DEV Community

Cover image for Ansible for Beginners: Ansible Passwordless SSH Setup on AWS EC2 (Step-by-Step for Beginners)
Ritesh Singh
Ritesh Singh

Posted on

Ansible for Beginners: Ansible Passwordless SSH Setup on AWS EC2 (Step-by-Step for Beginners)

#ansible #aws #devops #ssh

🧠 Ansible Setup with Passwordless SSH (Private Key Method)

This guide walks you through a clean Ansible setup using a dedicated ansible user, passwordless sudo, and private key authentication (no password prompt).

This setup allows your control node to manage multiple EC2 instances without entering passwords every time, making automation smooth and efficient. Perfect for beginners wanting hands-on practice with Ansible and AWS

🚀 Architecture Overview

Role OS Description
Control Node Amazon Linux Runs Ansible and manages other nodes
Managed Nodes Amazon Linux / Ubuntu Machines managed by Ansible

🧩 Step 1 — Create Ansible User on All Nodes

On each node (Control + Managed): 

sudo adduser ansible
sudo passwd ansible
Enter fullscreen mode Exit fullscreen mode

Add ansible to sudoers: 

sudo visudo
Enter fullscreen mode Exit fullscreen mode 


ansible ALL=(ALL) NOPASSWD:ALL
Enter fullscreen mode Exit fullscreen mode


Add this line at the end: After adding press ctrl+o then enter then ctrl+x

💡 This gives passwordless sudo access to the ansible user.

🔐 Step 2 — Configure SSH on (Managed+ controle) Nodes

Edit /etc/ssh/sshd_config on each managed node:

sudo vi /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

Uncomment or add the following lines:

PermitRootLogin no
PasswordAuthentication yes
PubkeyAuthentication yes
ChallengeResponseAuthentication no
Enter fullscreen mode Exit fullscreen mode

Then restart SSH:

  • On Amazon Linux: 
  sudo systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

  • On Ubuntu: 
  sudo systemctl restart ssh
Enter fullscreen mode Exit fullscreen mode

🧰 Step 4 — Install Ansible (Control Node Only)

On control node (Amazon Linux):

sudo yum install python3-pip -y
Enter fullscreen mode Exit fullscreen mode 
sudo pip3 install ansible
Enter fullscreen mode Exit fullscreen mode 
ansible --version
Enter fullscreen mode Exit fullscreen mode

Verify:

ansible --version
Enter fullscreen mode Exit fullscreen mode

🔑 Step 5 — Generate SSH Key Pair on Control Node

Switch to ansible user on control node:

sudo su - ansible
Enter fullscreen mode Exit fullscreen mode

Generate SSH keys:

ssh-keygen -t rsa -b 2048
Enter fullscreen mode Exit fullscreen mode


Press Enter for all prompts to accept defaults (no passphrase).

You’ll get:

/home/ansible/.ssh/id_rsa      (private key)
 /home/ansible/.ssh/id_rsa.pub  (public key)
Enter fullscreen mode Exit fullscreen mode

📤 Step 6 — Copy SSH Key to Managed Nodes (Passwordless Setup)

Use this command on the control node:

ssh-copy-id ansible@<managed_node_private_ip>
Enter fullscreen mode Exit fullscreen mode


You’ll enter the password of the ansible user only once.

Repeat for each managed node.

Example:

ssh-copy-id ansible@172.31.29.148
ssh-copy-id ansible@172.31.18.225
Enter fullscreen mode Exit fullscreen mode

✅ Now test:

ssh ansible@172.31.29.148
Enter fullscreen mode Exit fullscreen mode


If it logs in without asking password, passwordless SSH is working perfectly.

🧭 Step 7 — Verify Setup with Ansible Ping

Create an inventory file /home/ansible/hosts:

use this command under /home/ansible directory

sudo vi hosts
Enter fullscreen mode Exit fullscreen mode 


[web]
172.31.29.148 

[dev]
172.31.18.225
Enter fullscreen mode Exit fullscreen mode

Now test connection:

ansible all -i hosts -m ping
Enter fullscreen mode Exit fullscreen mode


Expected output:

172.31.29.148 | SUCCESS => {
    "changed": false,
    "ping": "pong"
}
172.31.18.225 | SUCCESS => {
    "changed": false,
    "ping": "pong"
}
Enter fullscreen mode Exit fullscreen mode

✅ Verification Checklist

Step Check
ansible user exists on all nodes ✅
Passwordless sudo enabled ✅
SSH passwordless login (private key) works ✅
/etc/ssh/sshd_config updated and SSH restarted ✅
Ansible ping successful ✅

🧩 Bonus Tip — Test with Ad Hoc Command 

ansible all -i hosts -m shell -a "hostname"
ansible all -i hosts -m shell -a "uptime"
Enter fullscreen mode Exit fullscreen mode

If you see hostnames and uptime output — congratulations 🎉
Your Ansible setup with private key passwordless access is ready!

🧾 Notes

  • Private key (id_rsa) always stays on the control node
  • Public key (id_rsa.pub) is copied to managed nodes’ ~/.ssh/authorized_keys
  • Never share or upload your private key to any other system...

❤️ Follow My DevOps Journey

Ritesh Singh

🌐 LinkedIn | 📝 Hashnode | GITHUB

Top comments (0)