# AWX credential to access jumphost used in proxycommand directive **URL:** \ **Category:** AWX Project\ **Tags:** awx\ **Created:** [September 27, 2018, 8:36am UTC](https://forum.ansible.com/t/awx-credential-to-access-jumphost-used-in-proxycommand-directive/28659 "2018-09-27T08:36:13Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\ **Post date:** [September 27, 2018, 8:36am UTC](https://forum.ansible.com/t/awx-credential-to-access-jumphost-used-in-proxycommand-directive/28659/1 "2018-09-27T08:36:13Z")
I have added a SSH config file and key to the awx\_task container to authenticate against a jumphost that is referred to in an inventory file with the variable “ansible\_ssh\_common\_args”. With this I’m able to run jobs which use this inventory via the jumphost. My reading of the Tower docs is that a Tower/AWX credential cannot be used to connect to a jumphost Pushing the SSH config file and key manually to the awx\_task container doesn’t seem to be a good way of working with a jumphost. Is there an automated way of doing this, that would enable me to add/remove entries from SSH config and add/remove SSH keys from the AWX container? ---
**Author:** ![Cesar\_Sanchez2](https://avatars.discourse-cdn.com/v4/letter/c/f6c823/32.png) [@Cesar\_Sanchez2](https://forum.ansible.com/u/Cesar_Sanchez2)\ **Post date:** [September 27, 2018, 3:44pm UTC](https://forum.ansible.com/t/awx-credential-to-access-jumphost-used-in-proxycommand-directive/28659/2 "2018-09-27T15:44:28Z")
What we do, is that we set our dynamic inventories having the whole ProxyCommand indicating the jumphost, so for example: [server1] server1.domain ansible\_ssh\_common\_args=‘-i -o IdentitiesOnly=yes -o ProxyCommand=“ssh -A -W %h%p -p 22 -o User= -o IdentitiesOnly=yes -i ”’ You can create a volume for the docker container to load your shared ssh keys, for example. -Cesar ---
**Author:** ![creisor](https://avatars.discourse-cdn.com/v4/letter/c/ecc23a/32.png) [@creisor](https://forum.ansible.com/u/creisor)\ **Post date:** [September 28, 2018, 2:46pm UTC](https://forum.ansible.com/t/awx-credential-to-access-jumphost-used-in-proxycommand-directive/28659/3 "2018-09-28T14:46:20Z")
+1 we take the same approach, it works well. ---
**Author:** ![Frank\_Dias](https://avatars.discourse-cdn.com/v4/letter/f/eada6e/32.png) [@Frank\_Dias](https://forum.ansible.com/u/Frank_Dias)\ **Post date:** [October 13, 2018, 2:08am UTC](https://forum.ansible.com/t/awx-credential-to-access-jumphost-used-in-proxycommand-directive/28659/4 "2018-10-13T02:08:27Z")
Where do you set the variable, can you set it in the inventory variable. Can one of you share a screen shot ---
**Author:** ![Frank\_Dias](https://avatars.discourse-cdn.com/v4/letter/f/eada6e/32.png) [@Frank\_Dias](https://forum.ansible.com/u/Frank_Dias)\ **Post date:** [October 13, 2018, 6:19pm UTC](https://forum.ansible.com/t/awx-credential-to-access-jumphost-used-in-proxycommand-directive/28659/5 "2018-10-13T18:19:06Z")
I have tried adding the following to the variables section of an inventory ansible\_user: centos ansible\_connection: ssh ansible\_ssh\_common\_args: ‘-o ProxyCommand=“ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -A -W %h:%p -q centos@x.x.x.x -i /var/lib/awx/projects/keys/jump.pem”’ when I run the job it is failing; \<172.19.50.51\> (255, ‘’, 'OpenSSH\_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017\r\ndebug1: Reading configuration data /etc/ssh/ssh\_config\r\ndebug1: /etc/ssh/ssh\_config line 58: Applying options for \*\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: Control socket “/tmp/awx\_31\_PZyy3K/cp/52961c7d86” does not exist\r\ndebug1: Executing proxy command: exec ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -A -W 172.19.50.51:22 -q centos@x.x.x.x -i /var/lib/awx/projects/keys/jump.pem\r\ndebug3: timeout: 10000 ms remain after connect\r\ndebug1: permanently\_set\_uid: 0/0\r\ndebug1: key\_load\_public: No such file or directory\r\ndebug1: identity file /root/.ssh/id\_rsa type -1\r\ndebug1: key\_load\_public: No such file or directory\r\ndebug1: identity file /root/.ssh/id\_rsa-cert type -1\r\ndebug1: key\_load\_public: No such file or directory\r\ndebug1: identity file /root/.ssh/id\_dsa type -1\r\ndebug1: key\_load\_public: No such file or directory\r\ndebug1: permanently\_drop\_suid: 0\r\ndebug… 87 fatal: [172.19.50.51]: UNREACHABLE! =\> { 88 “changed”: false, 89 “msg”: "Failed to connect to the host via ssh: OpenSSH\_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017\r\ndebug1: Reading configuration data /etc/ssh/ssh\_config\r\ndebug1: /etc/ssh/ssh\_config line 58: Applying options for \*\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: Control socket "/tmp/awx\_31\_PZyy3K/cp/52961c7d86" does not exist\r\ndebug1: Executing proxy command: exec ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -A -W 172.19.50.51:22 -q centos@x.x.x.x -i /var/lib/awx/projects/keys/jump.pem\r\ndebug3: timeout: 10000 ms remain after connect\r\ndebug1: permanently\_set\_uid: 0/0\r\ndebug1: key\_load\_public: No such file or directory\r\ndebug1: identity file /root/.ssh/id\_rsa type -1\r\ndebug1: key\_load\_public: No such file or directory\r\ndebug1: identity file /root/.ssh/id\_rsa-cert type -1\r\ndebug1: key\_load\_public: No such file or directory\r\ndebug1: identity file /root/.ss… what am I doing wrong here? /var/lib/awx/projects/keys/ is visible in awx-tasks docker container ---
**Author:** ![Frank\_Dias](https://avatars.discourse-cdn.com/v4/letter/f/eada6e/32.png) [@Frank\_Dias](https://forum.ansible.com/u/Frank_Dias)\ **Post date:** [October 13, 2018, 8:10pm UTC](https://forum.ansible.com/t/awx-credential-to-access-jumphost-used-in-proxycommand-directive/28659/6 "2018-10-13T20:10:12Z")
After working on this for a few hours I now have it working here is my var ssetting; ---
**Author:** ![rake](https://avatars.discourse-cdn.com/v4/letter/r/8e8cbc/32.png) [@rake](https://forum.ansible.com/u/rake)\ **Post date:** [December 2, 2022, 7:23pm UTC](https://forum.ansible.com/t/awx-credential-to-access-jumphost-used-in-proxycommand-directive/28659/7 "2022-12-02T19:23:14Z")
Just curious where did you change sshd\_config setting ? I mean is it on the target host or awx host itself ---
**Author:** ![Manolis\_Kartsonakis](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@Manolis\_Kartsonakis](https://forum.ansible.com/u/Manolis_Kartsonakis)\ **Post date:** [December 5, 2022, 12:30pm UTC](https://forum.ansible.com/t/awx-credential-to-access-jumphost-used-in-proxycommand-directive/28659/8 "2022-12-05T12:30:37Z")
We have our ssh config copied in the Execution environment image so it is applying the Proxycommand for all target hosts. Strangely awx@jumphost … is working without specifying or copying somewhere in the container the private key file. So we assumed that somehow the key part is successfully loaded and used from the credential from awx in our job templates (which is using the same username). Στις Παρασκευή 2 Δεκεμβρίου 2022 στις 9:23:14 μ.μ. UTC+2, ο χρήστης [rake...@gmail.com](mailto:rake...@gmail.com) έγραψε: