# How to solve unattended Ansible provisioning of nodes on CentOS 7.x from within automated script **URL:** \ **Category:** Ansible Project\ **Tags:** azure\ **Created:** [August 5, 2018, 7:37pm UTC](https://forum.ansible.com/t/how-to-solve-unattended-ansible-provisioning-of-nodes-on-centos-7-x-from-within-automated-script/28264 "2018-08-05T19:37:17Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Romar\_Mro](https://avatars.discourse-cdn.com/v4/letter/r/b5ac83/32.png) [@Romar\_Mro](https://forum.ansible.com/u/Romar_Mro)\ **Post date:** [August 5, 2018, 7:37pm UTC](https://forum.ansible.com/t/how-to-solve-unattended-ansible-provisioning-of-nodes-on-centos-7-x-from-within-automated-script/28264/1 "2018-08-05T19:37:17Z")
Hi I have an automated script launched from an Azure ARM template. It runs on a master node and invokes Ansible to deploy configurations on nodes. The question is how to make Ansible function unattended i.e. w/o ssh blocking in prompting for pass-phrase or failing because the id\_rsa has a blank pass-phrase. **THE SCRIPT WILL FAIL NO MATTER WHAT - because SSH expects a private key to be protected by a passphrase**. The ask for help is: - what setting in sshd\_config on the node (or ssh\_config on master) will allow one of the following - ssh not skipping the blank-password id\_rsa blank pass-phrase private key or - ssh will take an id\_rsa key with pass-phrase but won’t ask for the pass-phrase but just continue - or there is a way to configure ansible to use ssh with passphrase-protected private keys w/o blocking in “enter passphrase” prompt?? The script runs inside the automation engine can’t / don’t know to use passphrase-protected private keys - because no-one can enter the id\_rsa passphrase. The tricks with ssh\_agent and ssh\_add fed a password won’t work in the real case (tried) because ansible is invoked with runuser -l -c “” - hence these are “child” sessions (it works for a very simple case using a non-blank passphrase id\_rsa and the ssh-add-pass expect script to automatically feed ssh-add the password then “ansible all -m ping -v” is all green in that session - but this won’t help) The private / public keys have been generated externally and already set on master and nodes by the Azure Agent before the Ansible script runs. Tried multiple simple variants using on the master something like ssh -vvv -i \ -E \. The keys are generated externally and imported on the master (private) and authorized\_keys (.pup on nodes) 1. Set BatchMode to yes in ssh\_config on the master and use blank passphrase id\_rsa 2. Set BatchMode to yes in ssh\_config on the master and use non blank passphrase id\_rsa 3. Set BatchMode to no in ssh\_config on the master and use blank passphrase id\_rsa 4. Set BatchMode to no in ssh\_config on the master and use non blank passphrase id\_rsa 5. and 2) will silently fail. Test case 3) will keep asking for a passphrase and will fail. Test case 4 obviously works after prompting for passphrase Here are some excerpts from traces 1. … debug3: authmethod\_is\_enabled publickey debug1: Next authentication method: publickey debug1: Trying private key: .ssh/id\_rsa debug2: we did not send a packet, disable method debug1: No more authentication methods to try. Permission denied (publickey,gssapi-keyex,gssapi-with-mic). 2)… debug3: authmethod\_is\_enabled publickey debug1: Next authentication method: publickey debug1: Offering RSA public key: ./id\_rsa\_wpass\_on\_node0 debug3: send\_pubkey\_test debug3: send packet: type 50 debug2: we sent a publickey packet, wait for reply debug3: receive packet: type 60 debug1: Server accepts key: pkalg rsa-sha2-512 blen 279 debug2: input\_userauth\_pk\_ok: fp SHA256:C/iGE4IdHhDGZKLeQaoEJkkRTOXbYoj3z3yJMYn3ogA debug3: sign\_and\_send\_pubkey: RSA SHA256:C/iGE4IdHhDGZKLeQaoEJkkRTOXbYoj3z3yJMYn3ogA **debug2: we did not send a packet, disable method** **debug1: No more authentication methods to try.** Permission denied (publickey,gssapi-keyex,gssapi-with-mic). 1. … prompted “Enter passphrase for key ‘.ssh/id\_rsa’:” and pressing Enter debug3: authmethod\_is\_enabled publickey debug1: Next authentication method: publickey debug1: Trying private key: .ssh/id\_rsa **debug2: no passphrase given, try next key** **debug2: we did not send a packet, disable method** debug1: No more authentication methods to try. Permission denied (publickey,gssapi-keyex,gssapi-with-mic). 1. … prompted “Enter passphrase for key ‘./id\_rsa\_wpass\_on\_node0’:” enter passphrase and it works Last login: Sun Aug 5 19:03:30 2018 from 10.1.0.5 [clusteradmin@ostest-node-0 ~]$ debug3: authmethod\_is\_enabled publickey debug1: Next authentication method: publickey debug1: Offering RSA public key: ./id\_rsa\_wpass\_on\_node0 debug3: send\_pubkey\_test debug3: send packet: type 50 debug2: we sent a publickey packet, wait for reply debug3: receive packet: type 60 debug1: Server accepts key: pkalg rsa-sha2-512 blen 279 debug2: input\_userauth\_pk\_ok: fp SHA256:C/iGE4IdHhDGZKLeQaoEJkkRTOXbYoj3z3yJMYn3ogA debug3: sign\_and\_send\_pubkey: RSA SHA256:C/iGE4IdHhDGZKLeQaoEJkkRTOXbYoj3z3yJMYn3ogA debug3: send packet: type 50 debug3: receive packet: type 52 debug1: Authentication succeeded (publickey). Authenticated to ostest-node-0 ([10.2.0.5]:22). Please advise - any idea welcome ---
**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\ **Post date:** [August 6, 2018, 6:54am UTC](https://forum.ansible.com/t/how-to-solve-unattended-ansible-provisioning-of-nodes-on-centos-7-x-from-within-automated-script/28264/2 "2018-08-06T06:54:20Z")
Hi As you found out yourself, this seems to be an issue with Azure and the way SSH keys are generated/handled there What does the Azure documentation say about this? In any case, I'm not sure why you'd want private key material to be generated by someone other than you. And what would be the point of having an empty passphrase for a private key, as opposed to having no passphrase. Dick