# Ansible ssh fails to connect to host via ssh. Permission denied - Raw ssh works **URL:** \ **Category:** Ansible Project\ **Created:** [October 9, 2018, 1:22am UTC](https://forum.ansible.com/t/ansible-ssh-fails-to-connect-to-host-via-ssh-permission-denied-raw-ssh-works/28746 "2018-10-09T01:22:49Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Fabio\_Gomes\_Sakiyama](https://avatars.discourse-cdn.com/v4/letter/f/b77776/32.png) [@Fabio\_Gomes\_Sakiyama](https://forum.ansible.com/u/Fabio_Gomes_Sakiyama)\ **Post date:** [October 9, 2018, 1:22am UTC](https://forum.ansible.com/t/ansible-ssh-fails-to-connect-to-host-via-ssh-permission-denied-raw-ssh-works/28746/1 "2018-10-09T01:22:49Z")
Hello guys, I’m trying to use the ansible\_authorized keys to create VMs (with packer and terraform), adding my workspace key to VMs authorized keys. I think it worked because if I execute ''ssh root@myVM", it connects without asking password. But when I execute “ansible all -m ping -u root” to that same host, it fails with the error “sshh fails to connect to host via ssh. Permission denied”. I’m really confused and struggling to understand that, since a raw ssh works and the ansible ssh doesn’t. What am I missing?? Thanks in advance! ---
**Author:** ![chenchireddy\_guvvala](https://avatars.discourse-cdn.com/v4/letter/c/46a35a/32.png) [@chenchireddy\_guvvala](https://forum.ansible.com/u/chenchireddy_guvvala)\ **Post date:** [October 9, 2018, 1:30am UTC](https://forum.ansible.com/t/ansible-ssh-fails-to-connect-to-host-via-ssh-permission-denied-raw-ssh-works/28746/2 "2018-10-09T01:30:30Z")
You also add ssh\_keys to the same host. like below #ssh-copy-id root@loclahost or ssh-copy-id [root@127.0.0.1](mailto:root@127.0.0.1) Thanks ---
**Author:** ![Fabio\_Gomes\_Sakiyama](https://avatars.discourse-cdn.com/v4/letter/f/b77776/32.png) [@Fabio\_Gomes\_Sakiyama](https://forum.ansible.com/u/Fabio_Gomes_Sakiyama)\ **Post date:** [October 9, 2018, 1:33am UTC](https://forum.ansible.com/t/ansible-ssh-fails-to-connect-to-host-via-ssh-permission-denied-raw-ssh-works/28746/3 "2018-10-09T01:33:38Z")
Hi Chen, AFAIK, ssh-copy-id does exactly what the ansible module ‘authorized\_keys’ does, which is copy the desired ssh-key to the server authorized\_keys. If I’m correct, this step is already done, so the problem is something else ☹ ---
**Author:** ![chenchireddy\_guvvala](https://avatars.discourse-cdn.com/v4/letter/c/46a35a/32.png) [@chenchireddy\_guvvala](https://forum.ansible.com/u/chenchireddy_guvvala)\ **Post date:** [October 9, 2018, 1:48am UTC](https://forum.ansible.com/t/ansible-ssh-fails-to-connect-to-host-via-ssh-permission-denied-raw-ssh-works/28746/4 "2018-10-09T01:48:44Z")
Hi, **ssh-keygen** creates the public and private keys. **ssh-copy-id** copies the local-host’s public key to the remote-host’s authorized\_keys file. ssh-copy-id also assigns proper permission to the remote-host’s home, ~/.ssh, and ~/.ssh/authorized\_keys. Check host entry in /etc/host file 127.0.0.1 localhost Check command# ansible localhost -m ping -vv Thanks. ---
**Author:** ![Fabio\_Gomes\_Sakiyama](https://avatars.discourse-cdn.com/v4/letter/f/b77776/32.png) [@Fabio\_Gomes\_Sakiyama](https://forum.ansible.com/u/Fabio_Gomes_Sakiyama)\ **Post date:** [October 9, 2018, 2:05am UTC](https://forum.ansible.com/t/ansible-ssh-fails-to-connect-to-host-via-ssh-permission-denied-raw-ssh-works/28746/5 "2018-10-09T02:05:42Z")
Hi Chen, I’m aware of ssh-key gen and ssh-copy-id. The ansible module “authorized\_keys” does the ssh-copy-id for me, so I don’t need to run it manually. The ssh works because when I execute ''ssh root@myAddress", it works perfectly. The problem is when doing exact the same thing, but with ansible. ---
