# Ansible adhoc command stuck on host pingable but not reachable on port 22

**URL:** <https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591>\
**Category:** Get Help\
**Tags:** ansible-core\
**Created:** [March 27, 2024, 1:13pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591 "2024-03-27T13:13:35Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![birb](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/birb/32/2698_2.png) [@birb](https://forum.ansible.com/u/birb)\
**Post date:** [March 27, 2024, 1:13pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/1 "2024-03-27T13:13:35Z")

</div>

Hi

When I run adhoc command (via awx or command line) on host pingable but not reachable )via ssh) my job/ansible command stuck/hang

How can I avoid such behavior?

```auto
[root@d8dc57f649cd project]# ansible --version
ansible [core 2.15.8]
  config file = None
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.9/site-packages/ansible
  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/local/bin/ansible
  python version = 3.9.18 (main, Sep 7 2023, 00:00:00) [GCC 11.4.1 20230605 (Red Hat 11.4.1-2)] (/usr/bin/python3)
  jinja version = 3.1.2
  libyaml = True

```

```auto
Steps to Reproduce
ansible -i client1, -a "uptime" all

Note that client1 should be pingable but not reachable via ssh

Expected Results
should answer immediately to adhoc command

Actual Results
ssh command stuck/hang
ssh command stuck/hang

root 3864278 0.0 0.0 11128 7476 pts/0 S+ 14:52 0:00 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User="root" -o ConnectTimeout=600 -o ControlPath="/root/.ansible/cp/679112afb7" vmtesttat1cdint3552 /bin/sh -c 'echo ~root && sleep 0'

```

Thanks for your support

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [March 28, 2024, 4:09pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/2 "2024-03-28T16:09:54Z")

</div>

Your best bet to figure out what is going on is to strace the ansible process on the remote end, also lsof might help to see if it is stuck on accessing a file.

But reading this:

```auto
Note that client1 should be pingable but not reachable via ssh

```

Makes me think it is getting stuck on the firewall while trying to ssh. Ansible uses ssh by default, unless you give it another connection plugin/method of accessing the machine, Ansible won’t be able to function.

---

<div class="post-metadata">

**Author:** ![birb](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/birb/32/2698_2.png) [@birb](https://forum.ansible.com/u/birb)\
**Post date:** [March 29, 2024, 10:01am UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/3 "2024-03-29T10:01:47Z")

</div>

Hi Bcoca

My question is why ssh ConnectTimeout or ansible ssh timeout option does notwork ?  
Thanks for your support

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [March 29, 2024, 1:24pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/4 "2024-03-29T13:24:39Z")

</div>

Those timeouts apply to some specific parts of the connection, not the total execution (see task timeout for that), so you can get to a point where those timeouts are not relevant anymore and still get stuck.

---

<div class="post-metadata">

**Author:** ![birb](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/birb/32/2698_2.png) [@birb](https://forum.ansible.com/u/birb)\
**Post date:** [March 29, 2024, 5:08pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/5 "2024-03-29T17:08:16Z")

</div>

Hi

Nothing to highlight with strace except that process is stuck

```auto
root 3046686 0.0 0.0 50412 6304 pts/27 S+ 18:03 0:00 ssh -T -C -o ControlMaster=auto -o ControlPersist=120s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User="root" -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/9c81620aa6 vmtesttat1cdbin9944 /bin/sh -c 'echo PLATFORM; uname; echo FOUND; command -v '"'"'/usr/bin/python'"'"'; command -v '"'"'python3.7'"'"'; command -v '"'"'python3.6'"'"'; command -v '"'"'python3.5'"'"'; command -v '"'"'python2.7'"'"'; command -v '"'"'python2.6'"'"'; command -v '"'"'/usr/libexec/platform-python'"'"'; command -v '"'"'/usr/bin/python3'"'"'; command -v '"'"'python'"'"'; echo ENDFOUND && sleep 0'
[root@vmgobemouche playbooks]# 
[root@vmgobemouche playbooks]# strace -v -p 3046686
strace: Process 3046686 attached
select(4, [3], NULL, NULL, NULL^Cstrace: Process 3046686 detached
 <detached ...>

[root@vmgobemouche playbooks]# strace -vvv -p 3046686
strace: Process 3046686 attached
select(4, [3], NULL, NULL, NULL^Cstrace: Process 3046686 detached
 <detached ...>

[playbooks]# strace -v -ff -p 3046686
strace: Process 3046686 attached
select(4, [3], NULL, NULL, NULL

