Ansible access via SSH to Azure VM's on same host but different ports - azure

Question

I have to VM's running on an azure cloud where the hostname is the same but the ports are different for the two VM's. I can do a direct SSH to each of the machines but now I'm trying to configure my ansible playbook to connect and run a simple ping command
ansible all -m ping
My basic ansible inventory file contained
[all]
test01vm0 ansible_host=test01.cloudapp.azure.com ansible_port=50000
test01vm1 ansible_host=test01.cloudapp.azure.com ansible_port=50001
The result is that first VM replies but the second always fails.
test01vm1 | UNREACHABLE! => {
"changed": false,
"msg": "ERROR! SSH encountered an unknown error during the connection. We recommend you re-run the command using -vvvv, which will enable SSH debugging output to help diagnose the issue",
"unreachable": true
}
test01vm0 | SUCCESS => {
"changed": false,
"ping": "pong"
}
I came across this thread on how-to-handle-ssh-host-key-verification-with-2-different-hosts-on-the-same-but and i added
these details to my '.ssh/config' file
Host azure.t01vm0
Hostname test01.cloudapp.azure.com
HostKeyAlias azure.t01vm0
CheckHostIP no
Port 50000
User admin
Host azure.t01vm1
Hostname test01.cloudapp.azure.com
HostKeyAlias azure.t01vm1
CheckHostIP no
Port 50001
User admin
I then updated my inventory file to
[all]
test01vm0 ansible_host=azure.t01vm0
test01vm1 ansible_host=azure.t01vm1
which uses the host alias, under the hood the SSH command will resolve the Hostname and Port.
In my 'groups_vars/all' file i have
# ssh access
ansible_connection: ssh
~~ansible_user: admin~~
~~ansible_pass: xxxxx~~
In my 'ansible.cfg' file i have
[defaults]
~~host_key_checking=false~~
But the same issue still happens. Any suggestions on how i can get around this SSH issue?
The full error is
pc#pc-HP-ZBook-15:~/work/devops/ansible$ ansible all -m ping -vvvv
Using /home/pc/work/devops/ansible/ansible.cfg as config file
Loaded callback minimal of type stdout, v2.0
<azure.t01vm0> ESTABLISH SSH CONNECTION FOR USER: admin
<azure.t01vm0> SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=admin -o ConnectTimeout=10 -o ControlPath=/home/pc/.ansible/cp/ansible-ssh-%h-%p-%r -tt azure.t01vm0 '( umask 22 && mkdir -p "$( echo $HOME/.ansible/tmp/ansible-tmp-1453379274.37-334027235531 )" && echo "$( echo $HOME/.ansible/tmp/ansible-tmp-1453379274.37-334027235531 )" )'
<azure.t01vm1> ESTABLISH SSH CONNECTION FOR USER: admin
<azure.t01vm1> SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o Port=50001 -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=admin -o ConnectTimeout=10 -o ControlPath=/home/pc/.ansible/cp/ansible-ssh-%h-%p-%r -tt azure.t01vm1 '( umask 22 && mkdir -p "$( echo $HOME/.ansible/tmp/ansible-tmp-1453379274.37-107934098383321 )" && echo "$( echo $HOME/.ansible/tmp/ansible-tmp-1453379274.37-107934098383321 )" )'
test01vm1 | UNREACHABLE! => {
"changed": false,
"msg": "ERROR! SSH encountered an unknown error. The output was:\nOpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014\r\ndebug1: Reading configuration data /home/pc/.ssh/config\r\ndebug1: /home/pc/.ssh/config line 20: Applying options for azure.t01vm1\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 19: Applying options for *\r\ndebug1: Hostname has changed; re-reading configuration\r\ndebug1: Reading configuration data /home/pc/.ssh/config\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 19: Applying options for *\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: Control socket \"/home/pc/.ansible/cp/ansible-ssh-test01.cloudapp.azure.com-50001-admin\" does not exist\r\ndebug2: ssh_connect: needpriv 0\r\ndebug1: Connecting to test01.cloudapp.azure.com [13.69.146.148] port 50001.