Automating Threat Intelligence series
May 04, 2025
Ansible with a bastion host (SSH Proxy)
On some Ansible designs, I need to use a bastion host to log in to remote servers. We can configure it in the following way:
on ansible.cfg file:
[defaults]
timeout = 25
gathering = smart # utile ma non essenziale
[ssh_connection]
#ssh_args = -o ControlMaster=auto -o ControlPersist=600s
ssh_args = -o ControlMaster=auto -o ControlPersist=600s -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=nocontrol_path = %(directory)s/%%h-%%r
pipelining = True
on the inventory file:
vars:
ansible_ssh_common_args: '-o ProxyCommand="sshpass -p passwordcomplessa ssh -W %h:%p -q remoteuser@bastionhost"'
Additional notes:
- Passwords sent through
sshpassare visible to all users usingps -acommand. - Prefer key authentication with the bastion host.