# ssh failing for a newly created EC2 instances **URL:** \ **Category:** Ansible Project\ **Tags:** ubuntu\ **Created:** [October 21, 2013, 3:50pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731 "2013-10-21T15:50:44Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Soumya\_Simanta](https://avatars.discourse-cdn.com/v4/letter/s/57b2e6/32.png) [@Soumya\_Simanta](https://forum.ansible.com/u/Soumya_Simanta)\ **Post date:** [October 21, 2013, 3:50pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/1 "2013-10-21T15:50:44Z")
My apologies for posting this as a new question but I’m doing it because I think it’s a separate question. My understanding is that the newly launched EC2 instances are added to an in-memory host group. And since I’m passing the private key of the EC2 instances to the ansible-playbook command I should be able log in. I was able to start up EC2 instances by following the example link below. [https://github.com/ansible/ansible-examples/blob/master/language\_features/eucalyptus-ec2.yml](https://github.com/ansible/ansible-examples/blob/master/language_features/eucalyptus-ec2.yml) However, I’m having trouble connecting to the instances after they are created. This is my playbook. - name: Stage instance(s) hosts: cfgsvr connection: local user: myuserid gather\_facts: false vars: keypair: mykeypair image: ami-2efa9d47 instance\_type: m1.small #t1.micro subnet: subnet-xxxxxx region: us-east-1 image: ami-2efa9d47 # Launch 1 instance with the following parameters. Register the output. tasks: - name: Launch instance local\_action: ec2 keypair={{keypair}} vpc\_subnet\_id={{subnet}} instance\_type={{instance\_type}} image={{image}} wait=true count=1 register: ec2 # Use with\_items to add each instances public IP to a new hostgroup for use in the next play. - name: Add new instances to host group local\_action: add\_host hostname={{item.public\_ip}} groupname= **deploy** with\_items: ${ec2.instances} - name: Wait for the instances to boot by checking the ssh port local\_action: wait\_for host={{item.public\_dns\_name}} port=22 delay=60 timeout=320 state=started with\_items: ${ec2.instances} - name: Breathing room pause: seconds=30 # This play targets the new host group - name: Configure instance hosts: **deploy #must match groupname in “add\_host” above** user: ubuntu sudo: yes gather\_facts: true # Install the necessary software on each instance tasks: - name: Get the latest updates for instance action: command apt-get update - name: Install JDK apt: pkg=openjdk-6-jre-headless state=latest install\_recommends=no update\_cache=yes #action: apt pkg=java-1.7.0-openjdk state=latest - name: Install Maven2 apt: pkg=maven2 state=latest update\_cache=yes I’m launching the playbook using the following command. $ansible-playbook -v ec2\_launch.yml -vvvv -i inventory/ansible\_hosts **–private-key=/path/to/private/key** GATHERING FACTS \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ESTABLISH CONNECTION FOR USER: ubuntu EXEC [‘ssh’, ‘-tt’, ‘-vvv’, ‘-o’, ‘ControlMaster=auto’, ‘-o’, ‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/home/myuserid/.ansible/cp/ansible-ssh-%h-%p-%r’, ‘-o’, ‘Port=22’, ‘-o’, ‘IdentityFile=/home/myuserid/.ec2/myprivatekey.pem’, ‘-o’, ‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’, ‘User=ubuntu’, ‘-o’, ‘ConnectTimeout=10’, u’None’, “/bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-1382270163.81-64347444346956 && chmod a+rx $HOME/.ansible/tmp/ansible-1382270163.81-64347444346956 && echo $HOME/.ansible/tmp/ansible-1382270163.81-64347444346956’”] fatal: [None] =\> SSH encountered an unknown error. The output was: OpenSSH\_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012 debug1: Reading configuration data /etc/ssh/ssh\_config debug1: /etc/ssh/ssh\_config line 19: Applying options for \* debug1: auto-mux: Trying existing master debug1: Control socket “/home/myuserid/.ansible/cp/ansible-ssh-None-22-ubuntu” does not exist debug2: ssh\_connect: needpriv 0 ssh: Could not resolve hostname None: Name or service not known TASK: [Get the latest updates for instance] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* FATAL: no hosts matched or all hosts have already failed – aborting I can log into the launched instance by using the private key I’m passing to the ansible-playbook command. $ansible-playbook -v ec2\_launch.yml -vvvv -i inventory/ansible\_hosts **–private-key=/path/to/private/key** Any idea why is this failing? Thanks. ---