```

thanks for your support

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [March 29, 2024, 6:38pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/6 "2024-03-29T18:38:48Z")

</div>

seems it is stuck waiting for input, which could be a firewall issue or a resources one. Since you already said ssh is not allowed, I’m going to guess its a firewall issue.

---

<div class="post-metadata">

**Author:** ![birb](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/birb/32/2698_2.png) [@birb](https://forum.ansible.com/u/birb)\
**Post date:** [March 30, 2024, 11:01pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/7 "2024-03-30T23:01:38Z")

</div>

Hi

no firewall it seems that host is simply not reachable via ssh but only pingable

from time to time ansible command stuck on ssh

If I reboot the server issue disappear

[playbooks]# ansible -i vmtesttat1cdbin9944, -a “rpm -q falcon-sensor” all -v  
Using /playbooks/ansible.cfg as config file  
[WARNING]: Unhandled error in Python interpreter discovery for host vmtesttat1cdbin9944: Failed to connect to the host via ssh: kex\_exchange\_identification: Connection closed by remote host  
vmtesttat1cdbin9944 | UNREACHABLE! =\> {  
“changed”: false,  
“msg”: “Data could not be sent to remote host "vmtesttat1cdbin9944". Make sure this host can be reached over ssh: kex\_exchange\_identification: Connection closed by remote host\r\n”,  
“unreachable”: true  
}  
[playbooks]# ansible -i vmtesttat1cdbin9944, -a “rpm -q falcon-sensor” all -v  
Using /playbooks/ansible.cfg as config file  
[WARNING]: Unhandled error in Python interpreter discovery for host vmtesttat1cdbin9944: Failed to connect to the host via ssh: kex\_exchange\_identification: Connection closed by remote host  
vmtesttat1cdbin9944 | UNREACHABLE! =\> {  
“changed”: false,  
“msg”: “Data could not be sent to remote host "vmtesttat1cdbin9944". Make sure this host can be reached over ssh: kex\_exchange\_identification: Connection closed by remote host\r\n”,  
“unreachable”: true  
}  
[playbooks]# ansible -i vmtesttat1cdbin9944, -a “rpm -q falcon-sensor” all -v  
Using /playbooks/ansible.cfg as config file  
[WARNING]: Unhandled error in Python interpreter discovery for host vmtesttat1cdbin9944: Failed to connect to the host via ssh: kex\_exchange\_identification: Connection closed by remote host  
vmtesttat1cdbin9944 | UNREACHABLE! =\> {  
“changed”: false,  
“msg”: “Data could not be sent to remote host "vmtesttat1cdbin9944". Make sure this host can be reached over ssh: kex\_exchange\_identification: Connection closed by remote host\r\n”,  
“unreachable”: true  
}  
[playbooks]# ansible -i vmtesttat1cdbin9944, -a “rpm -q falcon-sensor” all -v  
Using /playbooks/ansible.cfg as config file

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [April 1, 2024, 2:01pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/8 "2024-04-01T14:01:17Z")

</div>

if it is not reachable by ssh, i don’t know how you expect Ansible to work at all.

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [April 1, 2024, 5:31pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/9 "2024-04-01T17:31:49Z")

</div>

> [@birb](#):
>
> Connection closed by remote host

This is not an Ansible problem. You’re literally being denied access by the remote host. Either the firewall is blocking you, or PAM is. Instead of testing with ansible ad-hoc commands, test with ssh.