\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug1: fd 3 clearing O_NONBLOCK\r\ndebug1: Connection established.\r\ndebug3: timeout: 9975 ms remain after connect\r\ndebug3: Incorrect RSA1 identifier\r\ndebug3: Could not load \"/home/pc/.ssh/id_rsa\" as a RSA1 public key\r\ndebug1: identity file /home/pc/.ssh/id_rsa type 1\r\ndebug1: identity file /home/pc/.ssh/id_rsa-cert type -1\r\ndebug1: identity file /home/pc/.ssh/id_dsa type -1\r\ndebug1: identity file /home/pc/.ssh/id_dsa-cert type -1\r\ndebug1: identity file /home/pc/.ssh/id_ecdsa type -1\r\ndebug1: identity file /home/pc/.ssh/id_ecdsa-cert type -1\r\ndebug1: identity file /home/pc/.ssh/id_ed25519 type -1\r\ndebug1: identity file /home/pc/.ssh/id_ed25519-cert type -1\r\ndebug1: Enabling compatibility mode for protocol 2.0\r\ndebug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.4\r\ndebug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1\r\ndebug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug1: using hostkeyalias: azure.t01vm1\r\ndebug3: load_hostkeys: loading entries for host \"azure.t01vm1\" from file \"/home/pc/.ssh/known_hosts\"\r\ndebug3: load_hostkeys: found key type ECDSA in file /home/pc/.ssh/known_hosts:75\r\ndebug3: load_hostkeys: loaded 1 keys\r\ndebug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01#openssh.com,ecdsa-sha2-nistp384-cert-v01#openssh.com,ecdsa-sha2-nistp521-cert-v01#openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521\r\ndebug1: SSH2_MSG_KEXINIT sent\r\ndebug1: SSH2_MSG_KEXINIT received\r\ndebug2: kex_parse_kexinit: curve25519-sha256#libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\r\ndebug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01#openssh.com,ecdsa-sha2-nistp384-cert-v01#openssh.com,ecdsa-sha2-nistp521-cert-v01#openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01#openssh.com,ssh-rsa-cert-v01#openssh.com,ssh-dss-cert-v01#openssh.com,ssh-rsa-cert-v00#openssh.com,ssh-dss-cert-v00#openssh.com,ssh-ed25519,ssh-rsa,ssh-dss\r\ndebug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm#openssh.com,aes256-gcm#openssh.com,chacha20-poly1305#openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc#lysator.liu.se\r\ndebug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm#openssh.com,aes256-gcm#openssh.com,chacha20-poly1305#openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc#lysator.liu.se\r\ndebug2: kex_parse_kexinit: hmac-md5-etm#openssh.com,hmac-sha1-etm#openssh.com,umac-64-etm#openssh.com,umac-128-etm#openssh.com,hmac-sha2-256-etm#openssh.com,hmac-sha2-512-etm#openssh.com,hmac-ripemd160-etm#openssh.com,hmac-sha1-96-etm#openssh.com,hmac-md5-96-etm#openssh.com,hmac-md5,hmac-sha1,umac-64#openssh.com,umac-128#openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160#openssh.com,hmac-sha1-96,hmac-md5-96\r\ndebug2: kex_parse_kexinit: hmac-md5-etm#openssh.com,hmac-sha1-etm#openssh.com,umac-64-etm#openssh.com,umac-128-etm#openssh.com,hmac-sha2-256-etm#openssh.com,hmac-sha2-512-etm#openssh.com,hmac-ripemd160-etm#openssh.com,hmac-sha1-96-etm#openssh.com,hmac-md5-96-etm#openssh.com,hmac-md5,hmac-sha1,umac-64#openssh.com,umac-128#openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160#openssh.com,hmac-sha1-96,hmac-md5-96\r\ndebug2: kex_parse_kexinit: zlib#openssh.com,zlib,none\r\ndebug2: kex_parse_kexinit: zlib#openssh.com,zlib,none\r\ndebug2: kex_parse_kexinit: \r\ndebug2: kex_parse_kexinit: \r\ndebug2: kex_parse_kexinit: first_kex_follows 0 \r\ndebug2: kex_parse_kexinit: