Search code examples
ansiblessh-keyswindows-subsystem-for-linux

SSH private key format for Ansible used in Windows Subsystem for Linux (using PuttyGen to generate the key pair)

I try to learn/use Ansible for setting up my new server. Control Machine is a Windows PC. I use Debian in the Windows Subsystem for Linux and have successfully installed ansible. I can connect to the server (real Debian) using putty with a (password protected) private key (I copied the public key to the server on creation (it's a Hetzner cloud server)). But when I try to run ansible -m ping all I get 

server5 | UNREACHABLE! => {
    "changed": false,
    "msg": "not a valid OPENSSH private key file",
    "unreachable": true
}

I generated the private key by exporting it with puttygen.
After exporting it with "force new file format" I got

server5 | UNREACHABLE! => {
    "changed": false,
    "msg": "Invalid/incorrect username/password. Private key file is encrypted",
    "unreachable": true
}

So I generated a private key file without passphrase to see if this helps. This private key also works within putty but ansible prints:

server5 | UNREACHABLE! => {
    "changed": false,
    "msg": "Invalid key",
    "unreachable": true
}

The content of the hosts file:

server5 ansible_host=xxx.xx.xx.xx ansible_user=root ansible_ssh_private_key_file=prikey.pem

The key file looks like this

-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----

And like this if exported with "force new file format"

-----BEGIN OPENSSH PRIVATE KEY-----
...
-----END OPENSSH PRIVATE KEY-----

Any idea what I do wrong?

Solution

  • The necessary steps using the constellation Ansible, WinSubSystemLinux and Putty

    1. Load your private key file in PuttyGen (or generate one)
      • remove the passphrase if there is one!
    2. Menu Conversions->Export OpenSSH Key
      • NOT "force new file format"
      • this will ask you "are you sure to save without password?" -> yes

    That's the file you can use in ansible.

    The rest is independent of putty.

    • You can find the generated key file in the Linux subsystem at /mnt/hd/path/to/file.pem
    • Copy it for example to ~/.ssh/yourkeyfile
    • chmod 400 ~/.ssh/yourkeyfile to only make it readable by your user. Otherwise, ansible will not connect showing "It is required that your private key files are NOT accessible by others. This private key will be ignored."

    In your inventory/hosts file, eg:

    serverx ansible_host=xxx.xxx.xxx.xxx ansible_ssh_private_key_file=~/.ssh/yourkeyfile