# Ansible vs sshd config

**URL:** <https://forum.ansible.com/t/ansible-vs-sshd-config/30791>\
**Category:** Ansible Project\
**Created:** [July 16, 2019, 10:58am UTC](https://forum.ansible.com/t/ansible-vs-sshd-config/30791 "2019-07-16T10:58:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ermanno\_Travaglino](https://avatars.discourse-cdn.com/v4/letter/e/3ab097/32.png) [@Ermanno\_Travaglino](https://forum.ansible.com/u/Ermanno_Travaglino)\
**Post date:** [July 16, 2019, 10:58am UTC](https://forum.ansible.com/t/ansible-vs-sshd-config/30791/1 "2019-07-16T10:58:36Z")

</div>

Hi there,  
I’m using Ansible to manage target servers with following /etc/ssh/sshd\_config configuration:

"  
…  
PasswordAuthentication no  
…  
ChallengeResponseAuthentication yes  
…  
"

I have the root password of target servers but actually I can’t use the ansible “expect” module neither the ssh private/public key exchange, just the following:

ansible\_connection: ssh  
ansible\_port=22  
ansible\_host: \< host \>  
ansible\_ssh\_user: root  
ansible\_password: \< root password \>  
ansible\_ssh\_extra\_args: \< ??? \>

Which “ansible\_ssh\_extra\_args” do you suggest using to allow the connection? Otherwise, is it needed to patch the ansible python code to add this new features?

Thanks.

KR,  
Ermanno

---

<div class="post-metadata">

**Author:** ![erichymowitz](https://avatars.discourse-cdn.com/v4/letter/e/9d8465/32.png) [@erichymowitz](https://forum.ansible.com/u/erichymowitz)\
**Post date:** [July 16, 2019, 6:54pm UTC](https://forum.ansible.com/t/ansible-vs-sshd-config/30791/2 "2019-07-16T18:54:13Z")

</div>

I don’t fully understand your question, because you said both:

> PasswordAuthentication no

and

> I have the root password of target servers

That said …

If you read this web page

[https://serverfault.com/questions/838113/handling-keyboard-interactive-inputs-with-ansible](https://serverfault.com/questions/838113/handling-keyboard-interactive-inputs-with-ansible)

and the various github pages that it refers to, you will find that Ansible does not support ChallengeResponseAuthentication, and has no plans to support it.

I will also note that logging into your server as root is generally a bad idea, and it’s blocked by (almost) every default ssh configuration.

–EbH