reserved 0 \r\ndebug2: kex_parse_kexinit: curve25519-sha256#libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\r\ndebug2: kex_parse_kexinit: ssh-rsa,ecdsa-sha2-nistp256\r\ndebug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm#openssh.com,aes256-gcm#openssh.com,chacha20-poly1305#openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc#lysator.liu.se\r\ndebug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm#openssh.com,aes256-gcm#openssh.com,chacha20-poly1305#openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc#lysator.liu.se\r\ndebug2: kex_parse_kexinit: hmac-md5-etm#openssh.com,hmac-sha1-etm#openssh.com,umac-64-etm#openssh.com,umac-128-etm#openssh.com,hmac-sha2-256-etm#openssh.com,hmac-sha2-512-etm#openssh.com,hmac-ripemd160-etm#openssh.com,hmac-sha1-96-etm#openssh.com,hmac-md5-96-etm#openssh.com,hmac-md5,hmac-sha1,umac-64#openssh.com,umac-128#openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160#openssh.com,hmac-sha1-96,hmac-md5-96\r\ndebug2: kex_parse_kexinit: hmac-md5-etm#openssh.com,hmac-sha1-etm#openssh.com,umac-64-etm#openssh.com,umac-128-etm#openssh.com,hmac-sha2-256-etm#openssh.com,hmac-sha2-512-etm#openssh.com,hmac-ripemd160-etm#openssh.com,hmac-sha1-96-etm#openssh.com,hmac-md5-96-etm#openssh.com,hmac-md5,hmac-sha1,umac-64#openssh.com,umac-128#openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160#openssh.com,hmac-sha1-96,hmac-md5-96\r\ndebug2: kex_parse_kexinit: none,zlib#openssh.com\r\ndebug2: kex_parse_kexinit: none,zlib#openssh.com\r\ndebug2: kex_parse_kexinit: \r\ndebug2: kex_parse_kexinit: \r\ndebug2: kex_parse_kexinit: first_kex_follows 0 \r\ndebug2: kex_parse_kexinit: reserved 0 \r\ndebug2: mac_setup: setup hmac-md5-etm#openssh.com\r\ndebug1: kex: server->client aes128-ctr hmac-md5-etm#openssh.com zlib#openssh.com\r\ndebug2: mac_setup: setup hmac-md5-etm#openssh.com\r\ndebug1: kex: client->server aes128-ctr hmac-md5-etm#openssh.com zlib#openssh.com\r\ndebug1: sending SSH2_MSG_KEX_ECDH_INIT\r\ndebug1: expecting SSH2_MSG_KEX_ECDH_REPLY\r\ndebug1: Server host key: ECDSA ff:e4:84:a7:d4:88:18:6b:80:a7:0c:df:b0:f1:56:16\r\ndebug3: put_host_port: [13.69.146.148]:50001\r\ndebug1: using hostkeyalias: azure.t01vm1\r\ndebug3: load_hostkeys: loading entries for host \"azure.t01vm1\" from file \"/home/pc/.ssh/known_hosts\"\r\ndebug3: load_hostkeys: found key type ECDSA in file /home/pc/.ssh/known_hosts:75\r\ndebug3: load_hostkeys: loaded 1 keys\r\ndebug1: Host 'azure.t01vm1' is known and matches the ECDSA host key.\r\ndebug1: Found key in /home/pc/.ssh/known_hosts:75\r\ndebug1: ssh_ecdsa_verify: signature correct\r\ndebug2: kex_derive_keys\r\ndebug2: set_newkeys: mode 1\r\ndebug1: SSH2_MSG_NEWKEYS sent\r\ndebug1: expecting SSH2_MSG_NEWKEYS\r\ndebug2: set_newkeys: mode 0\r\ndebug1: SSH2_MSG_NEWKEYS received\r\ndebug1: SSH2_MSG_SERVICE_REQUEST sent\r\ndebug2: service_accept: ssh-userauth\r\ndebug1: SSH2_MSG_SERVICE_ACCEPT received\r\ndebug2: key: /home/pc/.ssh/id_rsa (0x7fcac5e86a60),\r\ndebug2: key: /home/pc/.ssh/id_dsa ((nil)),\r\ndebug2: key: /home/pc/.ssh/id_ecdsa ((nil)),\r\ndebug2: key: /home/pc/.ssh/id_ed25519 ((nil)),\r\ndebug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password\r\ndebug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password\r\ndebug3: preferred gssapi-with-mic,gssapi-keyex,hostbased,publickey\r\ndebug3: authmethod_lookup gssapi-with-mic\r\ndebug3: remaining preferred: gssapi-keyex,hostbased,publickey\r\ndebug3: authmethod_is_enabled gssapi-with-mic\r\ndebug1: Next authentication method: gssapi-with-mic\r\ndebug1: Unspecified GSS failure. Minor code may provide more