Ansible throwing "Failed to connect to the host via ssh: Permission denied (publickey)." error with remote connections

Question

I have the following playbook:

- hosts: localhost
  connection: local
  remote_user: test
  gather_facts: no

  vars_files:
    - files/aws_creds.yml
    - files/info.yml

  environment:
    AWS_ACCESS_KEY_ID: "{{ aws_id }}"
    AWS_SECRET_ACCESS_KEY: "{{ aws_key }}"
    s3cmd_access_key: "{{ aws_id }}"
    s3cmd_secret_key: "{{ aws_key }}"

  tasks:
    - name: Basic provisioning of EC2 instance
      ec2:
        assign_public_ip: no
        aws_access_key: "{{ aws_id }}"
        aws_secret_key: "{{ aws_key }}"
        region: "{{ aws_region }}"
        image: "{{image_instance }}"
        instance_type: "{{ free_instance }}"
        key_name: "{{ ssh_keyname }}"
        count: 3
        state: present
        group_id: "{{ secgroup_id }}"
        vpc_subnet_id: "{{ private_subnet_id }}"
        wait: no
        instance_tags:
          Name: Dawny33Template
        #delete_on_termination: yes
      register: ec2


    - name: Add new instance to host group
      add_host:
        hostname: "{{ item.private_ip }}"
        groupname: launched
      with_items: "{{ ec2.instances }}"

    - name: Wait for SSH to come up
      wait_for:
        host: "{{ item.private_ip }}"
        port: 22
        delay: 60
        timeout: 320
        state: started
      with_items: "{{ ec2.instances }}"

- hosts: launched
  sudo: true
  remote_user: test
  gather_facts: yes

  vars_files:
    - files/aws_creds.yml
    - files/info.yml

  environment:
    AWS_ACCESS_KEY_ID: "{{ aws_id }}"
    AWS_SECRET_ACCESS_KEY: "{{ aws_key }}"
    s3cmd_access_key: "{{ aws_id }}"
    s3cmd_secret_key: "{{ aws_key }}"

  tasks:
    - name: Add file system for the volume
      command: mkfs -t ext4 /dev/xvdb
      sudo: yes

    - name: Create a directory for mounting
      command: mkdir /home/ec2-user/EncryptedEBS

    - name: Mount the volume
      command: mount /dev/xvdb /home/ec2-user/EncryptedEBS
      sudo: yes

    - name: Owning the mounted folder
      command: chown ec2-user /home/ec2-user/EncryptedEBS/lost+found/
      sudo: yes

    - name: check out a git repository
      git: repo={{ repo_url }} dest=/home/ec2-user/EncryptedEBS/GitRepo accept_hostkey=yes force=yes
      vars:
        repo_url: https://github.com/Dawny33/AnsibleExperiments
      become: yes


    - name: Go to the folder and execute command
      command: chmod 0755 /home/ec2-user/EncryptedEBS/GitRepo/processing.py
      become: yes
      become_user: root

    - name: Run Py script
      command: /home/ec2-user/EncryptedEBS/GitRepo/processing.py {{ N }} {{ bucket_name }}
      become: yes
      become_user: root

However, I get the "Permission denied" error, when Ansible tries to connect to my remote hosts, even though I have defined the env. variables in environment

Is there anything which I did wrong here?

Error:

fatal: [10.0.1.62]: UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: Permission denied (publickey).\r\n",
    "unreachable": true
}
fatal: [10.0.1.177]: UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: Permission denied (publickey).\r\n",
    "unreachable": true
}
fatal: [10.0.1.151]: UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: Permission denied (publickey).\r\n",
    "unreachable": true
}

Adding the complete -vvv output:

