ansible で UNREACHABLE! Failed to connect to the host via ssh: Permission denied エラーで対象ホストにログインできない

2018年02月27日
Ansible
ansible, ssh

Ansible でサーバーの設定をしようとしたら、対象サーバに接続するときに


fatal: [198.51.100.33]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh:
   Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n", "unreachable": true}

PLAY RECAP ******************************************************************************************************
198.51.100.33               : ok=0    changed=0    unreachable=1    failed=0

fatal: [198.51.100.33]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh:

Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n", "unreachable": true}

PLAY RECAP ******************************************************************************************************

198.51.100.33 : ok=0 changed=0 unreachable=1 failed=0

というエラーが出てしまいました。

ansible all -m ping -i {hosts} で試して見ましたがエラーが出ます。


$ ansible all -m ping -i targets/host -vvv
ansible 2.4.2.0
  config file = /home/xxxxx/playbooks/ansible.cfg
  configured module search path = [u'/home/xxxxx/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /bin/ansible
  python version = 2.7.5 (default, Aug  4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]
Using /home/xxxxx/playbooks/ansible.cfg as config file
Parsed /home/xxxxx/playbooks/targets/sanren inventory source with ini plugin
META: ran handlers
Using module file /usr/lib/python2.7/site-packages/ansible/modules/system/ping.py
<198.51.100.33> ESTABLISH SSH CONNECTION FOR USER: None
<198.51.100.33> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o Port=22
   -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey
    -o PasswordAuthentication=no -o ConnectTimeout=30 -o ControlPath=/home/xxxxx/.ansible/cp/243722a335
       198.51.100.33 '/bin/sh -c '"'"'echo ~ && sleep 0'"'"''
<198.51.100.33> (255, '', 'Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n')
198.51.100.33 | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n",
    "unreachable": true
}

$ ansible all -m ping -i targets/host -vvv

ansible 2.4.2.0

config file = /home/xxxxx/playbooks/ansible.cfg

configured module search path = [u'/home/xxxxx/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']

ansible python module location = /usr/lib/python2.7/site-packages/ansible

executable location = /bin/ansible

python version = 2.7.5 (default, Aug 4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]

Using /home/xxxxx/playbooks/ansible.cfg as config file

Parsed /home/xxxxx/playbooks/targets/sanren inventory source with ini plugin

META: ran handlers

Using module file /usr/lib/python2.7/site-packages/ansible/modules/system/ping.py

<198.51.100.33> ESTABLISH SSH CONNECTION FOR USER: None

<198.51.100.33> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o Port=22

-o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey

-o PasswordAuthentication=no -o ConnectTimeout=30 -o ControlPath=/home/xxxxx/.ansible/cp/243722a335

198.51.100.33 '/bin/sh -c '"'"'echo ~ && sleep 0'"'"''

<198.51.100.33> (255, '', 'Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n')

198.51.100.33 | UNREACHABLE! => {

"changed": false,

"msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n",

"unreachable": true

}

ansible.cfg や playbook, task を確認しても、特に remote_user が指定されていたりもしません。

原因はパスワード認証

今回の対象サーバーは SSH の公開鍵を使わなくてもログインできる設定だったので、公開鍵認証を使わずにパスワード認証をして作業していました。 ssh-copy-id コマンドで対象サーバーに公開鍵を設置してみたところ上手くいきました。


$ ssh-copy-id 198.51.100.33
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/xxxxx/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
ansible@198.51.100.33's password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '198.51.100.33'"
and check to make sure that only the key(s) you wanted were added.

$ ansible all -m ping -i targets/sanren -vvv
...
198.51.100.33 | SUCCESS => {
    "changed": false,
    "invocation": {
        "module_args": {
            "data": "pong"
        }
    },
    "ping": "pong"
}

$ ssh-copy-id 198.51.100.33

/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/xxxxx/.ssh/id_rsa.pub"

/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys

ansible@198.51.100.33's password:

Number of key(s) added: 1

Now try logging into the machine, with: "ssh '198.51.100.33'"

and check to make sure that only the key(s) you wanted were added.

$ ansible all -m ping -i targets/sanren -vvv

...

198.51.100.33 | SUCCESS => {

"changed": false,

"invocation": {

"module_args": {

"data": "pong"

}

"ping": "pong"

}

Ansible で SSH のパスワード認証を使うには

今回は公開鍵認証をして解決しましたが、ansible でパスワード認証だけで設定したいときには、ansible.cfg に ask_pass を設定して

[defaults]
ask_pass      = True

1 2	[defaults] ask_pass = True

のようにするか、ansible-playbook コマンド実行時に --ask-pass を付ければよさそうです。

XAMPP 環境に Composer をインストールするときに The PHP exe file you specified did not run correctly エラー ansible で [DEPRECATION WARNING]: The use of ‘include’ for tasks has been deprecated.