Problems running ansible w/o root access

Running into some problems using Ansible on RHEL 5, installed/running as
regular user (no root access). Note - we use host based ssh authentication
on default port.

Ok, that's totally fine so far...

Added the hacking/env-setup portion to my .bash_profile to run in the
hacking setup. Added a couple hosts to my ANSIBLE_HOSTS file. Verified I
have ssh access to those hosts, no password prompt.
Username/hostnames have been changed to protect the innocent :slight_smile:

Try the ping command on the Getting Started page

$ ansible all -m ping

By default this will run as your user, you may wish to specify "-u
username" to provide the remote user.

/local/python/lib/python2.6/site-packages/pycrypto-2.6-py2.6-linux-x86_64.egg/Crypto/Util/number.py:57:
PowmInsecureWarning: Not using mpz_powm_sec. You should rebuild using
libgmp >= 5 to avoid timing attack vulnerability.

I have *NOT* seen the above warning, but I suspect it's not causing
your connection problem.

Still you may wish to try -c ssh to use native OpenSSH.

Though from RHEL5 you won't have ControlPersist so that's a little
suboptimal. Better to be using something a bit more current as the
control node if possible.

Next I created a generic ansible.cfg and the only major change I put was
adding -o HostbasedAuthentication to the ssh_args, then changed connection
type to ssh.

Ok, now you're doing SSH :slight_smile:

It does look like you're getting that warning just from importing
paramiko so just upgrading paramiko may make
that clear, in which case, it's not operational...

Unfortunate but it's RHEL5 so old pycrypto...

$ ansible all -m ping -vvv --connection=ssh
/local/python/lib/python2.6/site-packages/pycrypto-2.6-py2.6-linux-x86_64.egg/Crypto/Util/number.py:57:
PowmInsecureWarning: Not using mpz_powm_sec. You should rebuild using
libgmp >= 5 to avoid timing attack vulnerability.
<127.0.0.1> ESTABLISH CONNECTION FOR USER: myuser
<127.0.0.1> EXEC ['ssh', '-tt', '-q', '-o', 'HostbasedAuthentication', '-o',
'PasswordAuthentication=no', '-o', 'ControlMaster=auto', '-o',
'ControlPersist=60s', '-o', 'ControlPath=/tmp/ansible-ssh-%h-%p-%r', '-o',
'StrictHostKeyChecking=no', '-o', 'Port=22', '-o',
'KbdInteractiveAuthentication=no', '-o', 'PasswordAuthentication=no', '-o',
'User=myuser', '-o', 'ConnectTimeout=10', '127.0.0.1', "/bin/sh -c 'mkdir -p
$HOME/.ansible/tmp/ansible-1362678139.9-159934362371800 && chmod a+rx
$HOME/.ansible/tmp/ansible-1362678139.9-159934362371800 && echo
$HOME/.ansible/tmp/ansible-1362678139.9-159934362371800'"]
<host1> ESTABLISH CONNECTION FOR USER: myuser
<127.0.0.1> REMOTE_MODULE ping
<host1> EXEC ['ssh', '-tt', '-q', '-o', 'HostbasedAuthentication', '-o',
'PasswordAuthentication=no', '-o', 'ControlMaster=auto', '-o',
'ControlPersist=60s', '-o', 'ControlPath=/tmp/ansible-ssh-%h-%p-%r', '-o',
'StrictHostKeyChecking=no', '-o', 'Port=22', '-o',
'KbdInteractiveAuthentication=no', '-o', 'PasswordAuthentication=no', '-o',
'User=myuser', '-o', 'ConnectTimeout=10', 'host1', "/bin/sh -c 'mkdir -p
$HOME/.ansible/tmp/ansible-1362678139.9-96113492751967 && chmod a+rx
$HOME/.ansible/tmp/ansible-1362678139.9-96113492751967 && echo
$HOME/.ansible/tmp/ansible-1362678139.9-96113492751967'"]
<127.0.0.1> PUT /tmp/tmpZ96vfa TO /ping
<host1> REMOTE_MODULE ping
<host1> PUT /tmp/tmpcRZLhm TO /ping
<host2> ESTABLISH CONNECTION FOR USER: myuser
<host2> EXEC ['ssh', '-tt', '-q', '-o', 'HostbasedAuthentication', '-o',
'PasswordAuthentication=no', '-o', 'ControlMaster=auto', '-o',
'ControlPersist=60s', '-o', 'ControlPath=/tmp/ansible-ssh-%h-%p-%r', '-o',
'StrictHostKeyChecking=no', '-o', 'Port=22', '-o',
'KbdInteractiveAuthentication=no', '-o', 'PasswordAuthentication=no', '-o',
'User=myuser', '-o', 'ConnectTimeout=10', 'host2', "/bin/sh -c 'mkdir -p
$HOME/.ansible/tmp/ansible-1362678139.91-241679509045965 && chmod a+rx
$HOME/.ansible/tmp/ansible-1362678139.91-241679509045965 && echo
$HOME/.ansible/tmp/ansible-1362678139.91-241679509045965'"]
host1 | FAILED => Traceback (most recent call last):
  File "/local/ansible/lib/ansible/runner/__init__.py", line 297, in
_executor
    exec_rc = self._executor_internal(host)
  File "/local/ansible/lib/ansible/runner/__init__.py", line 354, in
_executor_internal
    return self._executor_internal_inner(host, self.module_name,
self.module_args, inject, port)
  File "/local/ansible/lib/ansible/runner/__init__.py", line 482, in
_executor_internal_inner
    result = handler.run(conn, tmp, module_name, module_args, inject,
self.complex_args)
  File "/local/ansible/lib/ansible/runner/action_plugins/normal.py", line
55, in run
    return self.runner._execute_module(conn, tmp, module_name, module_args,
inject=inject, complex_args=complex_args)
  File "/local/ansible/lib/ansible/runner/__init__.py", line 250, in
_execute_module
    (remote_module_path, is_new_style, shebang) = self._copy_module(conn,
tmp, module_name, args, inject, complex_args)
  File "/local/ansible/lib/ansible/runner/__init__.py", line 642, in
_copy_module
    self._transfer_str(conn, tmp, module_name, module_data)
  File "/local/ansible/lib/ansible/runner/__init__.py", line 217, in
_transfer_str
    conn.put_file(afile, remote)
  File "/local/ansible/lib/ansible/runner/connection_plugins/ssh.py", line
180, in put_file
    stdout, stderr = p.communicate(indata)
  File "/local/python/lib/python2.6/subprocess.py", line 691, in communicate
    return self._communicate(input)
  File "/local/python/lib/python2.6/subprocess.py", line 1222, in
_communicate
    bytes_written = os.write(self.stdin.fileno(), chunk)
OSError: [Errno 32] Broken pipe

