- **ecdsa**

  Values for each key should be the corresponding private key

  generated using the appropriate algorithm. Keys for this purpose can

  be easily created via commands::

    ssh-keygen -f backup_server_rsa_key -N '' -t rsa

    ssh-keygen -f backup_server_ed25519_key -N '' -t ed25519

    ssh-keygen -f backup_server_ecdsa_key -N '' -t ecdsa

Distribution compatibility

        public_key: "{{ lookup('file', inventory_dir + '/ssh/web.example.com.pub') }}"

        ip: 10.32.64.18

      - server: mail.example.com

        public_key: "{{ lookup('file', inventory_dir + '/ssh/mail.example.com.pub') }}"

        ip: 10.32.64.15

    backup_host_ssh_private_keys:

      rsa: "{{ lookup('file', inventory_dir + '/ssh/backup_server_rsa_key') }}"

      ed25519: "{{ lookup('file', inventory_dir + '/ssh/backup_server_ed25519_key') }}"

      ecdsa: "{{ lookup('file', inventory_dir + '/ssh/backup_server_ecdsa_key') }}"

Backup Client

    backup_additional_encryption_keys: "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...\n-----END PGP PUBLIC KEY BLOCK-----"

    backup_client_username: "user"

    backup_encryption_key: "-----BEGIN PGP PRIVATE KEY BLOCK-----\n...\n-----END PGP PRIVATE KEY BLOCK-----"

    backup_server: "backup.example.com"

    backup_server_destination: "//example/host"

    backup_server_host_ssh_public_keys:

      - "{{ lookup('file', inventory_dir + '/ssh/backup_server_ecdsa_key.pub') }}"

      - "{{ lookup('file', inventory_dir + '/ssh/backup_server_ed25519_key.pub') }}"

      - "{{ lookup('file', inventory_dir + '/ssh/backup_server_rsa_key.pub') }}"

    backup_server_port: 22

    backup_ssh_key: "{{ lookup('file', inventory_dir + '/ssh/web.example.com') }}"

   :file:`~/mysite/group_vars/backup.yml`

   ::

      ---

      backup_host_ssh_private_keys:

        rsa: "{{ lookup('file', inventory_dir + '/ssh/bak_rsa_key') }}"

        ed25519: "{{ lookup('file', inventory_dir + '/ssh/bak_ed25519_key') }}"

        ecdsa: "{{ lookup('file', inventory_dir + '/ssh/bak_ecdsa_key') }}"

3. Since we have decided to specify the keys above through file lookup, the

   above-listed keys now need to be generated::

     ssh-keygen -f ~/mysite/ssh/bak_rsa_key -N '' -t rsa

     ssh-keygen -f ~/mysite/ssh/bak_ed25519_key -N '' -t ed25519

     ssh-keygen -f ~/mysite/ssh/bak_ecdsa_key -N '' -t ecdsa

Adding backup clients

   ::

      enable_backup: yes

      backup_encryption_key: "{{ lookup('pipe', 'gpg --homedir ~/mysite/gnupg/ --armour --export-secret-keys ' + ansible_fqdn ) }}"

      backup_server: bak.example.com

      backup_server_host_ssh_public_keys:

        - "{{ lookup('file', inventory_dir + '/ssh/bak_rsa_key.pub') }}"

        - "{{ lookup('file', inventory_dir + '/ssh/bak_ed25519_key.pub') }}"

        - "{{ lookup('file', inventory_dir + '/ssh/bak_ecdsa_key.pub') }}"

      backup_ssh_key: "{{ lookup('file', inventory_dir + '/ssh/' + ansible_fqdn) }}"

3. So, looking at the configuration up there, there is a couple of file lookups

backup_patterns_filename: "test"

# backup_client role parameters.

backup_encryption_key: "{{ lookup('file', 'tests/data/gnupg/parameters-mandatory.asc') }}"

backup_server: 10.31.127.10

backup_server_host_ssh_public_keys:

  - "{{ lookup('file', 'tests/data/ssh/server_rsa.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ed25519.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ecdsa.pub') }}"

backup_ssh_key: "{{ lookup('file', 'tests/data/ssh/parameters-mandatory' ) }}"

