# Failed to connect to the host via ssh: OpenSSH\_8.0p1, OpenSSL 1.1.1k FIPS 25 Mar 2021 **URL:** \ **Category:** AWX Project\ **Created:** [May 31, 2022, 3:12am UTC](https://forum.ansible.com/t/failed-to-connect-to-the-host-via-ssh-openssh-8-0p1-openssl-1-1-1k-fips-25-mar-2021/36672 "2022-05-31T03:12:03Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Karthik\_Kumaraswamy](https://avatars.discourse-cdn.com/v4/letter/k/3be4f8/32.png) [@Karthik\_Kumaraswamy](https://forum.ansible.com/u/Karthik_Kumaraswamy)\ **Post date:** [May 31, 2022, 3:12am UTC](https://forum.ansible.com/t/failed-to-connect-to-the-host-via-ssh-openssh-8-0p1-openssl-1-1-1k-fips-25-mar-2021/36672/1 "2022-05-31T03:12:03Z")
Hi Team I am receiving below error while connecting to a server via an isolated node \<172.20.1.111\> (255, b’', b’OpenSSH\_8.0p1, OpenSSL 1.1.1k FIPS 25 Mar 2021\r\ndebug1: Reading configuration data /etc/ssh/ssh\_config\r\ndebug3: /etc/ssh/ssh\_config line 52: Including file /etc/ssh/ssh\_config.d/05-redhat.conf depth 0\r\ndebug1: Reading configuration data /etc/ssh/ssh\_config.d/05-redhat.conf\r\ndebug2: checking match for 'final all' host 172.20.1.111 originally 172.20.1.111\r\ndebug3: /etc/ssh/ssh\_config.d/05-redhat.conf line 3: not matched 'final'\r\ndebug2: match not found\r\ndebug3: /etc/ssh/ssh\_config.d/05-redhat.conf line 5: Including file /etc/crypto-policies/back-ends/openssh.config depth 1 (parse only)\r\ndebug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config\r\ndebug3: gss kex names ok: [gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-,gss-gex-sha1-,gss-group14-sha1-]\r\ndebug3: kex names ok: [curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-gr… fatal: [cyclonetest]: UNREACHABLE! =\> { “changed”: false, “msg”: "Failed to connect to the host via ssh: OpenSSH\_8.0p1, OpenSSL 1.1.1k FIPS 25 Mar 2021\r\ndebug1: Reading configuration data /etc/ssh/ssh\_config\r\ndebug3: /etc/ssh/ssh\_config line 52: Including file /etc/ssh/ssh\_config.d/05-redhat.conf depth 0\r\ndebug1: Reading configuration data /etc/ssh/ssh\_config.d/05-redhat.conf\r\ndebug2: checking match for ‘final all’ host 172.20.1.111 originally 172.20.1.111\r\ndebug3: /etc/ssh/ssh\_config.d/05-redhat.conf line 3: not matched ‘final’\r\ndebug2: match not found\r\ndebug3: /etc/ssh/ssh\_config.d/05-redhat.conf line 5: Including file /etc/crypto-policies/back-ends/openssh.config depth 1 (parse only)\r\ndebug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config\r\ndebug3: gss kex names ok: [gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-,gss-gex-sha1-,gss-group14-sha1-]\r\ndebug3: kex names ok: [curve25519-sha25… Please advise me on this ---
**Author:** ![Karthik\_Kumaraswamy](https://avatars.discourse-cdn.com/v4/letter/k/3be4f8/32.png) [@Karthik\_Kumaraswamy](https://forum.ansible.com/u/Karthik_Kumaraswamy)\ **Post date:** [May 31, 2022, 3:15am UTC](https://forum.ansible.com/t/failed-to-connect-to-the-host-via-ssh-openssh-8-0p1-openssl-1-1-1k-fips-25-mar-2021/36672/2 "2022-05-31T03:15:48Z")
####variables that are passed ssh\_proxy: 172.20.1.10 ansible\_ssh\_common\_args: ‘-o ProxyCommand=“ssh -W %h:%p -q awx-linux@{{ssh\_proxy}}”’ ####Inventory: 172.20.1.111 ---