127.0.0.1 | FAILED => failed to transfer file to /ping:

Connecting to 127.0.0.1...
command-line line 0: Missing yes/no argument.

Can you give the output of ansible --version here?

It seems quite unusual that it would try to put things in "/".

Running into some problems using Ansible on RHEL 5, installed/running as
regular user (no root access). Note - we use host based ssh authentication
on default port.

Ok, that’s totally fine so far…

Added the hacking/env-setup portion to my .bash_profile to run in the
hacking setup. Added a couple hosts to my ANSIBLE_HOSTS file. Verified I
have ssh access to those hosts, no password prompt.
Username/hostnames have been changed to protect the innocent :slight_smile:

Try the ping command on the Getting Started page

$ ansible all -m ping

By default this will run as your user, you may wish to specify “-u
username” to provide the remote user.

/local/python/lib/python2.6/site-packages/pycrypto-2.6-py2.6-linux-x86_64.egg/Crypto/Util/number.py:57:
PowmInsecureWarning: Not using mpz_powm_sec. You should rebuild using
libgmp >= 5 to avoid timing attack vulnerability.

I have NOT seen the above warning, but I suspect it’s not causing
your connection problem.

Still you may wish to try -c ssh to use native OpenSSH.

Though from RHEL5 you won’t have ControlPersist so that’s a little
suboptimal. Better to be using something a bit more current as the
control node if possible.

Next I created a generic ansible.cfg and the only major change I put was
adding -o HostbasedAuthentication to the ssh_args, then changed connection
type to ssh.

Ok, now you’re doing SSH :slight_smile:

It does look like you’re getting that warning just from importing
paramiko so just upgrading paramiko may make
that clear, in which case, it’s not operational…

