# PPK failed to authenticate after encrypting **URL:** \ **Category:** Ansible Project\ **Tags:** ubuntu\ **Created:** [September 27, 2015, 8:22am UTC](https://forum.ansible.com/t/ppk-failed-to-authenticate-after-encrypting/19365 "2015-09-27T08:22:44Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Neil\_Alwin\_Hermosill](https://avatars.discourse-cdn.com/v4/letter/n/e36b37/32.png) [@Neil\_Alwin\_Hermosill](https://forum.ansible.com/u/Neil_Alwin_Hermosill)\ **Post date:** [September 27, 2015, 8:22am UTC](https://forum.ansible.com/t/ppk-failed-to-authenticate-after-encrypting/19365/1 "2015-09-27T08:22:44Z")
Hello Team, I am just wondering if someone had encounter the same error using ansible-vault. Issue started after I encrypted the ppk using ansible-vault. For everyone to have an idea what I did, I will post the steps I’ve taken. ` ansible-vault create vault-master ansible-vault encrypt .ppk/user.ppk --vault-password-file vault-master ansible-vault encrypt .ppk/user.ppk --vault-password-file vault-masterkey Encryption successful chmod 0400 .ppk/user.ppk ansible all -m ping -u root --private-key=.ppk/user.ppk --vault-password-file vault-masterkey -vvvv ` After typing the last command above, the log seems to have an unusual output. Here is what the -verbose mode shows. ` \<—\> ESTABLISH CONNECTION FOR USER: root \<—\> REMOTE\_MODULE ping \<—\> EXEC [‘ssh’, ‘-C’, ‘-tt’, ‘-vvv’, ‘-o’, ‘ControlMaster=auto’, ‘-o’, ‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/root/.ansible/cp/ansible-ssh-%h-%p-%r’, ‘-o’, ‘IdentityFile=.ppk/user.ppk’, ‘-o’, ‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’, ‘ConnectTimeout=10’, ‘—’, “/bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1443340552.33-274338782155659 && echo $HOME/.ansible/tmp/ansible-tmp-1443340552.33-274338782155659’”] \<128.199.129.6\> ESTABLISH CONNECTION FOR USER: root \<128.199.129.6\> REMOTE\_MODULE ping \<128.199.129.6\> EXEC [‘ssh’, ‘-C’, ‘-tt’, ‘-vvv’, ‘-o’, ‘ControlMaster=auto’, ‘-o’, ‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/root/.ansible/cp/ansible-ssh-%h-%p-%r’, ‘-o’, ‘IdentityFile=.ppk/user.ppk’, ‘-o’, ‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’, ‘ConnectTimeout=10’, ‘128.199.129.6’, “/bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1443340552.33-50544696409516 && echo $HOME/.ansible/tmp/ansible-tmp-1443340552.33-50544696409516’”] — | FAILED =\> SSH encountered an unknown error. The output was: unknown option – - usage: ssh [-1246AaCfgKkMNnqsTtVvXxYy] [-b bind\_address] [-c cipher\_spec] [-D [bind\_address:]port] [-E log\_file] [-e escape\_char] [-F configfile] [-I pkcs11] [-i identity\_file] [-L [bind\_address:]port:host:hostport] [-l login\_name] [-m mac\_spec] [-O ctl\_cmd] [-o option] [-p port] [-Q cipher | cipher-auth | mac | kex | key] [-R [bind\_address:]port:host:hostport] [-S ctl\_path] [-W host:port] [-w local\_tun[:remote\_tun]] [user@]hostname [command] Enter passphrase for key ‘.ppk/user.ppk’: Enter passphrase for key ‘.ppk/user.ppk’: Enter passphrase for key ‘.ppk/user.ppk’: [jbox1-host.promethost.com](http://jbox1-host.promethost.com) | FAILED =\> SSH encountered an unknown error. The output was: OpenSSH\_6.6.1, OpenSSL 1.0.1f 6 Jan 2014 debug1: Reading configuration data /etc/ssh/ssh\_config debug1: /etc/ssh/ssh\_config line 19: Applying options for \* debug1: auto-mux: Trying existing master debug1: Control socket “/root/.ansible/cp/ansible-ssh-128.199.129.6-22-root” does not exist debug2: ssh\_connect: needpriv 0 debug1: Connecting to 128.199.129.6 [128.199.129.6] port 22. debug2: fd 3 setting O\_NONBLOCK debug1: fd 3 clearing O\_NONBLOCK debug1: Connection established. debug3: timeout: 9999 ms remain after connect debug1: permanently\_set\_uid: 0/0 debug3: Incorrect RSA1 