**Author:** ![Jeremy\_Bouse](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@Jeremy\_Bouse](https://forum.ansible.com/u/Jeremy_Bouse)\ **Post date:** [June 1, 2022, 2:46am UTC](https://forum.ansible.com/t/failed-to-connect-to-the-host-via-ssh-openssh-8-0p1-openssl-1-1-1k-fips-25-mar-2021/36672/3 "2022-06-01T02:46:38Z")
My initial question would be what crypto algorithm is the key you’re attempting to connect with? As you show that FIPS is enabled and I’m assuming this is on a RHEL server the crypto policy is restrictive and some keys simply won’t be able to connect. I know this was the case with my key that is ssh-ed25519 and I had to use an ssh-rsa key instead in the past. ---
**Author:** ![Karthik\_Kumaraswamy](https://avatars.discourse-cdn.com/v4/letter/k/3be4f8/32.png) [@Karthik\_Kumaraswamy](https://forum.ansible.com/u/Karthik_Kumaraswamy)\ **Post date:** [June 1, 2022, 2:57am UTC](https://forum.ansible.com/t/failed-to-connect-to-the-host-via-ssh-openssh-8-0p1-openssl-1-1-1k-fips-25-mar-2021/36672/4 "2022-06-01T02:57:33Z")
It’s ssh-rsa in my case. I am able to connect to the hosts if i pass " **-o StrictHostKeyChecking=no"** as below ssh\_proxy: 172.20.1.10 ansible\_ssh\_common\_args: ‘ **-o StrictHostKeyChecking=no** -o ProxyCommand=“ssh **-o StrictHostKeyChecking=no** -W %h:%p -q awx-linux@{{ssh\_proxy}}”’ However, I would like to understand why this is happening ? Please note, our AWX env is running on GKE Thanks, Karthik ---
**Author:** ![Jeremy\_Bouse](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@Jeremy\_Bouse](https://forum.ansible.com/u/Jeremy_Bouse)\ **Post date:** [June 1, 2022, 3:12am UTC](https://forum.ansible.com/t/failed-to-connect-to-the-host-via-ssh-openssh-8-0p1-openssl-1-1-1k-fips-25-mar-2021/36672/5 "2022-06-01T03:12:31Z")
Oh okay… So your AWX task needs to go through a jump box using the ProxyCommand to reach the host then? In that case it does make sense that adding the additional '-o StrictHostKeyChecking=no`before the ProxyCommand option would work. The`-o StrictHostKeyChecking=no`included in the ProxyCommand is specific to the ProxyCommand call the is being executed. The`-o StrictHostKeyChecking=no` outside the ProxyCommand is going to be when checking the final host key when jumping through the jump box. I can’t recall if the option would be passed to the ProxyCommand as well and only need to be added the initial time or not and still work. ---
**Author:** ![Karthik\_Kumaraswamy](https://avatars.discourse-cdn.com/v4/letter/k/3be4f8/32.png) [@Karthik\_Kumaraswamy](https://forum.ansible.com/u/Karthik_Kumaraswamy)\ **Post date:** [June 1, 2022, 3:17am UTC](https://forum.ansible.com/t/failed-to-connect-to-the-host-via-ssh-openssh-8-0p1-openssl-1-1-1k-fips-25-mar-2021/36672/6 "2022-06-01T03:17:46Z")
Do we have any risk involved with this as we’re using strict host key checking as false during every connection ?? ---
**Author:** ![Jeremy\_Bouse](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@Jeremy\_Bouse](https://forum.ansible.com/u/Jeremy_Bouse)\ **Post date:** [June 1, 2022, 6:38am UTC](https://forum.ansible.com/t/failed-to-connect-to-the-host-via-ssh-openssh-8-0p1-openssl-1-1-1k-fips-25-mar-2021/36672/7 "2022-06-01T06:38:01Z")
Unless you’re explicitly setting the host keys or using Vault host key signing the SSH host key checking is more of just an alert when the host key seen has changed. When connecting to machines that are ephemeral in nature like the cloud there is a good chance that host keys will change especially if a new instance is brought up to replace and older instance. The risk involved would be one that would need to be assessed for your particular environment