  - /var/log

# backup_client role parameters.

backup_encryption_key: "{{ lookup('file', 'tests/data/gnupg/parameters-optional.asc') }}"

backup_server: 10.31.127.10

backup_server_host_ssh_public_keys:

  - "{{ lookup('file', 'tests/data/ssh/server_rsa.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ed25519.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ecdsa.pub') }}"

backup_ssh_key: "{{ lookup('file', 'tests/data/ssh/parameters-mandatory' ) }}"

---

backup_encryption_key: "{{ lookup('file', 'tests/data/gnupg/parameters-mandatory.asc') }}"

backup_server: 10.31.127.10

backup_server_host_ssh_public_keys:

  - "{{ lookup('file', 'tests/data/ssh/server_rsa.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ed25519.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ecdsa.pub') }}"

backup_ssh_key: "{{ lookup('file', 'tests/data/ssh/parameters-mandatory' ) }}"

  - "{{ lookup('file', 'tests/data/gnupg/additional_encryption_key_3.asc') }}"

backup_client_username: backupuser

backup_encryption_key: "{{ lookup('file', 'tests/data/gnupg/parameters-optional.asc') }}"

backup_server: 10.31.127.10

backup_server_destination: "/duplicity/{{ inventory_hostname }}"

backup_server_host_ssh_public_keys:

  - "{{ lookup('file', 'tests/data/ssh/server_rsa.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ed25519.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ecdsa.pub') }}"

backup_server_port: 3333

backup_ssh_key: "{{ lookup('file', 'tests/data/ssh/parameters-optional' ) }}"

        content: "{{ lookup('file', item.key) + '\n' }}"

        dest: "{{ item.value }}"

        owner: root

        group: root

        mode: 0600

      with_dict:

        tests/data/ssh/server_rsa: /etc/ssh/ssh_host_rsa_key

        tests/data/ssh/server_ed25519: /etc/ssh/ssh_host_ed25519_key

        tests/data/ssh/server_ecdsa: /etc/ssh/ssh_host_ecdsa_key

      notify:

        - Restart ssh

# Use these options to restrict which interfaces/protocols sshd will bind to

#ListenAddress ::

#ListenAddress 0.0.0.0

Protocol 2

# HostKeys for protocol version 2

HostKey /etc/ssh/ssh_host_rsa_key

HostKey /etc/ssh/ssh_host_ecdsa_key

HostKey /etc/ssh/ssh_host_ed25519_key

#Privilege Separation is turned on for security

UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key

[10.31.127.10]:2222 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2SqbwZNanhTMM8wL1iGtNOR7nYbXcCQNbU65crXN43W1tz4GXoyluHEEXs0we7jmZZyow19X89Ve5w8ODL42KRDtNXoN8wjoLwZ1l7iGsrN1oUXJP7i6i9lH/0F+fudFB3Tm53ieBr0MEMdxAQBpk+MCi64G0iuvZeE0sKG5JfSky82ZZ26m5EchORJuiiKObB17EsUGl091S8eiLXIIiQQvg4d9933oAqNCLe0uxbNfJcbMJAdr+m9rYxyVoPXweUm1beb/6/vZQzAf0HL5+Ic/mbLu3z4httCh0dIlCqjRe/8llqF21psIlN8D8hZkzY6WEo7/v9wHAGFTFFFlJ

10.31.127.10 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2SqbwZNanhTMM8wL1iGtNOR7nYbXcCQNbU65crXN43W1tz4GXoyluHEEXs0we7jmZZyow19X89Ve5w8ODL42KRDtNXoN8wjoLwZ1l7iGsrN1oUXJP7i6i9lH/0F+fudFB3Tm53ieBr0MEMdxAQBpk+MCi64G0iuvZeE0sKG5JfSky82ZZ26m5EchORJuiiKObB17EsUGl091S8eiLXIIiQQvg4d9933oAqNCLe0uxbNfJcbMJAdr+m9rYxyVoPXweUm1beb/6/vZQzAf0HL5+Ic/mbLu3z4httCh0dIlCqjRe/8llqF21psIlN8D8hZkzY6WEo7/v9wHAGFTFFFlJ

[10.31.127.10]:2222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQzNj16lZ3ucIJvwnFYzR/vZT3SuWiIVPNOhK5JGlq6

10.31.127.10 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQzNj16lZ3ucIJvwnFYzR/vZT3SuWiIVPNOhK5JGlq6