**Author:** ![chenchireddy\_guvvala](https://avatars.discourse-cdn.com/v4/letter/c/46a35a/32.png) [@chenchireddy\_guvvala](https://forum.ansible.com/u/chenchireddy_guvvala)\ **Post date:** [October 9, 2018, 2:47am UTC](https://forum.ansible.com/t/ansible-ssh-fails-to-connect-to-host-via-ssh-permission-denied-raw-ssh-works/28746/6 "2018-10-09T02:47:35Z")
As I am aware Ansible always assumes jobs are running SSH keys either local system or remote system. Thanks. ---
**Author:** ![Fabio\_Gomes\_Sakiyama](https://avatars.discourse-cdn.com/v4/letter/f/b77776/32.png) [@Fabio\_Gomes\_Sakiyama](https://forum.ansible.com/u/Fabio_Gomes_Sakiyama)\ **Post date:** [October 9, 2018, 2:16pm UTC](https://forum.ansible.com/t/ansible-ssh-fails-to-connect-to-host-via-ssh-permission-denied-raw-ssh-works/28746/7 "2018-10-09T14:16:25Z")
Hi Chen, I manage to solve the problem. I need to pass the public key of a different user. In addition, I changed the way to connect to the VMs, since I am using openstack, I configured ansible to use the keypair to connect. Thanks ---
**Author:** ![dch](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dch/32/7132_2.png) [@dch](https://forum.ansible.com/u/dch)\ **Post date:** [October 10, 2018, 7:54am UTC](https://forum.ansible.com/t/ansible-ssh-fails-to-connect-to-host-via-ssh-permission-denied-raw-ssh-works/28746/8 "2018-10-10T07:54:45Z")
Hi Fabio, I see you found a solution, but this is what I'd recommend doing next time. Add -vvv and read the resulting output carefully. You can splice the ssh command from Ansible back into the shell to work out what is missing or different to just running ssh@\ locally. Usually this is because the username is different or you’re using a different ssh key than expected. e.g.: $ ansible-playbook site.yml --diff --check -vvv Gathering Facts... Using module file /usr/local/lib/python2.7/site-packages/ansible/modules/system/setup.py \ ESTABLISH SSH CONNECTION FOR USER: root Using module file /usr/local/lib/python2.7/site-packages/ansible/modules/system/setup.py \ SSH: EXEC ssh -F ./ssh\_config -o StrictHostKeyChecking=no -o Port=2200 -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=root -o ConnectTimeout=30 -tt i09.com 'which -s jailme' \ ESTABLISH SSH CONNECTION FOR USER: ansible \ SSH: EXEC ssh -F ./ssh\_config -o StrictHostKeyChecking=no -o Port=2200 -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=30 i09.com '/bin/sh -c '"'"'/usr/local/bin/python2.7 && sleep 0'"'"'' \ (255, '', 'root@i09com: Permission denied (publickey).\r\n') ... you can then try `ssh -F ./ssh_config -o ....` until you see what's missing. Check User= first. I have some further settings in ansible.cfg and a per-customer ssh\_config, in a git repo: # ansible.cfg [defaults] inventory = ./hosts.ini forks = 20 timeout = 30 poll\_interval = 15 transport = ssh retry\_files\_enabled = False [ssh\_connection] ssh\_args = -F ./ssh\_config pipelining = True # ssh\_config Host \*.i09.com www api beta couchdb cache rabbit vault     UseRoaming no     GSSAPIAuthentication no     KbdInteractiveAuthentication no     ServerAliveInterval 240     ControlMaster auto     ControlPath ~/.ssh/%r@%h:%p     ControlPersist 30m     KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256     SendEnv VAULT\_TOKEN     port 2200     user ansible     ForwardAgent yes ---