information\nNo Kerberos credentials available\n\r\ndebug1: Unspecified GSS failure. Minor code may provide more information\nNo Kerberos credentials available\n\r\ndebug1: Unspecified GSS failure. Minor code may provide more information\n\n\r\ndebug1: Unspecified GSS failure. Minor code may provide more information\nNo Kerberos credentials available\n\r\ndebug2: we did not send a packet, disable method\r\ndebug3: authmethod_lookup gssapi-keyex\r\ndebug3: remaining preferred: hostbased,publickey\r\ndebug3: authmethod_is_enabled gssapi-keyex\r\ndebug1: Next authentication method: gssapi-keyex\r\ndebug1: No valid Key exchange context\r\ndebug2: we did not send a packet, disable method\r\ndebug3: authmethod_lookup publickey\r\ndebug3: remaining preferred: ,publickey\r\ndebug3: authmethod_is_enabled publickey\r\ndebug1: Next authentication method: publickey\r\ndebug1: Offering RSA public key: /home/pc/.ssh/id_rsa\r\ndebug3: send_pubkey_test\r\ndebug2: we sent a publickey packet, wait for reply\r\ndebug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password\r\ndebug1: Trying private key: /home/pc/.ssh/id_dsa\r\ndebug3: no such identity: /home/pc/.ssh/id_dsa: No such file or directory\r\ndebug1: Trying private key: /home/pc/.ssh/id_ecdsa\r\ndebug3: no such identity: /home/pc/.ssh/id_ecdsa: No such file or directory\r\ndebug1: Trying private key: /home/pc/.ssh/id_ed25519\r\ndebug3: no such identity: /home/pc/.ssh/id_ed25519: No such file or directory\r\ndebug2: we did not send a packet, disable method\r\ndebug1: No more authentication methods to try.\r\nPermission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n",
"unreachable": true
}
EDIT
I updated my ansible.cfg file to include a the private_key_file value
[defaults]
private_key_file=/home/pc/.ssh/id_rsa.pem
when i attempt to SSH onto the box with the private_key, this is the debug details and i get access
ssh -p 50000 admin#test01.cloudapp.azure.com -v -i ~/.ssh/id_rsa.pem
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /home/pc/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to test01.cloudapp.azure.com [40.112.77.99] port 50000.
debug1: Connection established.
debug1: identity file /home/pc/.ssh/id_rsa.pem type -1
debug1: identity file /home/pc/.ssh/id_rsa.pem-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5-etm#openssh.com none
debug1: kex: client->server aes128-ctr hmac-md5-etm#openssh.com none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA a3:30:44:1a:1b:f9:fa:c0:6e:7e:79:a3:fe:da:f4:e1
debug1: Host '[test01.cloudapp.azure.com]:50000' is known and matches the ECDSA host key.
debug1: Found key in /home/pc/.ssh/known_hosts:67
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available
debug1: Unspecified GSS failure. Minor code may provide more information
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available
debug1: Next authentication method: publickey
debug1: Offering RSA public key: pc#pc-HP-ZBook-15
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: Authentication succeeded (publickey).
Authenticated to test01.cloudapp.azure.com ([40.112.77.99]:50000).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions#openssh.com
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = en_IE.UTF-8
It seems odd to me that the SSH login is still using the 'publickey' in this case?

Answer 1

If you have a look on that long line, with error, you will find:
debug3: preferred gssapi-with-mic,gssapi-keyex,hostbased,publickey
Server does not support password authentication. It is no wonder that it fails. You need to allow it in server config or log in using private key.