[10.31.127.10]:2222 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLaZb8xcw5PbzQ8Jo8xygcUaI6ziGLs+ZqsAqJSOIou9iN0zSKO9a4ujbeMgIbfZZPB5UWcv1CxNekTZ4tkrAaM=

10.31.127.10 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLaZb8xcw5PbzQ8Jo8xygcUaI6ziGLs+ZqsAqJSOIou9iN0zSKO9a4ujbeMgIbfZZPB5UWcv1CxNekTZ4tkrAaM=

[10.31.127.10]:3333 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2SqbwZNanhTMM8wL1iGtNOR7nYbXcCQNbU65crXN43W1tz4GXoyluHEEXs0we7jmZZyow19X89Ve5w8ODL42KRDtNXoN8wjoLwZ1l7iGsrN1oUXJP7i6i9lH/0F+fudFB3Tm53ieBr0MEMdxAQBpk+MCi64G0iuvZeE0sKG5JfSky82ZZ26m5EchORJuiiKObB17EsUGl091S8eiLXIIiQQvg4d9933oAqNCLe0uxbNfJcbMJAdr+m9rYxyVoPXweUm1beb/6/vZQzAf0HL5+Ic/mbLu3z4httCh0dIlCqjRe/8llqF21psIlN8D8hZkzY6WEo7/v9wHAGFTFFFlJ

10.31.127.10 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2SqbwZNanhTMM8wL1iGtNOR7nYbXcCQNbU65crXN43W1tz4GXoyluHEEXs0we7jmZZyow19X89Ve5w8ODL42KRDtNXoN8wjoLwZ1l7iGsrN1oUXJP7i6i9lH/0F+fudFB3Tm53ieBr0MEMdxAQBpk+MCi64G0iuvZeE0sKG5JfSky82ZZ26m5EchORJuiiKObB17EsUGl091S8eiLXIIiQQvg4d9933oAqNCLe0uxbNfJcbMJAdr+m9rYxyVoPXweUm1beb/6/vZQzAf0HL5+Ic/mbLu3z4httCh0dIlCqjRe/8llqF21psIlN8D8hZkzY6WEo7/v9wHAGFTFFFlJ

[10.31.127.10]:3333 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQzNj16lZ3ucIJvwnFYzR/vZT3SuWiIVPNOhK5JGlq6

10.31.127.10 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQzNj16lZ3ucIJvwnFYzR/vZT3SuWiIVPNOhK5JGlq6

[10.31.127.10]:3333 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLaZb8xcw5PbzQ8Jo8xygcUaI6ziGLs+ZqsAqJSOIou9iN0zSKO9a4ujbeMgIbfZZPB5UWcv1CxNekTZ4tkrAaM=

10.31.127.10 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLaZb8xcw5PbzQ8Jo8xygcUaI6ziGLs+ZqsAqJSOIou9iN0zSKO9a4ujbeMgIbfZZPB5UWcv1CxNekTZ4tkrAaM=

---

backup_host_ssh_private_keys:

  rsa: "{{ lookup('file', 'tests/data/ssh/server_rsa') }}"

  ed25519: "{{ lookup('file', 'tests/data/ssh/server_ed25519') }}"

  ecdsa: "{{ lookup('file', 'tests/data/ssh/server_ecdsa') }}"

---

backup_host_ssh_private_keys:

  rsa: "{{ lookup('file', 'tests/data/ssh/server_rsa') }}"

  ed25519: "{{ lookup('file', 'tests/data/ssh/server_ed25519') }}"

  ecdsa: "{{ lookup('file', 'tests/data/ssh/server_ecdsa') }}"

backup_clients:

  - server: client1.backup

    ip: 10.31.127.1

    """

    Tests if the backup SSH server private keys have been deployed correctly.

