CertGrid CertGrid
Configuration·Python Automation for IT

Python SSH Keys and Host Inventory

An unattended script needs a key with no passphrase, which sounds careless until you see what authorized_keys can restrict it to - a key that can run one command and nothing else. Then the other half: one inventory file that says what exists, so adding a host is one line rather than an edit to every script. Including the ssh_config mistake I made while writing this, which silently discards every specific setting.

Remote Hosts and CI/CD Guide 32 of 39 Intermediate

restrict in authorized_keys needs OpenSSH 7.2 or later and is the sensible default - it turns off everything and lets you add back what you need. paramiko.SSHConfig.from_path needs paramiko 2.7.

One control node and two managed hosts. The targets keep the hostnames the RHCSA path gave them - they are ordinary Linux boxes reachable over SSH, and nothing here is Red Hat specific.
Server NameIP AddressOSRolesCPURAMHDD
RUNNER01192.168.0.27Ubuntu 26.04 LTSControl node - every script in this path runs here2 Core4 GB50 GB
RHCSA-A01192.168.0.31RHEL 10.0Managed host - reached over SSH from the control node2 Core4 GB50 GB
RHCSA-B01192.168.0.33RHEL 10.0Second managed host - so an inventory has more than one row2 Core4 GB50 GB

This guide includes

Use this before any unattended script logs into anything. This matters because a passphrase-less key sounds careless until you restrict what it may do - the same key with and without that restriction is two very different risks.

Before you start

  1. A key made for one job

  2. The key on disk

  3. What a key is allowed to do

  4. And the same key with no restriction

  5. An inventory, in one file

  6. An inventory that is wrong

  7. The config file ssh already reads, and the trap in it

  8. And using it to connect

  9. A key with a passphrase

  10. Or let an agent hold it

  11. The inventory driving a real loop

  12. And a service that is not there

Official sources

← All Python Automation guides