identifier debug3: Could not load “.ppk/neil\_tr.ppk” as a RSA1 public key debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug3: key\_read: missing whitespace debug1: identity file .ppk/neil\_tr.ppk type -1 debug1: identity file .ppk/neil\_tr.ppk-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH\_6.6.1p1 Ubuntu-2ubuntu2 debug1: Remote protocol version 2.0, remote software version OpenSSH\_6.4 debug1: match: OpenSSH\_6.4 pat OpenSSH\* compat 0x04000000 debug2: fd 3 setting O\_NONBLOCK debug3: load\_hostkeys: loading entries for host “128.199.129.6” from file “/root/.ssh/known\_hosts” debug3: load\_hostkeys: found key type ECDSA in file /root/.ssh/known\_hosts:1 debug3: load\_hostkeys: loaded 1 keys debug3: order\_hostkeyalgs: prefer hostkeyalgs: [ecdsa-sha2-nistp256-cert-v01@openssh.com](mailto:ecdsa-sha2-nistp256-cert-v01@openssh.com),ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 debug1: SSH2\_MSG\_KEXINIT sent debug1: SSH2\_MSG\_KEXINIT received debug2: kex\_parse\_kexinit: [curve25519-sha256@libssh.org](mailto:curve25519-sha256@libssh.org),ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex\_parse\_kexinit: [ecdsa-sha2-nistp256-cert-v01@openssh.com](mailto:ecdsa-sha2-nistp256-cert-v01@openssh.com),ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-ed25519,ssh-rsa,ssh-dss debug2: kex\_parse\_kexinit: [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com](mailto:aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com),aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex\_parse\_kexinit: [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com](mailto:aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com),aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex\_parse\_kexinit: [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com),hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex\_parse\_kexinit: [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com),hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex\_parse\_kexinit: [zlib@openssh.com](mailto:zlib@openssh.com),zlib,none debug2: kex\_parse\_kexinit: [zlib@openssh.com](mailto:zlib@openssh.com),zlib,none debug2: kex\_parse\_kexinit: debug2: kex\_parse\_kexinit: debug2: kex\_parse\_kexinit: first\_kex\_follows 0 debug2: kex\_parse\_kexinit: reserved 0 debug2: kex\_parse\_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex\_parse\_kexinit: ssh-rsa,ecdsa-sha2-nistp256 debug2: kex\_parse\_kexinit: [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com](mailto:aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com),aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex\_parse\_kexinit: [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com](mailto:aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com),aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex\_parse\_kexinit: [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com),hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex\_parse\_kexinit: [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com),hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex\_parse\_kexinit: [none,zlib@openssh.com](mailto:none,zlib@openssh.com) debug2: kex\_parse\_kexinit: [none,zlib@openssh.com](mailto:none,zlib@openssh.com) debug2: kex\_parse\_kexinit: debug2: kex\_parse\_kexinit: debug2: kex\_parse\_kexinit: first\_kex\_follows 0 debug2: kex\_parse\_kexinit: reserved 0 debug2: mac\_setup: setup [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com) debug1: kex: server-\>client aes128-ctr [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com) [zlib@openssh.com](mailto:zlib@openssh.com) debug2: mac\_setup: setup [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com) debug1: kex: client-\>server aes128-ctr [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com) [zlib@openssh.com](mailto:zlib@openssh.com) debug1: sending SSH2\_MSG\_KEX\_ECDH\_INIT debug1: expecting SSH2\_MSG\_KEX\_ECDH\_REPLY debug1: Server host key: ECDSA d3:de:42:d7:d0:e5:d3:60:51:a8:0c:50:69:7c:60:1c debug3: load\_hostkeys: loading entries for host “128.199.129.6” from file “/root/.ssh/known\_hosts” debug3: load\_hostkeys: found key type ECDSA in file /root/.ssh/known\_hosts:1 debug3: load\_hostkeys: loaded 1 keys debug1: Host ‘128.199.129.6’ is known and matches the ECDSA host key. debug1: Found key in /root/.ssh/known\_hosts:1 debug1: ssh\_ecdsa\_verify: signature correct debug2: kex\_derive\_keys debug2: set\_newkeys: mode 1 debug1: SSH2\_MSG\_NEWKEYS sent debug1: expecting SSH2\_MSG\_NEWKEYS debug2: set\_newkeys: mode 0 debug1: SSH2\_MSG\_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2\_MSG\_SERVICE\_REQUEST sent debug2: service\_accept: ssh-userauth debug1: SSH2\_MSG\_SERVICE\_ACCEPT received debug2: key: .ppk/neil\_tr.ppk ((nil)), explicit debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password debug3: preferred gssapi-with-mic,gssapi-keyex,hostbased,publickey debug3: authmethod\_lookup gssapi-with-mic debug3: remaining preferred: gssapi-keyex,hostbased,publickey debug3: authmethod\_is\_enabled gssapi-with-mic debug1: Next authentication method: gssapi-with-mic debug1: Unspecified GSS failure. Minor code may provide more information No Kerberos credentials available debug1: Unspecified GSS failure. Minor code may provide more information No Kerberos credentials available debug1: Unspecified GSS failure. Minor code may provide more information debug1: Unspecified GSS failure. Minor code may provide more information No Kerberos credentials available debug2: we did not send a packet, disable method debug3: authmethod\_lookup gssapi-keyex debug3: remaining preferred: hostbased,publickey debug3: authmethod\_is\_enabled gssapi-keyex debug1: Next authentication method: gssapi-keyex debug1: No valid Key exchange context debug2: we did not send a packet, disable method debug3: authmethod\_lookup publickey debug3: remaining preferred: ,publickey debug3: authmethod\_is\_enabled publickey debug1: Next authentication method: publickey debug1: Trying private key: .ppk/neil\_tr.ppk debug1: key\_parse\_private2: missing begin marker debug1: key\_parse\_private\_pem: PEM\_read\_PrivateKey failed debug1: read PEM private key done: type debug1: key\_parse\_private2: missing begin marker debug1: key\_parse\_private\_pem: PEM\_read\_PrivateKey failed debug1: read PEM private key done: type debug2: bad passphrase given, try again… debug1: key\_parse\_private2: missing begin marker debug1: key\_parse\_private\_pem: PEM\_read\_PrivateKey failed debug1: read PEM private key done: type debug2: bad passphrase given, try again… debug1: key\_parse\_private2: missing begin marker debug1: key\_parse\_private\_pem: PEM\_read\_PrivateKey failed debug1: read PEM private key done: type debug2: bad passphrase given, try again… debug2: we did not send a packet, disable method debug1: No more authentication methods to try. Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password). ` I made sure to place the pass phrase corretly. Any other reason why I am bumping to this? Also that error that says “debug3: key\_read: missing whitespace” seems to be an issue on parsing cause the ppk works prior to encryption. ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [September 28, 2015, 12:56pm UTC](https://forum.ansible.com/t/ppk-failed-to-authenticate-after-encrypting/19365/2 "2015-09-28T12:56:37Z")
vault currently only supports yaml data files, your private key is not being decrypted with vault and you are passing the encrypted/base64 encoded version to ssh