Unfortunate but it’s RHEL5 so old pycrypto…

$ ansible all -m ping -vvv --connection=ssh
/local/python/lib/python2.6/site-packages/pycrypto-2.6-py2.6-linux-x86_64.egg/Crypto/Util/number.py:57:
PowmInsecureWarning: Not using mpz_powm_sec. You should rebuild using
libgmp >= 5 to avoid timing attack vulnerability.
<127.0.0.1> ESTABLISH CONNECTION FOR USER: myuser
<127.0.0.1> EXEC [‘ssh’, ‘-tt’, ‘-q’, ‘-o’, ‘HostbasedAuthentication’, ‘-o’,
‘PasswordAuthentication=no’, ‘-o’, ‘ControlMaster=auto’, ‘-o’,
‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/tmp/ansible-ssh-%h-%p-%r’, ‘-o’,
‘StrictHostKeyChecking=no’, ‘-o’, ‘Port=22’, ‘-o’,
‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’,
‘User=myuser’, ‘-o’, ‘ConnectTimeout=10’, ‘127.0.0.1’, “/bin/sh -c ‘mkdir -p
$HOME/.ansible/tmp/ansible-1362678139.9-159934362371800 && chmod a+rx
$HOME/.ansible/tmp/ansible-1362678139.9-159934362371800 && echo
$HOME/.ansible/tmp/ansible-1362678139.9-159934362371800’”]
ESTABLISH CONNECTION FOR USER: myuser
<127.0.0.1> REMOTE_MODULE ping
EXEC [‘ssh’, ‘-tt’, ‘-q’, ‘-o’, ‘HostbasedAuthentication’, ‘-o’,
‘PasswordAuthentication=no’, ‘-o’, ‘ControlMaster=auto’, ‘-o’,
‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/tmp/ansible-ssh-%h-%p-%r’, ‘-o’,
‘StrictHostKeyChecking=no’, ‘-o’, ‘Port=22’, ‘-o’,
‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’,
‘User=myuser’, ‘-o’, ‘ConnectTimeout=10’, ‘host1’, “/bin/sh -c ‘mkdir -p
$HOME/.ansible/tmp/ansible-1362678139.9-96113492751967 && chmod a+rx
$HOME/.ansible/tmp/ansible-1362678139.9-96113492751967 && echo
$HOME/.ansible/tmp/ansible-1362678139.9-96113492751967’”]
<127.0.0.1> PUT /tmp/tmpZ96vfa TO /ping
REMOTE_MODULE ping
PUT /tmp/tmpcRZLhm TO /ping
ESTABLISH CONNECTION FOR USER: myuser
EXEC [‘ssh’, ‘-tt’, ‘-q’, ‘-o’, ‘HostbasedAuthentication’, ‘-o’,
‘PasswordAuthentication=no’, ‘-o’, ‘ControlMaster=auto’, ‘-o’,
‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/tmp/ansible-ssh-%h-%p-%r’, ‘-o’,
‘StrictHostKeyChecking=no’, ‘-o’, ‘Port=22’, ‘-o’,
‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’,
‘User=myuser’, ‘-o’, ‘ConnectTimeout=10’, ‘host2’, “/bin/sh -c ‘mkdir -p
$HOME/.ansible/tmp/ansible-1362678139.91-241679509045965 && chmod a+rx
$HOME/.ansible/tmp/ansible-1362678139.91-241679509045965 && echo
$HOME/.ansible/tmp/ansible-1362678139.91-241679509045965’”]
host1 | FAILED => Traceback (most recent call last):
File “/local/ansible/lib/ansible/runner/init.py”, line 297, in
_executor
exec_rc = self._executor_internal(host)
File “/local/ansible/lib/ansible/runner/init.py”, line 354, in
_executor_internal
return self._executor_internal_inner(host, self.module_name,
self.module_args, inject, port)
File “/local/ansible/lib/ansible/runner/init.py”, line 482, in
_executor_internal_inner
result = handler.run(conn, tmp, module_name, module_args, inject,
self.complex_args)
File “/local/ansible/lib/ansible/runner/action_plugins/normal.py”, line
55, in run
return self.runner._execute_module(conn, tmp, module_name, module_args,
inject=inject, complex_args=complex_args)
File “/local/ansible/lib/ansible/runner/init.py”, line 250, in
_execute_module
(remote_module_path, is_new_style, shebang) = self._copy_module(conn,
tmp, module_name, args, inject, complex_args)
File “/local/ansible/lib/ansible/runner/init.py”, line 642, in
_copy_module
self._transfer_str(conn, tmp, module_name, module_data)
File “/local/ansible/lib/ansible/runner/init.py”, line 217, in
_transfer_str
conn.put_file(afile, remote)
File “/local/ansible/lib/ansible/runner/connection_plugins/ssh.py”, line
180, in put_file
stdout, stderr = p.communicate(indata)
File “/local/python/lib/python2.6/subprocess.py”, line 691, in communicate
return self._communicate(input)
File “/local/python/lib/python2.6/subprocess.py”, line 1222, in
_communicate
bytes_written = os.write(self.stdin.fileno(), chunk)
OSError: [Errno 32] Broken pipe

127.0.0.1 | FAILED => failed to transfer file to /ping:

Connecting to 127.0.0.1…
command-line line 0: Missing yes/no argument.

Can you give the output of ansible --version here?

$ ansible --version
/local/python/lib/python2.7/site-packages/pycrypto-2.6-py2.7-linux-x86_64.egg/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec. You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.
ansible 1.1 (devel ca16a91da1) last updated 2013/03/06 16:26:11 (GMT -500)

It seems quite unusual that it would try to put things in “/”.

I reran using Python 2.7.3 and still getting similar errors. I put the connection type as ssh in my ansible.cfg, tried with/without ssh arguments. Changed hosts file to just contain a single host.

$ ansible all -m ping -vvv
/local/python/lib/python2.7/site-packages/pycrypto-2.6-py2.7-linux-x86_64.egg/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec. You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.
ESTABLISH CONNECTION FOR USER: myuser on PORT 22 TO server1
server1 | FAILED => FAILED: Authentication failed.

Ok, I don't have time to help debug today unfortunately.

Please stop by IRC and we should be able to help you there.

To clarify, IRC is

ansible

irc.freenode.net

You can use webchat.freenode.net if you don't have a client.

I think the problem is our ssh configuration. It is host based, and user based keys aren’t even checked/allowed. So Ansible/paramiko won’t be able to auth using the host-based key, and the user based authorized_keys aren’t even used.

I think the best option is for me to get approval for my Ansible server’s public key to get in the authorized_keys file managed by our platform team.