Skip to content


The cake function baseline_ssh executes the Blunix Ansible role-ssh, which installs and configures the OpenSSH server installed on all Debian instances. Simplified, the role-ssh works as follows:

  • Configure /etc/ssh/sshd_config.d/ansible.conf
  • Create a Linux group "admins"
  • Creates Linux users and prepares their /home/<username>/ directory for convinient interaction by SSH login
  • Optionally accepts remote SSH host keys (,
  • Optionally removes Linux users


Key Value
Playbook path plays/baseline/ssh.yml
Config file Description
/etc/ssh/sshd_config.d/ansible.conf OpenSSH daemon configuration file, which overrides the Debian package maintainers /etc/ssh/sshd_config, which is NOT being modified!
~/.bashrc Configures pretty colors in BASH and alike
~/.bashrc.d/ All files in this directory are included by ~/.bashrc
~/.ssh/ SSH configuration directory for this user
~/.ssh/id_ed25519(.pub) SSH private and public key
~/.ssh/environment Environment variables defined when somebody logs in as this user from remote
~/.ssh/config SSH configuration for outgoing SSH sessions
~/.ssh/known_hosts Servers which the Linux user has previously connected to are saved here


Define the ssh public keys of employees in inventory/group_vars/all.yml:

    ssh_key: 'ssh-ed25519 ssh-public-key'
    ssh_key: 'ssh-ed25519 ssh-public-key'

Define the variables for role-ssh in inventory/group_vars/all.yml to manage Linux users and their SSH settings:


    # name of the (existing if create is not True) user
  - name: root

    # Create the user and its group if it is not present
    # Requires: group (default: name), home, uid and gid (default: uid)
    create: True

    # State of this user (present or absent, default: present)
    # State absent will remove the user and its group, however it will not delete the home directory
    state: present

    # Ansible is to retarded to determine a users home directory, hence...
    home: /root

    # name of the users primary group (for templating files) (Default: "name")
    group: root

    # Groups to put this user in
    # Note that the users own group will always be added to the list of groups, so you don't have to specify it here
      - games

    # Append groups to already present groups of this user or enforce listed groups, default: True
    append: False

    # User and group ID
    uid: "0"
    gid: "0"

    # Weather to make this a system user and group, default: True
    system: False

    # Specify login shell
    shell: /bin/bash

    # Give this user a nice default ~/.bashrc, default: False
    bashrc: True

    # Create /home/user/.bashrc.d/
      - name: test
        content: |
          alias foo=bar

    # Generate a ed25519 keypair, default: False
    generate_keypair: True

    # Setup key=value environment variables in ~/.ssh/environment

    # Manage $HOME/.ssh/config
        HostName: ''
        User: git
        IdentityFile: '~/.ssh/id_ed25519'
        IdentitiesOnly: 'yes'

    # Accept host keys to known_hosts

    # Pull a ssh public key from another instance and put it into authorized_keys
        # Ansible hostname
      - host: bullseye
        # Where to find the public key on this host
        path: /root/.ssh/

    # Populate authorized_keys
      # - key:
      #   options: 'no-port-forwarding,from=""'
      # - key: "{{ lookup('file', '/home/charlie/.ssh/') }}"
      #   # present or absent, default: present
      #   state: present
      - key: "ssh-ed25519 ssh-pubic-key"

  # Minimal config - just add a public key to ssh authorized_keys of an existing user
  - name: backuppc
    home: /var/lib/backuppc
      - key: "ssh-ed25519 ssh-pubic-key"

Different users

To manage different Linux users on server A then on server B, you should define a default ssh_users dictionary in inventory/group_vars/all.yml and append to it in inventory/group_vars/ or inventory/host_vars/.

Setup j.doe's and m.mustermann's ssh public key on all servers for the root user in inventory/group_vars/all.yml:

ssh_users: "{{ ssh_users_admins }}"
  - name: root
    home: /root
      - key: "{{ humans['j.doe']['ssh_key'] }}"
      - key: "{{ humans['m.mustermann']['ssh_key'] }}"

Additionally setup a Linux user "myapp" and add developers public keys in inventory/group_vars/cus_www_prod_web:

ssh_users: "{{ ssh_users_admins + ssh_users_myapp }}"
  - name: myapp
    group: myapp
      - www-data
    create: True
    uid: 3000
    append: False
    home: /var/www/myapp
      - key: "{{ humans['j.doe']['ssh_key'] }}"
      - key: "{{ humans['m.mustermann']['ssh_key'] }}"
      - key: "{{ humans['t.atkins']['ssh_key'] }}"
      - key: "{{ humans['j.soap']['ssh_key'] }}"
    bashrc: True

ssh_sshd_config_AllowGroups: "root admins myapp"


Stream ssh logs on the cus-util-prod-log-1:

journalctl --file /var/log/journal/remote/all.journal -f _HOSTNAME=cus-www-prod-web-2 _COMM=sshd