# Ansible authentication failure, despite successfull keybased ssh-login

**URL:** <https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311>\
**Category:** Ansible Project\
**Created:** [May 23, 2014, 9:24am UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311 "2014-05-23T09:24:59Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joost\_Ringoot](https://avatars.discourse-cdn.com/v4/letter/j/c67d28/32.png) [@Joost\_Ringoot](https://forum.ansible.com/u/Joost_Ringoot)\
**Post date:** [May 23, 2014, 9:24am UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/1 "2014-05-23T09:24:59Z")

</div>

Hi,

When I try to connect to a host with ansible, it fails with the user jenkins.  
Despite keybased sshlogin is succesfull.

> [jenkins@geppetto ~]$ ssh jenkins@cal-25  
> Last login: Fri May 23 11:19:58 2014 from geppetto.oma.be  
> [jenkins@cal-25 ~]$ exit  
> logout  
> Connection to cal-25 closed.  
> [jenkins@geppetto ~]$ ansible cal-25 -m ping -u jenkins  
> cal-25 | FAILED =\> FAILED: Authentication failed.  
> [jenkins@geppetto ~]$

Any suggestions on troubleshooting this?

Thanks,

Joost

---

<div class="post-metadata">

**Author:** ![Serge\_van\_Ginderacht](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@Serge\_van\_Ginderacht](https://forum.ansible.com/u/Serge_van_Ginderacht)\
**Post date:** [May 23, 2014, 9:27am UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/2 "2014-05-23T09:27:02Z")

</div>

​Can you show the output of this, adding -vvvv ?​

---

<div class="post-metadata">

**Author:** ![Joost\_Ringoot](https://avatars.discourse-cdn.com/v4/letter/j/c67d28/32.png) [@Joost\_Ringoot](https://forum.ansible.com/u/Joost_Ringoot)\
**Post date:** [May 23, 2014, 9:29am UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/3 "2014-05-23T09:29:23Z")

</div>

[jenkins@geppetto ~]$ ansible -vvv cal-25 -m ping -u jenkins  
 ESTABLISH CONNECTION FOR USER: root on PORT 22 TO cal-25  
cal-25 | FAILED =\> FAILED: Authentication failed.  
[jenkins@geppetto ~]$

I tried with root and pass, that works:

[jenkins@geppetto ~]$ ansible cal-25 -m ping -u root --ask-pass  
SSH password:  
cal-25 | success \>\> {  
“changed”: false,  
“ping”: “pong”  
}

[jenkins@geppetto ~]$

---

<div class="post-metadata">

**Author:** ![Joost\_Ringoot](https://avatars.discourse-cdn.com/v4/letter/j/c67d28/32.png) [@Joost\_Ringoot](https://forum.ansible.com/u/Joost_Ringoot)\
**Post date:** [May 23, 2014, 9:31am UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/4 "2014-05-23T09:31:19Z")

</div>

To be complete:

[jenkins@geppetto ~]$ ansible -vvv cal-25 -m ping -u root --ask-pass  
SSH password:  
 ESTABLISH CONNECTION FOR USER: root on PORT 22 TO cal-25  
 REMOTE\_MODULE ping  
 EXEC /bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1400837387.95-16436599027436 && echo $HOME/.ansible/tmp/ansible-tmp-1400837387.95-16436599027436’  
 PUT /tmp/tmp7uj9w8 TO /root/.ansible/tmp/ansible-tmp-1400837387.95-16436599027436/ping  
 EXEC /bin/sh -c ‘LC\_CTYPE=en\_US.UTF-8 LANG=en\_US.UTF-8 /usr/bin/python /root/.ansible/tmp/ansible-tmp-1400837387.95-16436599027436/ping; rm -rf /root/.ansible/tmp/ansible-tmp-1400837387.95-16436599027436/ \>/dev/null 2\>&1’  
cal-25 | success \>\> {  
“changed”: false,  
“ping”: “pong”  
}  
[jenkins@geppetto ~]$ ansible -vvv cal-25 -m ping -u jenkins  
 ESTABLISH CONNECTION FOR USER: root on PORT 22 TO cal-25  
cal-25 | FAILED =\> FAILED: Authentication failed.  
[jenkins@geppetto ~]$  
[jenkins@geppetto ~]$ ssh jenkins@cal-25  
Last login: Fri May 23 11:24:01 2014 from geppetto.oma.be  
[jenkins@cal-25 ~]$ exit  
logout  
Connection to cal-25 closed.  
[jenkins@geppetto ~]$

