# SSH Errors during provisioning of ec2 hosts through ansible **URL:** \ **Category:** Ansible Project\ **Tags:** aws\ **Created:** [January 23, 2015, 9:49pm UTC](https://forum.ansible.com/t/ssh-errors-during-provisioning-of-ec2-hosts-through-ansible/17364 "2015-01-23T21:49:20Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![doug1](https://avatars.discourse-cdn.com/v4/letter/d/fbc32d/32.png) [@doug1](https://forum.ansible.com/u/doug1)\ **Post date:** [January 23, 2015, 9:49pm UTC](https://forum.ansible.com/t/ssh-errors-during-provisioning-of-ec2-hosts-through-ansible/17364/1 "2015-01-23T21:49:20Z")
Hi All, I’ve been battling with this issue all day. I wrote a playbook which spins up nodes on ec2 using ansible and then bootstraps the box by creating the “ansible” user on the remote machine, then it pushes the ansible user’s rsa.pub key to the box and finally overwrites the ‘90-cloud-init-users’ file which allows for provisioning of sudo permissions without password. I’ve been having the error below pop up after the provisioning is complete and the playbook moves on to installing some packages with git. It was working just fine with the default user setup by AWS, but after I migrated to the ansible username it doesn’t. After this provisioning fails, I am immediately able to login into the box using the username ‘ansible’ without a password so it seems that the public key is being sent correctly. > > fatal: [x.x.x.x] =\> SSH encountered an unknown error. The output was: > > > OpenSSH\_6.4, OpenSSL 1.0.1e-fips 11 Feb 2013 > > > debug1: Reading configuration data /home/ansible/.ssh/config > > > debug1: Reading configuration data /etc/ssh/ssh\_config > > > debug2: ssh\_connect: needpriv 0 > > > debug1: Connecting to x.x.x.x [x.x.x.x] port 22. > > > debug2: fd 3 setting O\_NONBLOCK > > > debug1: fd 3 clearing O\_NONBLOCK > > > debug1: Connection established. > > > debug3: timeout: 14998 ms remain after connect > > > debug3: Incorrect RSA1 identifier > > > debug3: Could not load “xxx.pem” as a RSA1 public key > > > debug1: identity file xxx.pem type -1 > > > debug1: identity file xxxx.pem-cert type -1 > > > debug1: Enabling compatibility mode for protocol 2.0 > > > debug1: Local version string SSH-2.0-OpenSSH\_6.4 > > > debug1: Remote protocol version 2.0, remote software version OpenSSH\_6.4 > > > debug1: match: OpenSSH\_6.4 pat OpenSSH\* > > > debug2: fd 3 setting O\_NONBLOCK > > > debug3: load\_hostkeys: loading entries for host “x.x.x.x” from file “/home/ansible/.ssh/known\_hosts” > > > debug3: load\_hostkeys: found key type ECDSA in file /home/ansible/.ssh/known\_hosts:17 > > > debug3: load\_hostkeys: loaded 1 keys > > > debug3: order\_hostkeyalgs: prefer hostkeyalgs: [ecdsa-sha2-nistp256-cert-v01@openssh.com](mailto:ecdsa-sha2-nistp256-cert-v01@openssh.com),ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 > > > debug1: SSH2\_MSG\_KEXINIT sent > > > debug1: SSH2\_MSG\_KEXINIT received > > > debug2: kex\_parse\_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 > > > debug2: kex\_parse\_kexinit: [ecdsa-sha2-nistp256-cert-v01@openssh.com](mailto:ecdsa-sha2-nistp256-cert-v01@openssh.com),ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-rsa,ssh-dss > > > debug2: kex\_parse\_kexinit: [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com](mailto:aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com),aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se > > > debug2: kex\_parse\_kexinit: [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com](mailto:aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com),aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se > > > debug2: kex\_parse\_kexinit: [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com),hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 > > > debug2: kex\_parse\_kexinit: [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com),hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 > > > debug2: kex\_parse\_kexinit: [zlib@openssh.com](mailto:zlib@openssh.com),zlib,none > > > debug2: kex\_parse\_kexinit: [zlib@openssh.com](mailto:zlib@openssh.com),zlib,none > > > debug2: kex\_parse\_kexinit: > > > debug2: kex\_parse\_kexinit: > > > debug2: kex\_parse\_kexinit: first\_kex\_follows 0 > > > debug2: kex\_parse\_kexinit: reserved 0 > > > debug2: kex\_parse\_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 > > > debug2: kex\_parse\_kexinit: ssh-rsa,ecdsa-sha2-nistp256 > > > debug2: kex\_parse\_kexinit: [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com](mailto:aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com),aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se > > > debug2: kex\_parse\_kexinit: [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com](mailto:aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com),aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se > > > debug2: kex\_parse\_kexinit: [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com),hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 > > > debug2: kex\_parse\_kexinit: [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com),hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 > > > debug2: kex\_parse\_kexinit: [none,zlib@openssh.com](mailto:none,zlib@openssh.com) > > > debug2: kex\_parse\_kexinit: [none,zlib@openssh.com](mailto:none,zlib@openssh.com) > > > debug2: kex\_parse\_kexinit: > > > debug2: kex\_parse\_kexinit: > > > debug2: kex\_parse\_kexinit: first\_kex\_follows 0 > > > debug2: kex\_parse\_kexinit: reserved 0 > > > debug2: mac\_setup: found [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com) > > > debug1: kex: server-\>client aes128-ctr [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com) [zlib@openssh.com](mailto:zlib@openssh.com) > > > debug2: mac\_setup: found [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com) > > > debug1: kex: client-\>server aes128-ctr [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com) [zlib@openssh.com](mailto:zlib@openssh.com) > > > debug1: sending SSH2\_MSG\_KEX\_ECDH\_INIT > > > debug1: expecting SSH2\_MSG\_KEX\_ECDH\_REPLY > > > debug1: Server host key: ECDSA 0f:59:bd:0b:c7:2d:93:4a:8e:4d:33:8e:22:50:16:36 > > > debug3: load\_hostkeys: loading entries for host “10.0.1.61” from file “/home/ansible/.ssh/known\_hosts” > > > debug3: load\_hostkeys: found key type ECDSA in file /home/ansible/.ssh/known\_hosts:17 > > > debug3: load\_hostkeys: loaded 1 keys > > > debug1: Host ‘x.x.x.x’ is known and matches the ECDSA host key. > > > debug1: Found key in /home/ansible/.ssh/known\_hosts:17 > > > debug1: ssh\_ecdsa\_verify: signature correct > > > debug2: kex\_derive\_keys > > > debug2: set\_newkeys: mode 1 > > > debug1: SSH2\_MSG\_NEWKEYS sent > > > debug1: expecting SSH2\_MSG\_NEWKEYS > > > debug2: set\_newkeys: mode 0 > > > debug1: SSH2\_MSG\_NEWKEYS received > > > debug1: Roaming not allowed by server > > > debug1: SSH2\_MSG\_SERVICE\_REQUEST sent > > > debug2: service\_accept: ssh-userauth > > > debug1: SSH2\_MSG\_SERVICE\_ACCEPT received > > > debug2: key: ansible.pem ((nil)), explicit > > > debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic > > > debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic > > > debug3: preferred gssapi-with-mic,gssapi-keyex,hostbased,publickey > > > debug3: authmethod\_lookup gssapi-with-mic > > > debug3: remaining preferred: gssapi-keyex,hostbased,publickey > > > debug3: authmethod\_lookup gssapi-keyex > > > debug3: remaining preferred: hostbased,publickey > > > debug3: authmethod\_lookup publickey > > > debug3: remaining preferred: ,publickey > > > debug3: authmethod\_is\_enabled publickey > > > debug1: Next authentication method: publickey > > > debug1: Trying private key: ansible.pem > > > debug1: read PEM private key done: type RSA > > > debug3: sign\_and\_send\_pubkey: RSA 3c:0e:99:49:fb:eb:b9:a7:f3:c2:d2:c5:e6:9a:a6:b7 > > > debug2: we sent a publickey packet, wait for reply > > > debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic > > > debug2: we did not send a packet, disable method > > > debug1: No more authentication methods to try. > > > Permission denied (publickey,gssapi-keyex,gssapi-with-mic). > > > > > > FATAL: all hosts have already failed – aborting Thanks!