Ansible jumpbox/bastion host configuration and private server

Get Help
1

Hi,
I have set up installed ansible on a server which is an EC2 , the ec2 in which i have installed ansible has the public IP which means its in public subnet. For another configuration I have launched jumpbox server which is in public subnet also. I have launched EC2 on private subnet which is able to access with jumpbox server , I have written a configuration file in .ssh folder of the jumpbox EC2 . Here is a example :

Host bastion-host
HostName
User ubuntu
Port 22
IdentityFile key/file/path
IdentitiesOnly yes

Host private-ec2
HostName
User ubuntu
Port 22
IdentityFile key/file/path
IdentitiesOnly yes
ProxyJump bastion-host

And i have allowed the SG id of jumpbox in Private EC2 SG
I have got some docs where its mentioned to make changes in the inv file , here i did the inv file as follows :
[jumpbox] (its the group)

[test] (its the group)
host01 ansible_host=
ansible_ssh_user= ansible
ansible_ssh_private_key_file= key/file/path

host02 ansible_host=
ansible_ssh_user= ansible
ansible_ssh_private_key_file= key/file/path

host03 ansible_host=
ansible_ssh_user= ansible
ansible_ssh_private_key_file= key/file/path

[jumpbox:vars]
ansible_user= ubuntu
private_key_file= key/file/path
ansible_ssh_common_args=‘-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ProxyCommand=“ssh -W %h:%p -q ansible@”’
The above file i have written in the ansible server.
I am able to connect to jumpbox with the ansible and able to get ping response but i am unable to connect to private server with the ansible can you help with it . From many days i am stuck with it.

1 Like
2

Hi,

I’d need more time to wrap my head around your setup, but here are a few remarks / questions, top of my head:

  • Isn’t your jumpbox the ‘bastion-host’ you’re mentioning in ssh config up there ? If so, why would you define this host on your bastion ssh config, as well as using it for private-ec2 host ? This config file should be on your Ansible control node (the one you’re running Ansible playbooks from). Or I’m missing something ?
  • ‘HostName’ fields are empty in your ssh config; why is that ?
  • ‘jumpbox’ group is empty in your inventory. If you plan to use it somewhere, as your group vars suppose, your jumpbox / bastion shoud be in there
  • ansible_ssh_common_args should probably be applied to your remote hosts, not your jumpbox. I think ?
  • I’m not sure ansible@ works in your ProxyCommand opt. I’m guessing you’d like to authenticate using ‘ansible’ user on your jumpbox using this command, but I think you’d have to specify the host as well, not just the user

Then again, I might be reading all of this wrong.

In comparison, I simply set the ANSIBLE_SSH_ARGS envvar on my Ansible control node to use our bastion as jumpbox to reach managed nodes with Ansible, like this: ANSIBLE_SSH_ARGS=-o ProxyJump=my_bastion_host -o User=my_ansible_remote_user -o IdentityFile=my_ansible_private_key_filepath

‘my_bastion_host’ referring to corresponding host in ssh client config on the same machine:

Host my_bastion_host
  HostName my_bastion_hostname
  User my_user_on_bastion_host
  IdentityFile my_user_private_key_filepath

And ‘my_ansible_private_key_filepath’ being the private key file local path I use to login through ssh on my remote / managed node (Ansible targets) using ‘my_ansible_remote_user’.

Note you could use ProxyCommand instead of ProxyJump depending on Openssh version you’re using on both client and server.

So please tell me what I misunderstood and we’ll take it from there.