# Ansible errors for non-root sudo users

**URL:** <https://forum.ansible.com/t/ansible-errors-for-non-root-sudo-users/13812>\
**Category:** Ansible Project\
**Tags:** ubuntu\
**Created:** [October 31, 2013, 8:19am UTC](https://forum.ansible.com/t/ansible-errors-for-non-root-sudo-users/13812 "2013-10-31T08:19:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ansible\_User1](https://avatars.discourse-cdn.com/v4/letter/a/2acd7d/32.png) [@Ansible\_User1](https://forum.ansible.com/u/Ansible_User1)\
**Post date:** [October 31, 2013, 8:19am UTC](https://forum.ansible.com/t/ansible-errors-for-non-root-sudo-users/13812/1 "2013-10-31T08:19:47Z")

</div>

When I try to fire any sudo commands using ansible (both command line tool and Python API) using **non-root sudo users** , it throws errors as follows:

(Note that “xyz” is a non-root user with sudo permissions)

**Error Patterns observed while firing the command “/etc/init.d/abc stop” on a CentOS 6.3 machine from the same machine itself:**

1. $ansible 192.168.110.97 -a “/etc/init.d/abc stop” -u “xyz” -s -K

Response: 192.168.110.97 | FAILED =\> FAILED: No authentication methods available

1. $ansible 192.168.110.97 -a “/etc/init.d/abc stop” -u “xyz” -s -k  
This case took a long time (3 mins approx.) and then got the following response:  
Response: 192.168.110.97 | FAILED =\> failed to parse: [sudo via ansible, key=wwhnmtchgnaokcwrldorwgfnxozkkcbs] password: )

2. $ansible 192.168.110.97 -a “/etc/init.d/abc stop” -U “xyz” -s -k

Response: 192.168.110.97 | FAILED | rc=1 \>\>  
Stopping abc: [FAILED]rm: cannot remove `/var/run/abc.pid’: Permission denied

1. $ansible 192.168.110.97 -a “/etc/init.d/abc stop” -U “xyz” -s -K  
Response: 192.168.110.97 | FAILED =\> FAILED: No authentication methods available

**Error Patterns observed while firing the command “/etc/init.d/abc stop” on an Ubuntu 12.04 machine from a CentOS 6.3 machine:**

1. $ansible 10.71.71.49 -a “/etc/init.d/abc stop” -u “xyz” -k -s  
No Response for more than 10 minutes

2. $ansible 10.71.71.49 -a “/etc/init.d/abc stop” -u “xyz” -K -s  
Response: 10.71.71.49 | FAILED =\> FAILED: ssh xyz@10.71.71.49:22 : Private key file is encrypted  
To connect as a different user, use -u .

3. $ansible 10.71.71.49 -a “/etc/init.d/abc stop” -U “xyz” -k -s  
Response: 10.71.71.49 | FAILED =\> FAILED: Authentication failed.

4. $ansible 10.71.71.49 -a “/etc/init.d/abc stop” -U “xyz” -K -s  
Response: 10.71.71.49 | FAILED =\> FAILED: ssh root@10.71.71.49:22 : Private key file is encrypted  
To connect as a different user, use -u .

**Error Patterns observed while firing the command “/etc/init.d/abc stop” on a CentOS 6.3 machine from an Ubuntu 12.04 machine:**

1. $ansible 10.71.71.53 -a “/etc/init.d/abc stop” -u “xyz” -k -s  
Response: 10.71.71.53 | FAILED =\> failed to parse: [sudo via ansible, key=zumlkykoeuwpxgdlsqrofkwejiwvlqdk] password:

2. $ansible 10.71.71.53 -a “/etc/init.d/abc stop” -u “xyz” -K -s  
Response: 10.71.71.53 | FAILED =\> SSH encountered an unknown error during the connection. We recommend you re-run the command using -vvvv, which will enable SSH debugging output to help diagnose the issue

3. $ansible 10.71.71.53 -a “/etc/init.d/abc stop” -U “xyz” -k -s  
Response: 10.71.71.53 | FAILED =\> Authentication failure.