[jenkins@geppetto ~]$

---

<div class="post-metadata">

**Author:** ![Joost\_Ringoot](https://avatars.discourse-cdn.com/v4/letter/j/c67d28/32.png) [@Joost\_Ringoot](https://forum.ansible.com/u/Joost_Ringoot)\
**Post date:** [May 23, 2014, 9:38am UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/5 "2014-05-23T09:38:15Z")

</div>

Ok I see now, ansible tries to login as root, despite passing a “-u jenkins”

---

<div class="post-metadata">

**Author:** ![Joost\_Ringoot](https://avatars.discourse-cdn.com/v4/letter/j/c67d28/32.png) [@Joost\_Ringoot](https://forum.ansible.com/u/Joost_Ringoot)\
**Post date:** [May 23, 2014, 9:47am UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/6 "2014-05-23T09:47:56Z")

</div>

I explicitly defined remote\_user as jenkins, it still wants to use root, any ideas?:

`  
[jenkins@geppetto ~]$ cat ~/.ansible.cfg  
[defaults]  
log\_path=/home/jenkins/.ansible/var/log/ansible.log  
remote\_user = jenkins  
sudo\_user = root

[jenkins@geppetto ~]$ ansible -vvv cal-25 -m ping -u jenkins  
 ESTABLISH CONNECTION FOR USER: root on PORT 22 TO cal-25  
cal-25 | FAILED =\> FAILED: Authentication failed.  
[jenkins@geppetto ~]$ cat /home/jenkins/.ansible/var/log/ansible.log  
2014-05-23 11:47:08,693 p=4285 u=jenkins |  
2014-05-23 11:47:08,693 p=4285 u=jenkins | /opt/ansible/bin/ansible -vvv cal-25 -m ping -u jenkins  
2014-05-23 11:47:08,694 p=4285 u=jenkins |  
2014-05-23 11:47:08,755 p=4285 u=jenkins | ESTABLISH CONNECTION FOR USER: root on PORT 22 TO cal-25  
2014-05-23 11:47:09,048 p=4285 u=jenkins | cal-25 | FAILED =\> FAILED: Authentication failed.  
[jenkins@geppetto ~]$

`

---

<div class="post-metadata">

**Author:** ![Vincent\_Van\_der\_Kuss](https://avatars.discourse-cdn.com/v4/letter/v/7c8e57/32.png) [@Vincent\_Van\_der\_Kuss](https://forum.ansible.com/u/Vincent_Van_der_Kuss)\
**Post date:** [May 23, 2014, 9:50am UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/7 "2014-05-23T09:50:26Z")

</div>

What if you specify --ask-sudo-pass ?

---

<div class="post-metadata">

**Author:** ![Joost\_Ringoot](https://avatars.discourse-cdn.com/v4/letter/j/c67d28/32.png) [@Joost\_Ringoot](https://forum.ansible.com/u/Joost_Ringoot)\
**Post date:** [May 23, 2014, 10:19am UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/8 "2014-05-23T10:19:39Z")

</div>

No difference:

`  
[jenkins@geppetto ~]$ ansible -vvv cal-25 -m ping -u jenkins --ask-sudo-pass  
sudo password:  
 ESTABLISH CONNECTION FOR USER: root on PORT 22 TO cal-25  
cal-25 | FAILED =\> FAILED: Authentication failed.  
[jenkins@geppetto ~]$

`

Local sudo actions work with user jenkins, I don’t think the problem is there.

`  
[root@cal-25 ~]# grep SOFTWARE /etc/sudoers  
Cmnd\_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum

# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS

jenkins ALL=(root) NOPASSWD: SOFTWARE  
[root@cal-25 ~]# grep jenkins /etc/sudoers  
#stuff for jenkins and ansible  
jenkins ALL=(root) NOPASSWD: SOFTWARE  
[root@cal-25 ~]#

`

Anyway thanks for looking into it Vincent and Serge

---

<div class="post-metadata">

**Author:** ![Vincent\_Van\_der\_Kuss](https://avatars.discourse-cdn.com/v4/letter/v/7c8e57/32.png) [@Vincent\_Van\_der\_Kuss](https://forum.ansible.com/u/Vincent_Van_der_Kuss)\
**Post date:** [May 23, 2014, 10:21am UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/9 "2014-05-23T10:21:24Z")

</div>

Which version of Ansible is this?