**Author:** ![Arvind\_Thatikonda](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Arvind\_Thatikonda](https://forum.ansible.com/u/Arvind_Thatikonda)\ **Post date:** [November 19, 2018, 10:14pm UTC](https://forum.ansible.com/t/ansible-ssh-fails-to-connect-to-host-via-ssh-permission-denied-raw-ssh-works/28746/9 "2018-11-19T22:14:06Z")
Hi Fabio, can you please clarify how you managed to solve it. I created user ansible, the public keys ID\_RSA.pub are stored under /home/ansible/.ssh folders. the ssh-copy-id should copy to target server - client when I run ssh-copy-id ansible@privateip. I create same user name ‘ansible’ on remote server. I get permission denied error. ---
**Author:** ![Fabio\_Gomes\_Sakiyama](https://avatars.discourse-cdn.com/v4/letter/f/b77776/32.png) [@Fabio\_Gomes\_Sakiyama](https://forum.ansible.com/u/Fabio_Gomes_Sakiyama)\ **Post date:** [November 19, 2018, 11:48pm UTC](https://forum.ansible.com/t/ansible-ssh-fails-to-connect-to-host-via-ssh-permission-denied-raw-ssh-works/28746/10 "2018-11-19T23:48:04Z")
Hi Arvind, It was pretty simple 'cause I was messing up the users. Are you running your playbook with root? Which user you set on your hosts as ansible\_user? Are you using become inside your playbooks? Also, I stopped using ssh, instead I’m using openstack keypair. And try Dave’s suggestion, it’s very useful: > Hi Fabio, > > I see you found a solution, but this is what I’d recommend doing next time. > > Add -vvv and read the resulting output carefully. You can splice the ssh command from Ansible back into the shell to work out what is missing or different to just running ssh@ locally. > > Usually this is because the username is different or you’re using a different ssh key than expected. > e.g.: > $ ansible-playbook site.yml --diff --check -vvv > > Gathering Facts… > Using module file /usr/local/lib/python2.7/site-packages/ansible/modules/system/setup.py > \<[www@i09.com](mailto:www@i09.com)\> ESTABLISH SSH CONNECTION FOR USER: root > Using module file /usr/local/lib/python2.7/site-packages/ansible/modules/system/setup.py > \<[i09.com](http://i09.com/)\> SSH: EXEC ssh -F ./ssh\_config -o StrictHostKeyChecking=no -o Port=2200 -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=root -o ConnectTimeout=30 -tt [i09.com](http://i09.com/) ‘which -s jailme’ > \<[i09.koan-ci.com](http://i09.koan-ci.com/)\> ESTABLISH SSH CONNECTION FOR USER: ansible > \<[i09.com](http://i09.com/)\> SSH: EXEC ssh -F ./ssh\_config -o StrictHostKeyChecking=no -o Port=2200 -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=30 [i09.com](http://i09.com/) ‘/bin/sh -c ‘"’"’/usr/local/bin/python2.7 && sleep 0’“'”‘’ > \<[i09.com](http://i09.com/)\> (255, ‘’, ‘root@i09com: Permission denied (publickey).\r\n’) And finally, if possible, post your playbook. ---
**Author:** ![Arvind\_Thatikonda](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Arvind\_Thatikonda](https://forum.ansible.com/u/Arvind_Thatikonda)\ **Post date:** [November 19, 2018, 11:56pm UTC](https://forum.ansible.com/t/ansible-ssh-fails-to-connect-to-host-via-ssh-permission-denied-raw-ssh-works/28746/11 "2018-11-19T23:56:03Z")
Hi Fabio, I am not using the playbook for this particular task, I am creating an ansible control server and client. I am trying to connect from control server to client after generating the ssh keys. I used ssh-keygen on ubuntu server using ansible user. I am setting a passwordless connection from the ansible control server /localhost to client. ---
**Author:** ![Fabio\_Gomes\_Sakiyama](https://avatars.discourse-cdn.com/v4/letter/f/b77776/32.png) [@Fabio\_Gomes\_Sakiyama](https://forum.ansible.com/u/Fabio_Gomes_Sakiyama)\ **Post date:** [November 21, 2018, 8:07am UTC](https://forum.ansible.com/t/ansible-ssh-fails-to-connect-to-host-via-ssh-permission-denied-raw-ssh-works/28746/12 "2018-11-21T08:07:24Z")
Sorry, couldnt look further. Could you provide any log of the permission denied you’re getting?