# problem with ansible bastion hosts /playbook connectivity **URL:** \ **Category:** Ansible Project\ **Created:** [July 8, 2014, 8:05pm UTC](https://forum.ansible.com/t/problem-with-ansible-bastion-hosts-playbook-connectivity/15624 "2014-07-08T20:05:26Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Simon\_Tyler](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Simon\_Tyler](https://forum.ansible.com/u/Simon_Tyler)\ **Post date:** [July 8, 2014, 8:05pm UTC](https://forum.ansible.com/t/problem-with-ansible-bastion-hosts-playbook-connectivity/15624/1 "2014-07-08T20:05:26Z")
Hello, I was running an older version of ansible, and I couldn’t find a way to get it to connect through a bastion host to run scripts against a destination server, so I tried upgrading ansible. (yum upgrade to 1.6.2) Now it appears that some things don’t work the way they did eg. it doesn’t seem to recognize the hosts list properly. It used to be that the first line in the .yml file was: - hosts: $Server\_name but, now that entry results in an error [prod\_deploy@srvtoolbox simontest]$ ansible-playbook fetch\_mysql\_config2.yml --extra-vars=“Server\_name=jruby01” [WARNING]: The version of gmp you have installed has a known issue regarding timing vulnerabilities when used with pycrypto. If possible, you should update it (ie. yum update gmp). PLAY [$Server\_name] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* skipping: no hosts matched so, I can no longer pass the host name at the command line? or the syntax has changed. fine that’s a new issue i guess. If I enter the host name in the playbook itself, it appears to work, if the host name is in the ansible list. I’ve tried a number of methods to get it to recognize host names in ~/.ssh/config but all failed? eg. [prod\_deploy@srvtoolbox simontest]$ ansible-playbook -c ssh fetch\_mysql\_config2.yml [WARNING]: The version of gmp you have installed has a known issue regarding timing vulnerabilities when used with pycrypto. If possible, you should update it (ie. yum update gmp). PLAY [tmdb02] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* skipping: no hosts matched PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* my .ssh/config file: [prod\_deploy@srvtoolbox simontest]$ cat ~/.ssh/config Host terremarkjump HostName 208.39.105.26 User prod\_deploy Host solr4-dih User prod\_deploy HostName 10.124.33.204 ProxyCommand ssh -q terremarkjump ncat %h 22 Host sprt\_liferay\_10 User prod\_deploy HostName [ec2-54-202-175-96.us-west-2.compute.amazonaws.com](http://ec2-54-202-175-96.us-west-2.compute.amazonaws.com) Host tmdb02 User prod\_deploy HostName 10.124.33.250 ProxyCommand ssh -q terremarkjump ncat %h 22 my test playbook: - hosts: tmdb02 user: prod\_deploy sudo: yes tasks: - name: get INVENTORY action: fetch src=/etc/my.cnf dest=~ I looked briefly at /usr/lib/python2.6/site-packages/ansible/runner/connection\_plugins/ssh.py but, I don’t know enough python to be able to tell if this has anything to do with using the ~/.ssh/config file. Is anyone aware if the current state of ansible/ssh (not paramiko) documented in plain english, or is there a way to use jump servers via ssh with ansible 1.6.2? It may well be that I’m doing something silly, much obliged for any assist Simon ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [July 9, 2014, 2:37am UTC](https://forum.ansible.com/t/problem-with-ansible-bastion-hosts-playbook-connectivity/15624/2 "2014-07-09T02:37:54Z")
The $ variables have been dropped from current ansible, they have been deprecated for a loong time. The new way to do the host variables would be writing plays like this: hosts: “{{server\_name}}” and pass on the command line as before, there is some more advanced stuff you can do now, like using --limit or doing this hosts: “{{server\_name|default(‘all’)}}” the ssh config should be picked up normally, I still use it for some bastion jump hosts w/o issues. ​ ---
**Author:** ![Simon\_Tyler](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Simon\_Tyler](https://forum.ansible.com/u/Simon_Tyler)\ **Post date:** [July 9, 2014, 1:48pm UTC](https://forum.ansible.com/t/problem-with-ansible-bastion-hosts-playbook-connectivity/15624/3 "2014-07-09T13:48:13Z")
ok i havent used Ansible before. Are you saying I don’t have to pass any switch to use SSH; it uses Paramiko and if it doesn’t find a hostname, it tries ssh config? it just keeps giving me the error"No hosts matched", ---
**Author:** ![Henry\_Finucane](https://avatars.discourse-cdn.com/v4/letter/h/94ad74/32.png) [@Henry\_Finucane](https://forum.ansible.com/u/Henry_Finucane)\ **Post date:** [July 9, 2014, 1:58pm UTC](https://forum.ansible.com/t/problem-with-ansible-bastion-hosts-playbook-connectivity/15624/4 "2014-07-09T13:58:43Z")
> ok i havent used Ansible before. Are you saying I don’t have to pass any switch to use SSH; it uses Paramiko and if it doesn’t find a hostname, it tries ssh config? it just keeps giving me the error"No hosts matched", Current versions of ansible use openssh as a library for connections by default. You can also ask ansible to use paramiko instead. If you’re using openssh, your ssh config will get picked up, if you’re using paramiko, it won’t. “No hosts matched” is, I believe, unrelated- it means that there are no hosts in your inventory in the specified group. ---
**Author:** ![Simon\_Tyler](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Simon\_Tyler](https://forum.ansible.com/u/Simon_Tyler)\ **Post date:** [July 9, 2014, 2:56pm UTC](https://forum.ansible.com/t/problem-with-ansible-bastion-hosts-playbook-connectivity/15624/5 "2014-07-09T14:56:25Z")
ok clearly I am doing something dumb. I have an entry in ~/.ssh/config for destination host: tmdb02 Host tmdb02 User prod\_deploy HostName 10.124.33.250 ProxyCommand ssh -q terremarkjump ncat %h 22 I can ssh to it normally eg. ssh tmdb02 I’ve updated a test playbook to use the new server name syntax eg. - hosts: “{{server\_name}}” user: prod\_deploy sudo: yes tasks: # Store file into /tmp/fetched/[host.example.com/tmp/somefile](http://host.example.com/tmp/somefile) - name: get INVENTORY action: fetch src=/etc/my.cnf dest=~ I try to run it: ansible-playbook /home/prod\_deploy/simontest/fetch\_mysql\_config2.yml --extra-vars=“server\_name=jruby03” and this works: jruby03 is listed in /etc/ansible/hosts If I try a name that is listed in my ssh config, it fails as previously indicated. So, I need to add an entry or two to /etc/ansible/hosts. The server I’m trying to hit is on the other side of a jump server. How do i set this up in /etc/ansible/hosts? ---
**Author:** ![Henry\_Finucane](https://avatars.discourse-cdn.com/v4/letter/h/94ad74/32.png) [@Henry\_Finucane](https://forum.ansible.com/u/Henry_Finucane)\ **Post date:** [July 9, 2014, 3:03pm UTC](https://forum.ansible.com/t/problem-with-ansible-bastion-hosts-playbook-connectivity/15624/6 "2014-07-09T15:03:48Z")
Ansible only wants to talk to hosts in its inventory. If you want your inventory to be your ssh config file, there is a dynamic inventory script called ‘ssh\_config.py’ that ships with ansible that will do that for you. ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [July 9, 2014, 4:18pm UTC](https://forum.ansible.com/t/problem-with-ansible-bastion-hosts-playbook-connectivity/15624/7 "2014-07-09T16:18:14Z")
also, remove "user: prod\_deploy"​ from your playbook, using a ‘user’ will avoid using your .ssh/config file, since you are already setting it there, it is redundant. ---
**Author:** ![Simon\_Tyler](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Simon\_Tyler](https://forum.ansible.com/u/Simon_Tyler)\ **Post date:** [July 9, 2014, 5:56pm UTC](https://forum.ansible.com/t/problem-with-ansible-bastion-hosts-playbook-connectivity/15624/8 "2014-07-09T17:56:19Z")
Hi Henry, I am most definitely stupider than normal; I blame a recent pigeon infestation and the resulting lack of sleep. I did not find that script on my system, so I downloaded it from here [https://github.com/ansible/ansible/blob/release1.6.2/plugins/inventory/ssh\_config.py](https://github.com/ansible/ansible/blob/release1.6.2/plugins/inventory/ssh_config.py). It appears to be throwing a python error: [prod\_deploy@srvtoolbox ansible]$ ./ssh\_config.py --list Traceback (most recent call last): File “./ssh\_config.py”, line 111, in main(sys.argv[1:]) File “./ssh\_config.py”, line 105, in main print\_list() File “./ssh\_config.py”, line 72, in print\_list cfg = get\_config() File “./ssh\_config.py”, line 67, in get\_config ret\_dict[host] = \_copy[‘config’] KeyError: ‘config’ I think you wrote it? Perhaps it would be better if I went away and hunted some pigeons, and got some sleep, and then come back. I feel like I’m getting closer to a solution, even if I’m not getting any smarter. Have you got a suggestion for next steps? Thank you for your patience, ---
**Author:** ![Henry\_Finucane](https://avatars.discourse-cdn.com/v4/letter/h/94ad74/32.png) [@Henry\_Finucane](https://forum.ansible.com/u/Henry_Finucane)\ **Post date:** [July 9, 2014, 6:54pm UTC](https://forum.ansible.com/t/problem-with-ansible-bastion-hosts-playbook-connectivity/15624/9 "2014-07-09T18:54:35Z")
> Hi Henry, > > I am most definitely stupider than normal; I blame a recent pigeon > infestation and the resulting lack of sleep. > > I did not find that script on my system, so I downloaded it from here > [https://github.com/ansible/ansible/blob/release1.6.2/plugins/inventory/ssh\_config.py](https://github.com/ansible/ansible/blob/release1.6.2/plugins/inventory/ssh_config.py). > It appears to be throwing a python error: > [prod\_deploy@srvtoolbox ansible]$ ./ssh\_config.py --list > Traceback (most recent call