# Ansible Doesn't Use SSH Config File specified by ssh\_args? **URL:** \ **Category:** Ansible Project\ **Created:** [May 22, 2014, 10:12pm UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308 "2014-05-22T22:12:00Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [May 22, 2014, 10:12pm UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/1 "2014-05-22T22:12:00Z")
Ansible 1.6.1 I’m trying to set things up so that I can specify a bastion host as a gateway to my other machines. I’d like Ansible to use an SSH config file that I keep in git. So, I have a file named “sshconfig” with: Host \* ServerAliveInterval 60 TCPKeepAlive yes ProxyCommand ssh 55.232.102.151 ‘nc %h %p’ ControlMaster auto Where 55.232.102.151 is the bastion IP address. My ansible.cfg file looks like: [defaults] transport = ssh ssh\_args = -F sshconfig -o ControlPersist=15m If I run “ssh -F sshconfig [me@44.55.66.77](mailto:me@44.55.66.77)” it uses the bastion server as expected. But Ansible doesn’t ever seem to use my “sshconfig” file (I don’t see anything about it in the verbose output, nor the bastion IP address). ’ Does ssh\_args actually permit “-F sshconfig” or does it only allow “-o param=something” options? J ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [May 23, 2014, 12:31pm UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/2 "2014-05-23T12:31:52Z")
Ansible will use your SSH config when using the ssh (not paramiko) transport, perhaps it’s not finding it for some reason. paramiko would be the default if you were running from RHEL/CentOS 6 or before, where OpenSSH is not new enough to support ControlMaster, and paramiko is therefore still faster. (review for everyone: accelerate mode is the performance option there, since pipeling is OpenSSH only). Let’s start with what OS you are running form as that may highlight that transport question. If not, we can ask other questions. ---
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [May 23, 2014, 1:00pm UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/3 "2014-05-23T13:00:27Z")
I’m running ansible 1.6.1 on MacOSX 10.9.3. The target systems are CentOS 6. J ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [May 23, 2014, 3:09pm UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/4 "2014-05-23T15:09:27Z")
Hmm. So that’s definitely OpenSSH by default. Commands to ssh config are arbitrary and are handled here: [https://github.com/ansible/ansible/blob/devel/lib/ansible/runner/connection\_plugins/ssh.py#L60](https://github.com/ansible/ansible/blob/devel/lib/ansible/runner/connection_plugins/ssh.py#L60) Can you try specifying a full path to your SSH config file? Might be a case of relative path. ---
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [May 23, 2014, 3:39pm UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/5 "2014-05-23T15:39:52Z")
That didn’t make a difference. I know that ansible is using that ansible.cfg file because I can put a “remote\_user = xxx” line at the end of it and ansible uses that. It would be helpful if someone could simply add “ssh\_args= -F sshconfig” to an ansible.cfg file and show some output that proves that Ansible is using it. J ---
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [May 23, 2014, 4:30pm UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/6 "2014-05-23T16:30:59Z")
FWIW, I got this idea from **you** 🙂 - reference: [https://groups.google.com/d/msg/ansible-project/AOt-5fgBzho/hEDnnOrJkC8J](https://groups.google.com/d/msg/ansible-project/AOt-5fgBzho/hEDnnOrJkC8J) However, I’ve never seen an implementation of it or a working example that’s been tested. I think someone posted an example where they had “-F ~/.ssh/config” but since that’s the default ssh config file (ssh will use ~/.ssh/config whether or not your specify it with the -F flag) it doesn’t really test whether it’s working or not. 🙂 J ---
**Author:** ![James\_Cammarata](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@James\_Cammarata](https://forum.ansible.com/u/James_Cammarata)\ **Post date:** [May 23, 2014, 8:04pm UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/7 "2014-05-23T20:04:26Z")
I think what Michael meant was to specify the full path to the sshconfig file, ie. “-F /path/to/mysshconfig” instead of a relative path. ---
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [May 23, 2014, 9:53pm UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/8 "2014-05-23T21:53:19Z")
Yes. I tried that. No difference. As I mentioned, it’s clear that Ansible is using my ansible.cfg file. For example, if I set the remote\_user in my ansible.cfg to: [defaults] transport=ssh ssh\_args= -F /work/sshconfig remote\_user=dummyuser Then everything fails because Ansible tries to use “dummyuser” to connect. I’m still wondering if anyone has ever successfully used ssh\_args with anything besides “-o param=value” directives. What is ansible doing, for example, if you put “-v” or “-f” in ssh\_args? They seem to have no effect. J ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [May 23, 2014, 10:10pm UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/9 "2014-05-23T22:10:27Z")
ssh\_args does not go under the [defaults] section. It belongs under a section titled [ssh\_connection] ---
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [May 24, 2014, 12:04pm UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/10 "2014-05-24T12:04:58Z")
Thanks. That got things working. It would be nice if Ansible did some basic syntax checking on the cfg file. 🙂 So if you have multiple bastion files, but no specific domain name you can wildcard off of (e.g. “Host \*.mydomain.com”, "Host “.anotherdom.com”, etc), what is the Ansible best practice for handling multiple clusters with a bastion server for each cluster? Reference: [https://groups.google.com/d/msg/ansible-project/bWdWJ4UtkFQ/fXHO3MDvF\_kJ](https://groups.google.com/d/msg/ansible-project/bWdWJ4UtkFQ/fXHO3MDvF_kJ) J ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [May 25, 2014, 8:54pm UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/11 "2014-05-25T20:54:09Z")
“Ansible best practice for handling multiple clusters with a bastion server for each cluster?” Per host settings in your SSH config file. ---
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [May 26, 2014, 12:49am UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/12 "2014-05-26T00:49:17Z")
So, if a lot of your machines have IP addresses (or very different domain names) then you’d have to create an ssh config file entry for each individual IP address, right? Because there’d be no way to use wildcards. Am I missing something here? Example: Host 33.44.55.66 ServerAliveInterval 60 TCPKeepAlive yes ProxyCommand ssh 55.232.102.151 ‘nc %h %p’ ControlMaster auto Host 22.33.44.55 ServerAliveInterval 60 TCPKeepAlive yes ProxyCommand ssh 55.232.102.151 ‘nc %h %p’ ControlMaster auto …and so on… J ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [May 26, 2014, 2:04am UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/13 "2014-05-26T02:04:16Z")
if using the ssh connection plugin, it supports whatever ssh does, so wildcards should work​. ---
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [May 26, 2014, 3:51am UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/14 "2014-05-26T03:51:24Z")
To clarify further – I know that I can use wildcards in the ssh config file like: ```auto Host *.example.com Host 128.220.19.* ``` But what if I have a lot of different IP addresses or host names? Then I’d have to simply have a separate entry in my ssh config file for each one? J ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [May 27, 2014, 8:09pm UTC](https://forum.ansible.com/t/ansible-doesnt-use-ssh-config-file-specified-by-ssh-args/15308/15 "2014-05-27T20:09:40Z")
“Then I’d have to simply have a separate entry in my ssh config file for each one?” Yes, because you just said you couldn’t use wildcards 🙂 +1 to having private hostnames or conventions to make that easier.