Stage 4 · Provision
Ansible Fundamentals
SSH & Privilege Escalation
Keys, become/sudo, connection plugins, and ansible.cfg essentials.
SSH Key Setup
Ansible connects to managed nodes via SSH by default. SSH key authentication is preferred over passwords — it is more secure and does not require interactive prompts during automation.
# Generate a key pair for Ansible
ssh-keygen -t ed25519 -C "ansible-control" -f ~/.ssh/ansible_key
# Copy to a managed node
ssh-copy-id -i ~/.ssh/ansible_key.pub deploy@web1.example.com
# Test the connection
ssh -i ~/.ssh/ansible_key deploy@web1.example.comEd25519 keys are faster and more secure than RSA. Use them unless your infrastructure requires older key types.
Connection Plugins
Ansible supports multiple connection methods. SSH (ssh) is the default, but others exist for different scenarios — local execution, Windows hosts, or container environments.
| Plugin | Use Case | Configuration |
|---|---|---|
| ssh | Default for Linux/Unix | inventory_host:22 |
| local | Control node only | connection: local |
| winrm | Windows hosts | port: 5986, use_ssl: yes |
| docker | Containers | connection: community.docker.docker |
Become Configuration
The become directive handles privilege escalation. It supports sudo, su, pbrun, pfexec, doas, and other methods depending on your environment.
# Global become for all tasks
- name: Configure servers
hosts: all
become: yes
tasks:
- name: Install packages
package:
name: nginx
# Per-task become
- name: Mixed privilege tasks
hosts: all
tasks:
- name: Check disk
command: df -h
# No become needed
- name: Install nginx
package:
name: nginx
become: yesApply become at the play level for consistent privilege escalation. Use per-task become when only some tasks need root.
SSH Pipelining
Pipelining reduces the number of SSH connections Ansible makes by sending multiple commands in one connection. It significantly improves performance on large inventories.
[ssh_connection]
pipelining = True
# Also requires on managed nodes:
# Defaults !requiretty in /etc/sudoersPipelining requires that requiretty is disabled in the sudoers file on managed nodes. Without this, pipelining fails with a sudo error.
Pipelining can reduce playbook runtime by 30-50% on large inventories. It eliminates the overhead of multiple SSH handshakes and module transfers.
Troubleshooting SSH
# Verbose output (up to -vvvv)
ansible all -m ping -vvvv
# Test SSH directly
ssh -vvv deploy@web1.example.com
# Check SSH config
ansible all -m debug -a "msg={{ ansible_ssh_common_args }}"
# Force specific SSH binary
ANSIBLE_SSH_EXECUTABLE=/usr/local/bin/ssh ansible all -m pingUse increasing verbosity levels (-v, -vv, -vvv, -vvvv) to diagnose SSH, authentication, and Python issues.
By default, Ansible checks SSH host keys. In development or cloud environments, you may disable this with host_key_checking = False in ansible.cfg. Never disable it in production without understanding the security trade-off.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.