last): >   File "./ssh\_config.py", line 111, in \ >     main(sys.argv[1:]) >   File "./ssh\_config.py", line 105, in main >     print\_list() >   File "./ssh\_config.py", line 72, in print\_list >     cfg = get\_config() >   File "./ssh\_config.py", line 67, in get\_config >     ret\_dict[host] = \_copy['config'] > KeyError: 'config' > > I think you wrote it? Perhaps it would be better if I went away and hunted > some pigeons, and got some sleep, and then come back. I feel like I'm > getting closer to a solution, even if I'm not getting any smarter. I did- or at least the line in question. I may have relied too closely on my ability to read the paramiko source code and infer its api contract. I wrote a stupid patch: [https://github.com/hfinucane/ansible/tree/feature/paramiko-safety](https://github.com/hfinucane/ansible/tree/feature/paramiko-safety) let me know if that works out for you, or if more things are broken. ---
**Author:** ![Simon\_Tyler](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Simon\_Tyler](https://forum.ansible.com/u/Simon_Tyler)\ **Post date:** [July 10, 2014, 3:26pm UTC](https://forum.ansible.com/t/problem-with-ansible-bastion-hosts-playbook-connectivity/15624/10 "2014-07-10T15:26:45Z")
Hi Henry, Thank you so much for such quick responses! I have not used git much, here is what I did: -browsed to [https://github.com/hfinucane/ansible/blob/feature/paramiko-safety/plugins/inventory/ssh\_config.py](https://github.com/hfinucane/ansible/blob/feature/paramiko-safety/plugins/inventory/ssh_config.py) -cut and paste the script into /usr/lib/python2.6/site-packages/ansible/runner/connection\_plugins/ -since all of the ansible files are owned by root, I put a copy of ssh\_config.py in my user directory so I could run it directly, and made it executable here are results of test [prod\_deploy@srvtoolbox simontest]$ ./ssh\_config.py --list {“ssh\_config”: , “\_meta”: {“hostvars”: {}}} and [prod\_deploy@srvtoolbox simontest]$ ansible tmdb02 -m ping No hosts matched I hope that I’ve gone about this in an acceptable way; thank you again for your patience, Simon ---
**Author:** ![Henry\_Finucane](https://avatars.discourse-cdn.com/v4/letter/h/94ad74/32.png) [@Henry\_Finucane](https://forum.ansible.com/u/Henry_Finucane)\ **Post date:** [July 10, 2014, 5:12pm UTC](https://forum.ansible.com/t/problem-with-ansible-bastion-hosts-playbook-connectivity/15624/11 "2014-07-10T17:12:24Z")
I talked to Simon a little bit out of band, it looks like the problem is his version of Paramiko- it predates both the initial and the working ProxyCommand implementation. You need Paramiko \>= 1.10 for parsing support, and if you want to use Paramiko as a transport you want \>= 1.10.6 . ---
**Author:** ![Simon\_Tyler](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Simon\_Tyler](https://forum.ansible.com/u/Simon_Tyler)\ **Post date:** [July 11, 2014, 6:01pm UTC](https://forum.ansible.com/t/problem-with-ansible-bastion-hosts-playbook-connectivity/15624/12 "2014-07-11T18:01:51Z")
Hello again, we have updated Paramiko but it appears I still have issues. ssh\_config.py works when I don’t have to hop through a bastion host. When I have to go through a bastion host, it appears to ignore the Proxy variable. I created an entry in ssh config file for jruby1. (The name in the ansible hosts file is jruby01): [prod\_deploy@srvtoolbox simontest]$ ansible-playbook -i /home/prod\_deploy/simontest/ssh\_config.py fetch\_mysql\_config2.yml --extra-vars=“server\_name=jruby1” prod\_deploy@srvtoolbox simontest]$ ssh -V OpenSSH\_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013 [prod\_deploy@srvtoolbox log]$ ANSIBLE\_SSH\_ARGS=“” ansible tmdb02 -i /home/prod\_deploy/simontest/ssh\_config.py -m ping -c ssh -vvvv \<10.124.33.250\> ESTABLISH CONNECTION FOR USER: prod\_deploy \<10.124.33.250\> REMOTE\_MODULE ping \<10.124.33.250\> EXEC [‘ssh’, ‘-C’, ‘-tt’, ‘-vvv’, ‘-o’, ‘Port=22’, ‘-o’, ‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’, ‘ConnectTimeout=10’, u’10.124.xx.xxx’, “/bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1405085298.07-20022175021754 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1405085298.07-20022175021754 && echo $HOME/.ansible/tmp/ansible-tmp-1405085298.07-20022175021754’”] tmdb02 | FAILED =\> SSH encountered an unknown error. The output was: OpenSSH\_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013 debug1: Reading configuration data /home/prod\_deploy/.ssh/config debug1: Reading configuration data /etc/ssh/ssh\_config debug1: Applying options for \* debug2: ssh\_connect: needpriv 0 debug1: **Connecting to 10.124.xx.xxx [10.124.xx.xxx] port 22.** debug2: fd 4 setting O\_NONBLOCK debug1: connect to address 10.124.xx.xxx port 22: No route to host ssh: connect to host 10.124.xx.xxx port 22: No route to host [root@srvtoolbox tmp]# pip show pycrypto