ansible で UNREACHABLE! Failed to connect to the host via ssh: Permission denied エラーで対象ホストにログインできない

2018年02月27日
Ansible
ansible, ssh

Ansible でサーバーの設定をしようとしたら、対象サーバに接続するときに


fatal: [198.51.100.33]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh:
   Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n", "unreachable": true}

PLAY RECAP ******************************************************************************************************
198.51.100.33               : ok=0    changed=0    unreachable=1    failed=0

fatal: [198.51.100.33]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh:

Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n", "unreachable": true}

PLAY RECAP ******************************************************************************************************

198.51.100.33 : ok=0 changed=0 unreachable=1 failed=0

というエラーが出てしまいました。

ansible all -m ping -i {hosts} で試して見ましたがエラーが出ます。


$ ansible all -m ping -i targets/host -vvv
ansible 2.4.2.0
  config file = /home/xxxxx/playbooks/ansible.cfg
  configured module search path = [u'/home/xxxxx/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /bin/ansible
  python version = 2.7.5 (default, Aug  4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]
Using /home/xxxxx/playbooks/ansible.cfg as config file
Parsed /home/xxxxx/playbooks/targets/sanren inventory source with ini plugin
META: ran handlers
Using module file /usr/lib/python2.7/site-packages/ansible/modules/system/ping.py
<198.51.100.33> ESTABLISH SSH CONNECTION FOR USER: None
<198.51.100.33> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o Port=22
   -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey
    -o PasswordAuthentication=no -o ConnectTimeout=30 -o ControlPath=/home/xxxxx/.ansible/cp/243722a335
       198.51.100.33 '/bin/sh -c '"'"'echo ~ && sleep 0'"'"''
<198.51.100.33> (255, '', 'Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n')
198.51.100.33 | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n",
    "unreachable": true
}

$ ansible all -m ping -i targets/host -vvv

ansible 2.4.2.0

config file = /home/xxxxx/playbooks/ansible.cfg

configured module search path = [u'/home/xxxxx/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']

ansible python module location = /usr/lib/python2.7/site-packages/ansible

executable location = /bin/ansible

python version = 2.7.5 (default, Aug 4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]

Using /home/xxxxx/playbooks/ansible.cfg as config file

Parsed /home/xxxxx/playbooks/targets/sanren inventory source with ini plugin

META: ran handlers

Using module file /usr/lib/python2.7/site-packages/ansible/modules/system/ping.py

<198.51.100.33> ESTABLISH SSH CONNECTION FOR USER: None

<198.51.100.33> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o Port=22

-o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey

-o PasswordAuthentication=no -o ConnectTimeout=30 -o ControlPath=/home/xxxxx/.ansible/cp/243722a335

198.51.100.33 '/bin/sh -c '"'"'echo ~ && sleep 0'"'"''

<198.51.100.33> (255, '', 'Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n')

198.51.100.33 | UNREACHABLE! => {

"changed": false,

"msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n",

"unreachable": true

}

ansible.cfg や playbook, task を確認しても、特に remote_user が指定されていたりもしません。

原因はパスワード認証

今回の対象サーバーは SSH の公開鍵を使わなくてもログインできる設定だったので、公開鍵認証を使わずにパスワード認証をして作業していました。

ssh-copy-id コマンドで対象サーバーに公開鍵を設置してみたところ上手くいきました。


$ ssh-copy-id 198.51.100.33
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/xxxxx/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
ansible@198.51.100.33's password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '198.51.100.33'"
and check to make sure that only the key(s) you wanted were added.

$ ansible all -m ping -i targets/sanren -vvv
...
198.51.100.33 | SUCCESS => {
    "changed": false,
    "invocation": {
        "module_args": {
            "data": "pong"
        }
    },
    "ping": "pong"
}

$ ssh-copy-id 198.51.100.33

/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/xxxxx/.ssh/id_rsa.pub"

/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys

ansible@198.51.100.33's password:

Number of key(s) added: 1

Now try logging into the machine, with: "ssh '198.51.100.33'"

and check to make sure that only the key(s) you wanted were added.

$ ansible all -m ping -i targets/sanren -vvv

...

198.51.100.33 | SUCCESS => {

"changed": false,

"invocation": {

"module_args": {

"data": "pong"

}

"ping": "pong"

}

Ansible で SSH のパスワード認証を使うには

今回は公開鍵認証をして解決しましたが、ansible でパスワード認証だけで設定したいときには、ansible.cfg に ask_pass を設定して

[defaults]
ask_pass      = True

1 2	[defaults] ask_pass = True

のようにするか、ansible-playbook コマンド実行時に --ask-pass を付ければよさそうです。

ITエンジニア募集中！

キュアコード株式会社はITエンジニアを募集しております。少人数の職場なので、上流・下流やサーバー・クライアント対応の垣根なく、あなたの強みを活かしながらいろいろなことにチャレンジ可能です。エンジニアとしての未経験の方、経験が少ない方も歓迎しています。

下記よりITエンジニア募集の採用情報をご覧いただけます。

XAMPP 環境に Composer をインストールするときに The PHP exe file you specified did not run correctly エラー ansible で [DEPRECATION WARNING]: The use of ‘include’ for tasks has been deprecated.