---

<div class="post-metadata">

**Author:** ![birb](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/birb/32/2698_2.png) [@birb](https://forum.ansible.com/u/birb)\
**Post date:** [April 1, 2024, 7:14pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/10 "2024-04-01T19:14:21Z")

</div>

Hi

What I am waiting is that Ansible timeout and do no stay hang

Thanks for your help

---

<div class="post-metadata">

**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\
**Post date:** [April 1, 2024, 8:01pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/11 "2024-04-01T20:01:21Z")

</div>

set a task timeout using the [playbook keyword](https://docs.ansible.com/ansible/latest/reference_appendices/playbooks_keywords.html#playbook-keywords) `timeout` or [configure a default task timeout](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#task-timeout)

---

<div class="post-metadata">

**Author:** ![birb](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/birb/32/2698_2.png) [@birb](https://forum.ansible.com/u/birb)\
**Post date:** [April 5, 2024, 4:29pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/12 "2024-04-05T16:29:18Z")

</div>

Sorry but you do not understand my issue (may be not enough explained from my side)

Issue o during first connection to the server so task not yet proceed

As already said server is pingable so ansible try to connect but as ssh not available ansible adhoc command stay hang/stuck

I am wondering if ansible can manage such case and timeout to avoid hanging all the command

Thanks for your help

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [April 5, 2024, 4:37pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/13 "2024-04-05T16:37:25Z")

</div>

> [@birb](#):
>
> Issue o during first connection to the server so task not yet proceed
> 
> As already said server is pingable so ansible try to connect but as ssh not available ansible adhoc command stay hang/stuck

As I said before, this is not really an Ansible issue. Just because you can ping the host over ICMP, that doesn’t mean you can establish a tcp connection to port 22 on that host. Something is denying your ssh connection. If you can prove that you can `ssh <username>@vmtesttat1cdbin9944` successfully from where you’re trying to run Ansible, then we can at least rule out networking/firewall issues.

---

<div class="post-metadata">

**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\
**Post date:** [April 5, 2024, 4:43pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/14 "2024-04-05T16:43:47Z")

</div>

Did you try it? Apologies if you already looked into it, but you didn’t acknowledge it when responding to [Ansible adhoc command stuck on host pingable but not reachable on port 22 - #4 by bcoca](http://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/4).

Testing locally, setting the `timeout` at the play level does appear to apply to the implicit `gather_facts` tasks too, but it’s possible it’s a bug in the version you’re using…

(obviously, if you’re testing via adhoc there is no playbook, so you have to use the second link I shared to configure it)

(and to be clear, it won’t “make it work”, it will just prevent the hang since you said “What I am waiting is that Ansible timeout and do no stay hang”)

---

<div class="post-metadata">

**Author:** ![Dustin](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dustin/32/2573_2.png) [@Dustin](https://forum.ansible.com/u/Dustin)\
**Post date:** [April 5, 2024, 7:08pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/15 "2024-04-05T19:08:59Z")

</div>

I think @birb is saying that they expect some hosts to fail the SSH connection from time to time, but they don’t want that failure to cause such a long delay in the execution of the rest of the playbook or workflow.

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [April 5, 2024, 7:12pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/16 "2024-04-05T19:12:53Z")

</div>

That is what the task timeout can do (big hammer), but not the connection timeout.

I know this might be counter intuitive, but connections have many phases and each with it’s own timeout, the timeout in the connection plugins normally maps to ‘how long a does each interaction/response take w/o a ping/alive’ … but it is stuck long before that applies in ‘initial connection waiting for response’.

The ssh client configuration has dozens of timeouts, one of them applies to this case, but not the ‘connection\_timeout’.

You probably want to set ConnectTimeout to not match the TCP timeout, which sometimes does not trigger due to how the firewall prevents ssh access.

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [April 5, 2024, 7:49pm UTC](https://forum.ansible.com/t/ansible-adhoc-command-stuck-on-host-pingable-but-not-reachable-on-port-22/4591/17 "2024-04-05T19:49:34Z")

</div>

> [@Dustin](#):
>
> I think @birb is saying that they expect some hosts to fail the SSH connection from time to time, but they don’t want that failure to cause such a long delay in the execution of the rest of the playbook or workflow.

🤔 Well don’t mind me then…