Problems with ssh connections to hosts behind jumphost

Archives Ansible Project
1

Dear all,

I have some hosts that I can only reach via a jumphost. So, my
.ssh/config contains:

Host foobar
  ...
  ProxyCommand ssh -W %h:%p whatever
  ...

I have a strange, intermittent issue, that I can connect to one of
these hosts via ansible and run a playbook. Running it on more than
one host fails out, sometimes "unreachable", sometimes module errors.
Re-running the playbook on the failing host only works.

Any hints, how to solve this? Or how to look for the error? I thought
about checking ssh multiplexing, pipelining and similiar stuff, but
without an idea where to look I'm kind of in the dark here...

Any help would be highly appreciated!

Johannes

2

You may want to look into raising the MaxStartups sshd config on the bastion.

Maybe also look into increasing timeout in Ansible.cfg

3

Thanks Matt,

that was quick!

You may want to look into raising the MaxStartups sshd config on the
bastion.

I'll try 100:30:300 and see, thanks for the suggestion.

Maybe also look into increasing `timeout` in Ansible.cfg

I already did that, but to no avail...

Johannes

4

Although timeout is set to 30s and MaxStartups is set to 100:30:300, I
still have intermittent failures.

I tried to set 'serial: 2' in the group_vars, but I am not sure if
this has to be set on play level. Off to read the docs..

Johannes

5

One thing which once hit me: on MacOSX the file ulimit was only 256. I have about 140 hosts and when our company decided to use a jump host I suddenly ran into problems because the pipelined connections now hit this limit.

Regards
Mirko

6

Hi Mirko,

7

Hello,

I have the same problem. Did you find any solution for this ?

Thanks

8

As the hosts are lxc containers running on the jump host (and only
being available via the jump host), I guess it might be due to memory
usage when the commands are being run on all hosts simultaneously.

I'm in the middle of trying out some things, but no, a real solution
did not present itself.

Try (and maybe disable) ssh multiplexing, pipelining and starting the
playbooks with forks and/or serial...

Johannes