Using module file /usr/local/lib/python2.7/site-packages/ansible/modules/core/system/setup.py
<10.0.1.170> ESTABLISH SSH CONNECTION FOR USER: ec2-user
Using module file /usr/local/lib/python2.7/site-packages/ansible/modules/core/system/setup.py
<10.0.1.11> ESTABLISH SSH CONNECTION FOR USER: ec2-user
<10.0.1.170> SSH: EXEC ssh -o ForwardAgent=yes -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 10.0.1.170 '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-137345507492691 `" && echo ansible-tmp-1487158610.11-137345507492691="` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-137345507492691 `" ) && sleep 0'"'"''
<10.0.1.11> SSH: EXEC ssh -o ForwardAgent=yes -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 10.0.1.11 '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-2307895121172 `" && echo ansible-tmp-1487158610.11-2307895121172="` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-2307895121172 `" ) && sleep 0'"'"''
Using module file /usr/local/lib/python2.7/site-packages/ansible/modules/core/system/setup.py
<10.0.1.45> ESTABLISH SSH CONNECTION FOR USER: ec2-user
<10.0.1.45> SSH: EXEC ssh -o ForwardAgent=yes -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 10.0.1.45 '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.12-3620848798638 `" && echo ansible-tmp-1487158610.12-3620848798638="` echo ~/.ansible/tmp/ansible-tmp-1487158610.12-3620848798638 `" ) && sleep 0'"'"''
<10.0.1.170> ssh_retry: attempt: 0, ssh return code is 255. cmd (/bin/sh -c '( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-137345507492691 `" && echo ansible-tmp-1487158610.11-137345507492691="` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-137345507492691 `" ) && sleep 0'...), pausing for 0 seconds
<10.0.1.170> ESTABLISH SSH CONNECTION FOR USER: ec2-user
<10.0.1.170> SSH: EXEC ssh -o ForwardAgent=yes -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 10.0.1.170 '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-137345507492691 `" && echo ansible-tmp-1487158610.11-137345507492691="` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-137345507492691 `" ) && sleep 0'"'"''
<10.0.1.11> ssh_retry: attempt: 0, ssh return code is 255. cmd (/bin/sh -c '( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-2307895121172 `" && echo ansible-tmp-1487158610.11-2307895121172="` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-2307895121172 `" ) && sleep 0'...), pausing for 0 seconds
<10.0.1.11> ESTABLISH SSH CONNECTION FOR USER: ec2-user
<10.0.1.11> SSH: EXEC ssh -o ForwardAgent=yes -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 10.0.1.11 '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-2307895121172 `" && echo ansible-tmp-1487158610.11-2307895121172="` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-2307895121172 `" ) && sleep 0'"'"''
<10.0.1.45> ssh_retry: attempt: 0, ssh return code is 255. cmd (/bin/sh -c '( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.12-3620848798638 `" && echo ansible-tmp-1487158610.12-3620848798638="` echo ~/.ansible/tmp/ansible-tmp-1487158610.12-3620848798638 `" ) && sleep 0'...), pausing for 0 seconds
<10.0.1.45> ESTABLISH SSH CONNECTION FOR USER: ec2-user
<10.0.1.45> SSH: EXEC ssh -o ForwardAgent=yes -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 10.0.1.45 '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.12-3620848798638 `" && echo ansible-tmp-1487158610.12-3620848798638="` echo ~/.ansible/tmp/ansible-tmp-1487158610.12-3620848798638 `" ) && sleep 0'"'"''
<10.0.1.170> ssh_retry: attempt: 1, ssh return code is 255. cmd (/bin/sh -c '( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-137345507492691 `" && echo ansible-tmp-1487158610.11-137345507492691="` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-137345507492691 `" ) && sleep 0'...), pausing for 1 seconds
<10.0.1.11> ssh_retry: attempt: 1, ssh return code is 255. cmd (/bin/sh -c '( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-2307895121172 `" && echo ansible-tmp-1487158610.11-2307895121172="` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-2307895121172 `" ) && sleep 0'...), pausing for 1 seconds
<10.0.1.45> ssh_retry: attempt: 1, ssh return code is 255. cmd (/bin/sh -c '( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.12-3620848798638 `" && echo ansible-tmp-1487158610.12-3620848798638="` echo ~/.ansible/tmp/ansible-tmp-1487158610.12-3620848798638 `" ) && sleep 0'...), pausing for 1 seconds
<10.0.1.170> ESTABLISH SSH CONNECTION FOR USER: ec2-user
<10.0.1.170> SSH: EXEC ssh -o ForwardAgent=yes -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 10.0.1.170 '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-137345507492691 `" && echo ansible-tmp-1487158610.11-137345507492691="` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-137345507492691 `" ) && sleep 0'"'"''
<10.0.1.11> ESTABLISH SSH CONNECTION FOR USER: ec2-user
<10.0.1.11> SSH: EXEC ssh -o ForwardAgent=yes -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 10.0.1.11 '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-2307895121172 `" && echo ansible-tmp-1487158610.11-2307895121172="` echo ~/.ansible/tmp/ansible-tmp-1487158610.11-2307895121172 `" ) && sleep 0'"'"''
<10.0.1.45> ESTABLISH SSH CONNECTION FOR USER: ec2-user
<10.0.1.45> SSH: EXEC ssh -o ForwardAgent=yes -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 10.0.1.45 '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1487158610.12-3620848798638 `" && echo ansible-tmp-1487158610.12-3620848798638="` echo ~/.ansible/tmp/ansible-tmp-1487158610.12-3620848798638 `" ) && sleep 0'"'"''
fatal: [10.0.1.11]: UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: Permission denied (publickey).\r\n",
    "unreachable": true
}
fatal: [10.0.1.170]: UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: Permission denied (publickey).\r\n",
    "unreachable": true
}
fatal: [10.0.1.45]: UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: Permission denied (publickey).\r\n",
    "unreachable": true
}