4. $ansible 10.71.71.53 -a “/etc/init.d/abc stop” -U “xyz” -K -s  
Response: 10.71.71.53 | FAILED =\> SSH encountered an unknown error during the connection. We recommend you re-run the command using -vvvv, which will enable SSH debugging output to help diagnose the issue

On trying above case with -vvvv:

10.71.71.53 | FAILED =\> SSH encountered an unknown error. The output was:  
OpenSSH\_5.9p1 Debian-5ubuntu1.1, OpenSSL 1.0.1 14 Mar 2012  
debug1: Reading configuration data /etc/ssh/ssh\_config  
debug1: /etc/ssh/ssh\_config line 19: Applying options for \*  
debug1: auto-mux: Trying existing master  
debug1: Control socket “/root/.ansible/cp/ansible-ssh-10.71.71.53-22-root” does not exist  
debug2: ssh\_connect: needpriv 0  
debug1: Connecting to 10.71.71.53 [10.71.71.53] port 22.  
debug2: fd 3 setting O\_NONBLOCK  
debug1: fd 3 clearing O\_NONBLOCK  
debug1: Connection established.  
debug3: timeout: 10000 ms remain after connect  
debug1: permanently\_set\_uid: 0/0  
debug3: Incorrect RSA1 identifier  
debug3: Could not load “/root/.ssh/id\_rsa” as a RSA1 public key  
debug1: identity file /root/.ssh/id\_rsa type 1  
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048  
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048  
debug1: identity file /root/.ssh/id\_rsa-cert type -1  
debug1: identity file /root/.ssh/id\_dsa type -1  
debug1: identity file /root/.ssh/id\_dsa-cert type -1  
debug1: identity file /root/.ssh/id\_ecdsa type -1  
debug1: identity file /root/.ssh/id\_ecdsa-cert type -1  
debug1: Remote protocol version 2.0, remote software version OpenSSH\_5.3  
debug1: match: OpenSSH\_5.3 pat OpenSSH\*  
debug1: Enabling compatibility mode for protocol 2.0  
debug1: Local version string SSH-2.0-OpenSSH\_5.9p1 Debian-5ubuntu1.1  
debug2: fd 3 setting O\_NONBLOCK  
debug3: load\_hostkeys: loading entries for host “10.71.71.53” from file “/root/.ssh/known\_hosts”  
debug3: load\_hostkeys: found key type RSA in file /root/.ssh/known\_hosts:2  
debug3: load\_hostkeys: loaded 1 keys  
debug3: order\_hostkeyalgs: prefer hostkeyalgs: [ssh-rsa-cert-v01@openssh.com](mailto:ssh-rsa-cert-v01@openssh.com),ssh-rsa-cert-v00@openssh.com,ssh-rsa  
debug1: SSH2\_MSG\_KEXINIT sent  
debug1: SSH2\_MSG\_KEXINIT received  
debug2: kex\_parse\_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1  
debug2: kex\_parse\_kexinit: [ssh-rsa-cert-v01@openssh.com](mailto:ssh-rsa-cert-v01@openssh.com),ssh-rsa-cert-v00@openssh.com,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-dss-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-dss  
debug2: kex\_parse\_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se  
debug2: kex\_parse\_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se  
debug2: kex\_parse\_kexinit: [hmac-md5,hmac-sha1,umac-64@openssh.com](mailto:hmac-md5,hmac-sha1,umac-64@openssh.com),hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96  
debug2: kex\_parse\_kexinit: [hmac-md5,hmac-sha1,umac-64@openssh.com](mailto:hmac-md5,hmac-sha1,umac-64@openssh.com),hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96  
debug2: kex\_parse\_kexinit: [none,zlib@openssh.com](mailto:none,zlib@openssh.com),zlib  
debug2: kex\_parse\_kexinit: [none,zlib@openssh.com](mailto:none,zlib@openssh.com),zlib  
debug2: kex\_parse\_kexinit:  
debug2: kex\_parse\_kexinit:  
debug2: kex\_parse\_kexinit: first\_kex\_follows 0  
debug2: kex\_parse\_kexinit: reserved 0  
debug2: kex\_parse\_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1  
debug2: kex\_parse\_kexinit: ssh-rsa,ssh-dss  
debug2: kex\_parse\_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se  
debug2: kex\_parse\_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se  
debug2: kex\_parse\_kexinit: [hmac-md5,hmac-sha1,umac-64@openssh.com](mailto:hmac-md5,hmac-sha1,umac-64@openssh.com),hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96  
debug2: kex\_parse\_kexinit: [hmac-md5,hmac-sha1,umac-64@openssh.com](mailto:hmac-md5,hmac-sha1,umac-64@openssh.com),hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96  
debug2: kex\_parse\_kexinit: [none,zlib@openssh.com](mailto:none,zlib@openssh.com)  
debug2: kex\_parse\_kexinit: [none,zlib@openssh.com](mailto:none,zlib@openssh.com)  
debug2: kex\_parse\_kexinit:  
debug2: kex\_parse\_kexinit:  
debug2: kex\_parse\_kexinit: first\_kex\_follows 0  
debug2: kex\_parse\_kexinit: reserved 0  
debug2: mac\_setup: found hmac-md5  
debug1: kex: server-\>client aes128-ctr hmac-md5 none  
debug2: mac\_setup: found hmac-md5  
debug1: kex: client-\>server aes128-ctr hmac-md5 none  
debug1: SSH2\_MSG\_KEX\_DH\_GEX\_REQUEST(1024\<1024\<8192) sent  
debug1: expecting SSH2\_MSG\_KEX\_DH\_GEX\_GROUP  
debug2: dh\_gen\_key: priv key bits set: 127/256  
debug2: bits set: 541/1024  
debug1: SSH2\_MSG\_KEX\_DH\_GEX\_INIT sent  
debug1: expecting SSH2\_MSG\_KEX\_DH\_GEX\_REPLY  
debug1: Server host key: RSA 3f:f8:9e:92:4d:75:98:4e:09:e5:8e:18:fa:5a:2e:35  
debug3: load\_hostkeys: loading entries for host “10.71.71.53” from file “/root/.ssh/known\_hosts”  
debug3: load\_hostkeys: found key type RSA in file /root/.ssh/known\_hosts:2  
debug3: load\_hostkeys: loaded 1 keys  
debug1: Host ‘10.71.71.53’ is known and matches the RSA host key.  
debug1: Found key in /root/.ssh/known\_hosts:2  
debug2: bits set: 536/1024  
debug1: ssh\_rsa\_verify: signature correct  
debug2: kex\_derive\_keys  
debug2: set\_newkeys: mode 1  
debug1: SSH2\_MSG\_NEWKEYS sent  
debug1: expecting SSH2\_MSG\_NEWKEYS  
debug2: set\_newkeys: mode 0  
debug1: SSH2\_MSG\_NEWKEYS received  
debug1: Roaming not allowed by server  
debug1: SSH2\_MSG\_SERVICE\_REQUEST sent  
debug2: service\_accept: ssh-userauth  
debug1: SSH2\_MSG\_SERVICE\_ACCEPT received  
debug2: key: /root/.ssh/id\_rsa (0x7fbdf70d0f40)  
debug2: key: /root/.ssh/id\_dsa ((nil))  
debug2: key: /root/.ssh/id\_ecdsa ((nil))  
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password  
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password  
debug3: preferred gssapi-with-mic,gssapi-keyex,hostbased,publickey  
debug3: authmethod\_lookup gssapi-with-mic  
debug3: remaining preferred: gssapi-keyex,hostbased,publickey  
debug3: authmethod\_is\_enabled gssapi-with-mic  
debug1: Next authentication method: gssapi-with-mic  
debug1: Unspecified GSS failure. Minor code may provide more information  
Cannot determine realm for numeric host address

