# Ansible provisioning through bastion SSH host

**URL:** <https://forum.ansible.com/t/ansible-provisioning-through-bastion-ssh-host/18785>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [July 16, 2015, 6:24pm UTC](https://forum.ansible.com/t/ansible-provisioning-through-bastion-ssh-host/18785 "2015-07-16T18:24:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![andrew2](https://avatars.discourse-cdn.com/v4/letter/a/58956e/32.png) [@andrew2](https://forum.ansible.com/u/andrew2)\
**Post date:** [July 16, 2015, 6:24pm UTC](https://forum.ansible.com/t/ansible-provisioning-through-bastion-ssh-host/18785/1 "2015-07-16T18:24:59Z")

</div>

Hi folks,

I’m encountering issues provisioning with Ansible via SSH from outside our datacenter (well, AWS Virtual Private Cloud).

Our bastion hosts (“jump boxes”) are configured to accept SSH keys from staff members. Boxes behind the bastion hosts accept only the SSH keys created for the jumpbox user on the bastion hosts. This makes our administration easier in the event of key compromise staff turnover (only need to rotate out on the jumpboxes).

The ProxyCommand examples I’ve seen for Ansible rely on agent forwarding and netcat. I want Ansible to SSH in to the bastion host, then run a second SSH command with the private key of the bastion host. Thus agent forwarding is useless here. I’ve tried replacing the netcat ProxyCommand with “ssh -q -t awsjumpbox1 ssh -p %p %h” and I get mysterious failures that even -vvvv doesn’t provide much insight on. For instance:

fatal: [172.31.17.144] =\> SSH Error: -bash: line 1: SSH-2.0-OpenSSH\_6.6.1\_hpn13v11: command not found  
It is sometimes useful to re-run the command using -vvvv, which prints SSH debug output to help diagnose the issue.

Our ansible.cfg looks like:

[defaults]  
host\_key\_checking = False

[ssh\_connection]  
ssh\_args = -o ControlPersist=15m -F ssh.config -q  
scp\_if\_ssh = True  
control\_path = ~/.ssh/mux-%%r@%%h:%%p

Our ssh.config (simplified) looks like:

Host jumpbox  
HostName (redacted)  
User (redacted)  
BatchMode yes  
PasswordAuthentication no

Host \*  
ServerAliveInterval 60  
TCPKeepAlive yes  
#ProxyCommand ssh -q -A -t jumpbox nc %h %p # have tried this one too  
ProxyCommand ssh -q -t jumpbox ssh -p %p %h  
ControlMaster auto  
ControlPath ~/.ssh/ansible-%r@%h:%p  
ControlPersist 8h  
User (redacted)

Our boxes are running the standard Amazon AMI (which I am led to believe are CentOS-based). We are open to rethinking the aforementioned strategy re: the keys if that’s the only way.

I’ll be interested in anyone’s thoughts on the matter. Thank you.

Best regards,

Andrew Merenbach  
Senior DevOps Engineer at Edlio Inc

---

<div class="post-metadata">

**Author:** ![andrew2](https://avatars.discourse-cdn.com/v4/letter/a/58956e/32.png) [@andrew2](https://forum.ansible.com/u/andrew2)\
**Post date:** [July 16, 2015, 11:59pm UTC](https://forum.ansible.com/t/ansible-provisioning-through-bastion-ssh-host/18785/2 "2015-07-16T23:59:06Z")

</div>

Correction: the non-working command is “ssh -q -t jumpbox1 ssh -p %p %h” (not awsjumpbox1)

---

<div class="post-metadata">

**Author:** ![Paul\_Markham](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@Paul\_Markham](https://forum.ansible.com/u/Paul_Markham)\
**Post date:** [July 19, 2015, 3:34am UTC](https://forum.ansible.com/t/ansible-provisioning-through-bastion-ssh-host/18785/3 "2015-07-19T03:34:41Z")

</div>

I had a play with this and I can’t get it to work either.

Whilst running ‘ssh -tt bastion01 ssh -tt server01’ does works from the command line, it doesn’t work when used as a ProxyCommand in .ssh/config.

This makes sense though. When using ProxyCommand you’re telling your ssh client to connect to a remote server, the hops in between are transparent to it. So, the private key needs to be on your local machine, not on some intermediate machine.

If you’re managing accounts and keys through Ansible, changing keys or removing an account shouldn’t be a big deal.