Forge Home


sshkeys puppet module


33,425 latest version

3.9 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 2.1.0 (latest)
  • 2.0.1
  • 1.0.0
  • 0.5.0
released Mar 11th 2015

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'jtopjian-sshkeys', '2.1.0'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add jtopjian-sshkeys
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install jtopjian-sshkeys --version 2.1.0

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.

Tags: ssh, puppetdb


jtopjian/sshkeys — version 2.1.0 Mar 11th 2015

sshkeys puppet module

The sshkeys puppet module creates, shares, and installs SSH keys.


This module recently went through a large change and is not compatible with previous versions.

You can access the old version in the v1 branch or the 1.0.0 tag.

How it works

This module contains two facts:


This fact publishes all default SSH keys for all users found in /etc/passwd.

By using PuppetDB, all keys are then recorded in the database. Other nodes (and tools) are then able to query PuppetDB and obtain the public key for the user.


This fact publishes the homedir for all users found in /etc/passwd. This fact is used to help locate a certain user's home directory.

In addition to those two facts, an optional third fact can be created:

$ cat /etc/facter/facts.d/homedir_users.yaml
  - root
  - jdoe

If this fact exists, then only the users specified will have their home directory and ssh public key exported via facter. This is useful in cases where /home is automounted and parsing all users will mount all home directories. It's also useful if you just don't want everyone's public key exported.


  • Only the default id_rsa or id_dsa public key is shared -- this module is unable to handle multiple keys at this time.
  • Users are expected to be managed outside of this module.


Create a SSH key for a user (this is optional):

sshkeys::create_ssh_key { 'root':
  ssh_keytype => 'dsa',

The default bit lengths are 2048 for rsa and 1024 for dsa. To override the defaults, use the ssh_bitlength parameter.

Once created, Facter will expose the public key via the fact sshpubkey_root.

To allow root@server1 to access root@server2:

sshkeys::set_authorized_key { 'root@server1 to root@server2':
  local_user  => 'root',
  remote_user => 'root@server1',

Now, root@server2 will have root@server1's public key added to its ~/.ssh/authorized_keys file thus allowing root@server1 to log into server2 as root without a password.


This module requires:


This module was lightly based off of Boklm's module. I used this module frequently before changing to a PuppetDB/Facter-based solution. Some of the code was used in my version.