debug1: Unspecified GSS failure. Minor code may provide more information  
Cannot determine realm for numeric host address

debug1: Unspecified GSS failure. Minor code may provide more information

debug1: Unspecified GSS failure. Minor code may provide more information  
Cannot determine realm for numeric host address

debug2: we did not send a packet, disable method  
debug3: authmethod\_lookup gssapi-keyex  
debug3: remaining preferred: hostbased,publickey  
debug3: authmethod\_is\_enabled gssapi-keyex  
debug1: Next authentication method: gssapi-keyex  
debug1: No valid Key exchange context  
debug2: we did not send a packet, disable method  
debug3: authmethod\_lookup publickey  
debug3: remaining preferred: ,publickey  
debug3: authmethod\_is\_enabled publickey  
debug1: Next authentication method: publickey  
debug1: Offering RSA public key: /root/.ssh/id\_rsa  
debug3: send\_pubkey\_test  
debug2: we sent a publickey packet, wait for reply  
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password  
debug1: Trying private key: /root/.ssh/id\_dsa  
debug3: no such identity: /root/.ssh/id\_dsa  
debug1: Trying private key: /root/.ssh/id\_ecdsa  
debug3: no such identity: /root/.ssh/id\_ecdsa  
debug2: we did not send a packet, disable method  
debug1: No more authentication methods to try.  
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).

---

<div class="post-metadata">

**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\
**Post date:** [October 31, 2013, 4:24pm UTC](https://forum.ansible.com/t/ansible-errors-for-non-root-sudo-users/13812/2 "2013-10-31T16:24:40Z")

</div>

Is the ansible\_ssh\_user for the host non-root? What user is the ssh connection being made with?