---

<div class="post-metadata">

**Author:** ![Joost\_Ringoot](https://avatars.discourse-cdn.com/v4/letter/j/c67d28/32.png) [@Joost\_Ringoot](https://forum.ansible.com/u/Joost_Ringoot)\
**Post date:** [May 23, 2014, 10:23am UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/10 "2014-05-23T10:23:00Z")

</div>

`  
[jenkins@geppetto ~]$ ansible --version  
ansible 1.7 (devel d314f1b038) last updated 2014/05/07 15:38:39 (GMT +200)  
[jenkins@geppetto ~]$

`

---

<div class="post-metadata">

**Author:** ![Vincent\_Van\_der\_Kuss](https://avatars.discourse-cdn.com/v4/letter/v/7c8e57/32.png) [@Vincent\_Van\_der\_Kuss](https://forum.ansible.com/u/Vincent_Van_der_Kuss)\
**Post date:** [May 23, 2014, 10:26am UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/11 "2014-05-23T10:26:16Z")

</div>

What if you try with 1.6 ?

---

<div class="post-metadata">

**Author:** ![Joost\_Ringoot](https://avatars.discourse-cdn.com/v4/letter/j/c67d28/32.png) [@Joost\_Ringoot](https://forum.ansible.com/u/Joost_Ringoot)\
**Post date:** [May 23, 2014, 10:26am UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/12 "2014-05-23T10:26:27Z")

</div>

Just tried again with latest clone from git:

`  
[jenkins@geppetto ~]$ ansible --version  
ansible 1.7 (devel ee82681d14) last updated 2014/05/23 12:24:44 (GMT +200)  
[jenkins@geppetto ~]$ ansible -vvv cal-25 -m ping -u jenkins  
 ESTABLISH CONNECTION FOR USER: root on PORT 22 TO cal-25  
cal-25 | FAILED =\> FAILED: Authentication failed.  
[jenkins@geppetto ~]$

`

---

<div class="post-metadata">

**Author:** ![Joost\_Ringoot](https://avatars.discourse-cdn.com/v4/letter/j/c67d28/32.png) [@Joost\_Ringoot](https://forum.ansible.com/u/Joost_Ringoot)\
**Post date:** [May 23, 2014, 10:45am UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/13 "2014-05-23T10:45:30Z")

</div>

1.6 Where can I find that? the version available in epel is 1.5.5 and on the site of ansible I only find ansible tower.

---

<div class="post-metadata">

**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\
**Post date:** [May 23, 2014, 12:11pm UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/14 "2014-05-23T12:11:10Z")

</div>

[http://releases.ansible.com/ansible/](http://releases.ansible.com/ansible/)

Also via pypi for installation with pip/easy\_install

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [May 23, 2014, 12:43pm UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/15 "2014-05-23T12:43:21Z")

</div>

I’d check to see if you had defined ansible\_ssh\_user in inventory somewhere.

If setting the user didn’t work, I suspect we’d hear about it more, so I’m expecting this is something environmental.

(might you have something in your SSH config?)

---

<div class="post-metadata">

**Author:** ![Joost\_Ringoot](https://avatars.discourse-cdn.com/v4/letter/j/c67d28/32.png) [@Joost\_Ringoot](https://forum.ansible.com/u/Joost_Ringoot)\
**Post date:** [May 23, 2014, 6:44pm UTC](https://forum.ansible.com/t/ansible-authentication-failure-despite-successfull-keybased-ssh-login/15311/16 "2014-05-23T18:44:39Z")

</div>

Thanks michael,

ansible\_ssh\_user was set in the hosts file indeed.

Meanwhile I found also that inventory intentionally overrides commandline:  
[https://github.com/ansible/ansible/issues/4622](https://github.com/ansible/ansible/issues/4622)