfjbdc1FuW42TcOzeO2SKfuw0UCE5KnzzJuLdhjHGOhqmT8mfm+jaLlxvQKUqWNV3GUA0sD57jfTC/EBvMaL2EZ9Sv1k3+d/jfyweYSUYKwHdvgvIOPcNAp6mY2IHPIO/fYYuO2pnkuW0fF5XsZipSa9j7Xj4YeIS+n4XQ5mjwLmj+GJFOa0bicm4nX8LHYvurqFXOnFvLenWjeMmyXomQ281wusWRcX8QaeOIr51IXhdbNry2vb80cjmFa9wxya2Egipoar7q2/nun1oRvPuwCEXvNqJWSYZLm/2NWG7CXSpuTEs9AdMTp61VMtx9c4XtK+3tIpSNOpa1dF9sMefv5WEms7+asjUBk8YCtiE3gvkQzpRh7oSKQIMS4R2gQT5FlQw++/A00Ii4nwDVaDEKCSpeiycfyAev3/QVltWc0us6Ze9Wemsye/j78YP9kWW8aAmem7jxa0kxqx6lrrc/P01Bur4EnnTIa0k7I7RWHEEc/LdPTHa4gcoIWpsxBGv+5D2pYe8Wj88WBoXTI+HfyqbxwRouVTc9sFtgatS55lGSR5rdSGkR0U9qYE8ZZUM/cVbjWirwtcsAnj8Ji0A5duAbtqdRzkCvWPmJpNX3ZL8uz+VwgKhEIlCF2+NF8y2HSHgvylbg1BcO59gqr27Ze5qhYzrSAkVdyboWNUbe/x21w71WBZjT1j/AKKYocdG3KKpsetQx6XoFaA4++t+riYZpsNIZqQJLXUKIDQQbau9eME+6sTpMRjQrckB6c4jQKSXDBNIOpPBSemm+f0EFl1i3z4/CZetCgX6xYmQaDxJ0Xdb2mJEo1kfZ5qK/+VCkyhYlVAOaYHYxJ6qigv1Sa5ecGzP77amIlhbdtnCGcLa63JyFik6QyYP44sXo+TRiTO5urjTfMq3RWL39NJ0wbqLNyol3NdS36LG++IKviBD81gl6E0gJE3USgBwhVAxYHxfig+HCr1DCcrV8mU+tre7T63yZCWB9/l2U+SRjKYkMDs7oPU32blKfCiTlZiLqZBy1lWqGk04s/s6BwDszPxw3prmchkkriB3CgGhhha/FCn0Q== l3d@'
+
+win_sshd_otheruserkeys: false
+win_sshd_otheruser: 'voc'

handlers/main.yml

@@ -1,3 +1,11 @@
 ---
 - name: 'Install SSH Keys'
   ansible.windows.win_shell: '.ansible\ssh_keys.ps1'
+
+- name: 'Install SSH User Keys'
+  ansible.windows.win_shell: 'C:\Users\{{ win_sshd_otheruser }}\.ansible\ssh_userkeys.ps1'
+  become: true
+  become_method: runas
+  become_user: "{{ win_sshd_otheruser }}"
+  vars:
+    ansible_become_pass: '{{ win_sshd_otherusepassword }}'

tasks/main.yml

@@ -7,3 +7,7 @@
 
 - name: Add OpenSSH Pubkey Access
   ansible.builtin.include_tasks: pubkeys.yml
+
+- name: Add OpenSSH Pubkey Access for user
+  ansible.builtin.include_tasks: 'other_user_pubkeys.yml'
+  when: win_sshd_otheruserkeys | bool

tasks/other_user_pubkeys.yml

@@ -0,0 +1,30 @@
+---
+- name: Create .ansible folder
+  ansible.windows.win_powershell:
+    script: "[System.IO.Directory]::CreateDirectory('{{ item }}')"
+  changed_when: _fw.changed
+  become: true
+  become_method: runas
+  become_user: "{{ win_sshd_otheruser }}"
+  vars:
+    ansible_become_pass: '{{ win_sshd_otherusepassword }}'
+  with_items:
+    - 'C:\Users\{{ win_sshd_otheruser }}\.ansible'
+
+- name: Create .ansible folder
+  ansible.windows.win_powershell:
+    script: "attrib +h {{ item }}"
+  changed_when: _fw.changed
+  become: true
+  become_method: runas
+  become_user: "{{ win_sshd_otheruser }}"
+  vars:
+    ansible_become_pass: '{{ win_sshd_otherusepassword }}'
+  with_items:
+    - 'C:\Users\{{ win_sshd_otheruser }}\.ansible'
+
+- name: Prepare Pubkey PS1 Script
+  ansible.windows.win_template:
+    src: 'templates/ssh_userkeys.ps1'
+    dest: 'C:\Users\{{ win_sshd_otheruser }}\.ansible\ssh_userkeys.ps1'
+  notify: 'Install SSH User Keys'

templates/ssh_keys.ps1

@@ -12,6 +12,6 @@ $content | Set-Content -Path "$Env:ProgramData\ssh\administrators_authorized_key
 
 # Write Public key to file for user access
 [System.IO.Directory]::CreateDirectory("$env:USERPROFILE\.ssh")
-$content | Set-Content -Path "$env:USERPROFILE\.ssh\authorized"
+$content | Set-Content -Path "$env:USERPROFILE\.ssh\authorized_keys"
 
 echo "Writing SSH Keys successful"

templates/ssh_userkeys.ps1

@@ -0,0 +1,13 @@
+# {{ ansible_managed }}
+# Variable for PS1
+$content = @"
+{% for pubkey in win_sshd_pubkeys %}
+{{ pubkey }}
+{%endfor %}
+"@
+
+# Write Public key to file for user access
+[System.IO.Directory]::CreateDirectory("$env:USERPROFILE\.ssh")
+$content | Set-Content -Path "$env:USERPROFILE\.ssh\authorized_keys"
+
+echo "Writing SSH Keys successful"