    """

    with host.sudo():

        rsa = host.file('/etc/ssh-backup/ssh_host_rsa_key')

        assert rsa.is_file

        assert rsa.user == 'root'

        assert rsa.group == 'root'

        assert rsa.mode == 0o600

        assert rsa.content_string == open('tests/data/ssh/server_rsa', 'r').read()

# backup_client

backup_client_username: "bak-localhost"

backup_encryption_key: "{{ lookup('file', 'tests/data/gnupg/parameters-optional.asc') }}"

backup_server: localhost

backup_server_host_ssh_public_keys:

  - "{{ lookup('file', 'tests/data/ssh/server_rsa.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ed25519.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ecdsa.pub') }}"

backup_ssh_key: "{{ lookup('file', 'tests/data/ssh/parameters-optional' ) }}"

- hosts: backup-server

  become: true

  roles:

    - role: backup_server

      backup_host_ssh_private_keys:

        rsa: "{{ lookup('file', 'tests/data/ssh/server_rsa') }}"

        ed25519: "{{ lookup('file', 'tests/data/ssh/server_ed25519') }}"

        ecdsa: "{{ lookup('file', 'tests/data/ssh/server_ecdsa') }}"

      backup_clients:

        - server: localhost

          ip: 127.0.0.1

---

backup_host_ssh_private_keys:

  rsa: "{{ lookup('file', 'tests/data/ssh/server_rsa') }}"

  ed25519: "{{ lookup('file', 'tests/data/ssh/server_ed25519') }}"

  ecdsa: "{{ lookup('file', 'tests/data/ssh/server_ecdsa') }}"

backup_clients:

  - server: localhost

    ip: 127.0.0.1

# backup_client

enable_backup: true

backup_client_username: "bak-localhost"

backup_encryption_key: "{{ lookup('file', 'tests/data/gnupg/parameters-optional.asc') }}"

backup_server: localhost

backup_server_host_ssh_public_keys:

  - "{{ lookup('file', 'tests/data/ssh/server_rsa.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ed25519.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ecdsa.pub') }}"

backup_ssh_key: "{{ lookup('file', 'tests/data/ssh/parameters-optional' ) }}"

- hosts: backup-server

  become: true

  roles:

    - role: backup_server

      backup_host_ssh_private_keys:

        rsa: "{{ lookup('file', 'tests/data/ssh/server_rsa') }}"

        ed25519: "{{ lookup('file', 'tests/data/ssh/server_ed25519') }}"

        ecdsa: "{{ lookup('file', 'tests/data/ssh/server_ecdsa') }}"

      backup_clients:

        - server: localhost

          ip: 127.0.0.1

# backup_client (backup username should end in -s64 for Stretch).

enable_backup: true

backup_client_username: "bak-parameters-optional-{{ ansible_distribution_release[0] }}64"

backup_encryption_key: "{{ lookup('file', 'tests/data/gnupg/parameters-optional.asc') }}"

backup_server: ldap-server

backup_server_host_ssh_public_keys:

  - "{{ lookup('file', 'tests/data/ssh/server_rsa.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ed25519.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ecdsa.pub') }}"

backup_ssh_key: "{{ lookup('file', 'tests/data/ssh/parameters-optional' ) }}"

  - comment: URI

    option: URI

    value: ldapi:///

# backup_server role

backup_host_ssh_private_keys:

  rsa: "{{ lookup('file', 'tests/data/ssh/server_rsa') }}"

  ed25519: "{{ lookup('file', 'tests/data/ssh/server_ed25519') }}"

  ecdsa: "{{ lookup('file', 'tests/data/ssh/server_ecdsa') }}"

backup_clients:

  - server: parameters-optional-j64

# backup_client

enable_backup: true

backup_client_username: "bak-parameters-optional-{{ ansible_distribution_release }}"

backup_encryption_key: "{{ lookup('file', 'tests/data/gnupg/parameters-optional.asc') }}"

backup_server: backup-server

backup_server_host_ssh_public_keys:

  - "{{ lookup('file', 'tests/data/ssh/server_rsa.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ed25519.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ecdsa.pub') }}"

backup_ssh_key: "{{ lookup('file', 'tests/data/ssh/parameters-optional' ) }}"

  - comment: URI

    option: URI

    value: ldapi:///

# backup_server role.

backup_host_ssh_private_keys:

  rsa: "{{ lookup('file', 'tests/data/ssh/server_rsa') }}"

  ed25519: "{{ lookup('file', 'tests/data/ssh/server_ed25519') }}"

  ecdsa: "{{ lookup('file', 'tests/data/ssh/server_ecdsa') }}"

backup_clients:

  - server: parameters-optional-stretch

    ip: 10.31.127.33