# Need to automate task via bastion host **URL:** \ **Category:** Ansible Project\ **Created:** [April 2, 2023, 3:35pm UTC](https://forum.ansible.com/t/need-to-automate-task-via-bastion-host/37841 "2023-04-02T15:35:06Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Monica](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@Monica](https://forum.ansible.com/u/Monica)\ **Post date:** [April 2, 2023, 3:35pm UTC](https://forum.ansible.com/t/need-to-automate-task-via-bastion-host/37841/1 "2023-04-02T15:35:06Z")
Hi All, I have requirement to automate some tasks via ansible playbook, the problem is I cannot go to the serves directly I need to go to remote nodes via bastion node. Could anyone pls help how can I write the same inside inventory. Below is the example how I am connecting to the remote host via bastion host. ssh user@@ -p 8022 ---
**Author:** ![Will\_McDonald](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Will\_McDonald](https://forum.ansible.com/u/Will_McDonald)\ **Post date:** [April 2, 2023, 4:09pm UTC](https://forum.ansible.com/t/need-to-automate-task-via-bastion-host/37841/2 "2023-04-02T16:09:03Z")
[https://www.jeffgeerling.com/blog/2022/using-ansible-playbook-ssh-bastion-jump-host](https://www.jeffgeerling.com/blog/2022/using-ansible-playbook-ssh-bastion-jump-host) ---
**Author:** ![Todd\_Zullinger](https://avatars.discourse-cdn.com/v4/letter/t/82dd89/32.png) [@Todd\_Zullinger](https://forum.ansible.com/u/Todd_Zullinger)\ **Post date:** [April 2, 2023, 8:51pm UTC](https://forum.ansible.com/t/need-to-automate-task-via-bastion-host/37841/3 "2023-04-02T20:51:25Z")
Will McDonald wrote: > [https://www.jeffgeerling.com/blog/2022/](https://www.jeffgeerling.com/blog/2022/) > using-ansible-playbook-ssh-bastion-jump-host Odd that uses ProxyCommand in `ansible_ssh_common_args` and not the far simpler ProxyJump, which it does mention in the ~/.ssh/config method. The `-J` shortcut for that is even better. Perhaps it does that to illsutrate a more complex use case, where the bastion runs on a different port, but if you're not doing that, it's likely simpler to skip it and use the `-J` argument. I would expect (but have not tested) this works:     ansible\_ssh\_common\_args='-J $your\_bastion\_hostname' ProxyJump / -J was added in OpenSSH-7.3 -- so it's surely on any host folks would be using as an ansible control host. ---
**Author:** ![Monica](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@Monica](https://forum.ansible.com/u/Monica)\ **Post date:** [April 3, 2023, 3:37am UTC](https://forum.ansible.com/t/need-to-automate-task-via-bastion-host/37841/4 "2023-04-03T03:37:03Z")
Hi Todd, Thank you for sharing the same, however, I have already checked this article. I have a requirement to connect Host-A then I can connect Host-B. I can’t connect Host-B directly. So in this case how to execute the playbook task on Host-B from Control Machine? Because my control machine is centralized. Hence, my question is how to execute the playbook task on Host-B directly from the control machine via bastion host-: Below is an example of how I am connecting to the remote host via bastion host using ssh. ssh user@@ -p 8022 In the playbook I have created the inventory, however, while running the same I am getting the below error-: cat lab.txt [need\_bastion] bastion-host [need\_bastion:vars] ansible\_ssh\_common\_args=‘-o StrictHostKeyChecking=no -o ProxyJump=“user@@:8022”’ PLAY [copy file from jump to remote servers] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* TASK [copy node exporter package] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* Password: Password: fatal: [IP]: UNREACHABLE! =\> {“changed”: false, “msg”: “Failed to connect to the host via ssh: Connection timed out during banner exchange”, “unreachable”: true} PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* IP : ok=0 changed=0 unreachable=1 failed=0 skipped=0 rescued=0 ignored=0 ---
**Author:** ![Todd\_Zullinger](https://avatars.discourse-cdn.com/v4/letter/t/82dd89/32.png) [@Todd\_Zullinger](https://forum.ansible.com/u/Todd_Zullinger)\ **Post date:** [April 3, 2023, 4:37am UTC](https://forum.ansible.com/t/need-to-automate-task-via-bastion-host/37841/5 "2023-04-03T04:37:06Z")
Hi, Monica wrote: > Thank you for sharing the same, however, I have already > checked this article. I was simply quoting the article which Will kindly shared to mention that ProxyJump / -J might be a simpler method, even within ansible\_ssh\_common\_args. [I reformatted some of the text you wrote as it arrived at the list as one large block, which was rather hard to read.] > I have a requirement to connect Host-A then I can connect > Host-B. I can’t connect Host-B directly. So in this case > how to execute the playbook task on Host-B from Control > Machine? Because my control machine is centralized. Hence, > my question is how to execute the playbook task on Host-B > directly from the control machine via bastion host-: Below > is an example of how I am connecting to the remote host > via bastion host using ssh. > >   ssh user@\@\ -p 8022 Note that the ssh\_config man page says of ProxyJump:     Specifies one or more jump proxies as either     [user@]host[:port] or an ssh URI. It has further text regarding configuration applied to the jump (aka bastion) host, which is worth reading. Ansible uses the value from `ansible_ssh_common_args` to create the full ssh command to connect to each host, so `@\` should not