are you sure you can connect to the instances using plain ssh with your key and the test user? e.g. does `ssh test@10.0.1.62` work? — SztupY, Feb 15 '17 at 11:32
Also try to run the command with `-vvvv` to get more logging — SztupY, Feb 15 '17 at 11:32
@SztupY Added the `-vvv` logs. And, I guess I used `ec2-user` now, as `test` wouldn't work :) . But still, I get the same error — Dawny33, Feb 15 '17 at 11:39
And does connecting using plain SSH (without ansible) work? Note that in your playbook you do say `remote_user: test`, I'm not sure whether you have anything special in your inventory for these hosts — SztupY, Feb 15 '17 at 11:41
Most likely you do not use the proper private key when doing `ssh ec2-user@`, it should match the public key set up in `ssh_keyname` — SztupY, Feb 15 '17 at 11:42
@SztupY Did it. I am getting this problem: http://stackoverflow.com/q/42248643/4993513 — Dawny33, Feb 15 '17 at 11:54
So the problem is with your keys, solving it will most likely solve the ansible problem as well. If all else fails you can always try to generate a new keypair — SztupY, Feb 15 '17 at 11:57
@SztupY I changed the key, and now an able to ssh into the remote instances from master instance. But, Ansible still throws the same error :/ — Dawny33, Feb 16 '17 at 06:50
Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/135837/discussion-between-dawny33-and-sztupy). — Dawny33, Feb 16 '17 at 09:22

score 5 · Answer 1 · answered Jul 22 '17 at 15:59

5

Don't forget, when you use ec2.py you should add your pem first, like this:

ssh-add /home/yourusername/.ssh/your.pem

answered Jul 22 '17 at 15:59

Paulo Victor

3,814
2
26
29

score 1 · Accepted Answer · edited May 23 '17 at 12:09

Here, I was not sure why the key is not even allowing manual ssh. So, I generated a new key(pem file) and worked with it. [Manual ssh worked with that file]

Now, the problem lies in the following block:

- hosts: launched
  sudo: true
  remote_user: test
  gather_facts: yes

I edited it to be:

- hosts: launched
  sudo: no
  connection: ssh
  remote_user: ec2-user
  gather_facts: yes

and it worked. The reason must be obvious. The connection have to be an ssh and not local, and the username should be ec2-user for an Amazon Linux Instance and Ubuntu for an ubuntu instance.

score -1 · Answer 3 · answered Jul 28 '17 at 07:38

-1

Generate ssh public key using ssh-keygen tool and copy the ~/.ssh/id_rsa.pub key into ~/.ssh/authorized_keys file.

answered Jul 28 '17 at 07:38

Timothy Asir

39
2

Ansible throwing "Failed to connect to the host via ssh: Permission denied (publickey)." error with remote connections

3 Answers3