Ansible Auth, Install & Passwordless SSH

Authentication options

Passwordless means: from the control node you run ssh ubuntu@managed-ip with no password and no -i pem — the control node’s private key authenticates.

Install Ansible on the control node

From your laptop, SSH into the control node, then:

sudo apt update
sudo apt install -y ansible
ansible --version

Generate SSH keys on the control node

On the control node:

ssh-keygen -t ed25519 -C "ansible-control"
# press Enter for defaults (empty passphrase for labs)
ls ~/.ssh/
# id_ed25519      (private)
# id_ed25519.pub  (public)

Copy managed-node PEMs to the control node (bootstrap)

You still need the original EC2 .pem files once, to place the control node’s public key on each managed host.

From your laptop:

scp -i control-node.pem managed-node-1.pem ubuntu@<CONTROL_IP>:~/
scp -i control-node.pem managed-node-2.pem ubuntu@<CONTROL_IP>:~/

On the control node:

chmod 400 ~/managed-node-1.pem ~/managed-node-2.pem

Install the control node public key on managed nodes

On the control node:

ssh-copy-id -i ~/.ssh/id_ed25519.pub -o IdentityFile=~/managed-node-1.pem ubuntu@<MANAGED_1_IP>
ssh-copy-id -i ~/.ssh/id_ed25519.pub -o IdentityFile=~/managed-node-2.pem ubuntu@<MANAGED_2_IP>

If ssh-copy-id is unavailable, manually append ~/.ssh/id_ed25519.pub into each managed node’s ~/.ssh/authorized_keys, then:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Test passwordless SSH

From the control node (no -i, no password):

ssh ubuntu@<MANAGED_1_IP>
ssh ubuntu@<MANAGED_2_IP>

First inventory + ping

On the control node:

# inventory.ini
[web]
prod-managed-node-1 ansible_host=<MANAGED_1_IP>
prod-managed-node-2 ansible_host=<MANAGED_2_IP>
 
[web:vars]
ansible_user=ubuntu

ansible all -i inventory.ini -m ping

Expected: SUCCESS / "ping": "pong" for each host.

Production flow

Laptop → Control Node (Ansible)
              ↓ passwordless SSH
         Managed Nodes