be included if you're using ansible to connect to \ via \. (If you've got multiple bastion hosts to pass through from \ to \, you should probably get things working with ssh directly and then map that to either `ansible_ssh_common_args` or the `.ssh/config` of the user running ansible on the control host.) All that said, if you're going from \ to \ via \ (on port 8022), I think this would look like:     ansible\_ssh\_common\_args='-J \@\:8022' (I skipped the StrictHostKeyChecking option there simply for brevity. I replaced -o ProxyJump with -J for the same reason.) That connects to the \ via the bastion host as the given user and at the given port. I find testing with the ansible ping module is helpful in cases like this. It makes it easier to separate issues with the playbook from issues with the ssh configuration. E.g.:     ansible \ -om ping That should return:     \ | SUCCESS =\> {"changed": false,"ping": "pong"} If not, adding -vvv to the command will show the ssh command ansible used, which can be checked for sanity (and/or compared to what works when you run ssh directly to get from \ to \ via \). ---
**Author:** ![dulhaver](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dulhaver/32/1061_2.png) [@dulhaver](https://forum.ansible.com/u/dulhaver)\ **Post date:** [April 3, 2023, 5:42am UTC](https://forum.ansible.com/t/need-to-automate-task-via-bastion-host/37841/6 "2023-04-03T05:42:45Z")
I agree with Tood, that setting up a propper ~/.ssh/config should be the way to do this. something like ...    Host jumphost       HostName jumphost.blub.com       User username       PreferredAuthentication publickey       IdentityFile ~/.ssh/demo.ed25519        Host internal-target       Hostname target.blub.com       ProxyJump jumphost       User username       PreferredAuthentication publickey       IdentityFile ~/.ssh/demo.ed25519 ... should do it I believe ---
**Author:** ![Monica](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@Monica](https://forum.ansible.com/u/Monica)\ **Post date:** [April 3, 2023, 10:32am UTC](https://forum.ansible.com/t/need-to-automate-task-via-bastion-host/37841/7 "2023-04-03T10:32:10Z")
Hi Todd, Thank you for explaining the same, however I am still getting the same error-: ---
**Author:** ![Avinash\_Jadhav](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Avinash\_Jadhav](https://forum.ansible.com/u/Avinash_Jadhav)\ **Post date:** [April 3, 2023, 10:38am UTC](https://forum.ansible.com/t/need-to-automate-task-via-bastion-host/37841/8 "2023-04-03T10:38:36Z")
Hi Can you please try to this way [remote-nodes] remote-node-1 ansible\_host= ansible\_user=user ansible\_ssh\_common\_args=‘-o ProxyCommand=“ssh -W %h:%p -p 8022 user@”’ remote-node-2 ansible\_host= ansible\_user=user ansible\_ssh\_common\_args=‘-o ProxyCommand=“ssh -W %h:%p -p 8022 user@”’ ---
**Author:** ![Monica](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@Monica](https://forum.ansible.com/u/Monica)\ **Post date:** [April 3, 2023, 1:32pm UTC](https://forum.ansible.com/t/need-to-automate-task-via-bastion-host/37841/9 "2023-04-03T13:32:02Z")
Hi Avinash. Thanks you for the update. I am still facing the issue. Connection timed out during banner exchange", “unreachable”: true ---
**Author:** ![dulhaver](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dulhaver/32/1061_2.png) [@dulhaver](https://forum.ansible.com/u/dulhaver)\ **Post date:** [April 4, 2023, 9:47am UTC](https://forum.ansible.com/t/need-to-automate-task-via-bastion-host/37841/10 "2023-04-04T09:47:24Z")
what I would try is 1. create an **~/.ssh/conf** file as per the example I sent 2. use Ansible as if there was no jumphost involved at all ---
**Author:** ![Monica](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@Monica](https://forum.ansible.com/u/Monica)\ **Post date:** [April 12, 2023, 5:30am UTC](https://forum.ansible.com/t/need-to-automate-task-via-bastion-host/37841/11 "2023-04-12T05:30:45Z")
Hi, Can anyone help me on this, still I am facing the issue. ---
**Author:** ![Monica](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@Monica](https://forum.ansible.com/u/Monica)\ **Post date:** [April 16, 2023, 7:23am UTC](https://forum.ansible.com/t/need-to-automate-task-via-bastion-host/37841/12 "2023-04-16T07:23:14Z")
Hi Vladimir Botka, Looking for your support on this. ---
**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\ **Post date:** [April 16, 2023, 11:27am UTC](https://forum.ansible.com/t/need-to-automate-task-via-bastion-host/37841/13 "2023-04-16T11:27:43Z")
Hi Monica, > Hi Vladimir Botka, > Looking for your support on this. You said you can "connect to the remote host via bastion host using ssh". > ssh user@\@\ -p 8022 Let me ask you first. Wouldn't an Ansible controller in the internal network serve you use-case better? ext\_net \<-\> bastion\_host \<-\> ansible\_controller \<-\> remote\_host You should store you projects in a version control. Why don't you clone the projects on the controller and run your playbooks from there? This has many advantages: \* The configuration is simpler \* You can limit the external SSH access to single host \* Playbooks in the local network run faster \* The execution of the projects don't depend on the throughput and    quality of the external network \* You can use \*ansible-pull\* on the controller to update the    projects automatically \* You can schedule the projects' updating to off-peak times Why do you want to run Ansible via proxy?