**Author:** ![Brian\_Moulton](https://avatars.discourse-cdn.com/v4/letter/b/73ab20/32.png) [@Brian\_Moulton](https://forum.ansible.com/u/Brian_Moulton)\ **Post date:** [October 21, 2013, 5:57pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/2 "2013-10-21T17:57:56Z")
Looks like ssh is not open on the hosts. ---
**Author:** ![Soumya\_Simanta](https://avatars.discourse-cdn.com/v4/letter/s/57b2e6/32.png) [@Soumya\_Simanta](https://forum.ansible.com/u/Soumya_Simanta)\ **Post date:** [October 22, 2013, 12:11pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/3 "2013-10-22T12:11:24Z")
I can ssh into the launched instance from command line without any issues. **$ssh -i /path/to/private/key ubuntu@X.X.X.X** works just fine. Off topic, one of the reasons I choose Ansible over other DevOps tools was because of the advertised easy configuration. However, based on my initial experience it looks like that’s not the case. Either I’m missing out on basic things or the configuration is not as easy as it seems. -Soumya ---
**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\ **Post date:** [October 22, 2013, 1:18pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/4 "2013-10-22T13:18:38Z")
Have you tried invoking ssh-agent, adding the key and then running ansible playbook? 1) eval $(ssh-agent) 2) ssh-add /path/to/private/kye 3) ansible-playbook \ ---
**Author:** ![Soumya\_Simanta](https://avatars.discourse-cdn.com/v4/letter/s/57b2e6/32.png) [@Soumya\_Simanta](https://forum.ansible.com/u/Soumya_Simanta)\ **Post date:** [October 22, 2013, 3:24pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/5 "2013-10-22T15:24:56Z")
@James. I tried invoking ssh-agent and adding my private key to it before running ansible playbook. However, it still doesn’t work :-(. I also tried the ansbile-playbook command with and without the private-key option but it still gives the same error. I’m almost ready to give up on this now. -Soumya ---
**Author:** ![Greg\_Andrews](https://avatars.discourse-cdn.com/v4/letter/g/6bbea6/32.png) [@Greg\_Andrews](https://forum.ansible.com/u/Greg_Andrews)\ **Post date:** [October 22, 2013, 3:26pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/6 "2013-10-22T15:26:01Z")
Here's the relevant portion of the -vvvv output. It's the last three things that Ansible passed to ssh on the command line. (I've truncated the last one to just the starting 10 characters, for clarity): '-o', 'ConnectTimeout=10', u'None', "/bin/sh -c" The "-o ConnectTimeout=10" is the last of the command-line options given to ssh. The "u'None'" is interpreted by ssh as the remote hostname to connect to. The "/bin/sh -c" and following text is interpreted by ssh as the command to execute on the remote host. According to the ssh error message, the hostname "u'None'" is not resolving to a usable hostname or IP address. And it doesn't look like the kind of name that will properly resolve. So the evidence points to the playbook not successfully passing the EC2 instance's hostname (or ip address) to the ssh command, not a problem in the EC2 instance itself or in ssh keys.   -Greg ---
**Author:** ![Soumya\_Simanta](https://avatars.discourse-cdn.com/v4/letter/s/57b2e6/32.png) [@Soumya\_Simanta](https://forum.ansible.com/u/Soumya_Simanta)\ **Post date:** [October 22, 2013, 4:29pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/7 "2013-10-22T16:29:55Z")
@Greg, Thank you. Your analysis makes perfect sense. The host name is set here in the playbook. However, since I’m launching this instance on a VPC (Virtual Private Cloud) instance. This value is not set in the ansible variable. # Use with\_items to add each instances public IP to a new hostgroup for use in the next play. - name: Add new instances to host group local\_action: add\_host **hostname={{item.public\_ip}}** groupname= **deploy** with\_items: ${ec2.instances} I need to use **hostname={{item.private\_ip}}** for this work. However, now I’m getting the following error. GATHERING FACTS \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* \<10.128.3.113\> ESTABLISH CONNECTION FOR USER: ubuntu \<10.128.3.113\> EXEC [‘ssh’, ‘-tt’, ‘-vvv’, ‘-o’, ‘ControlMaster=auto’, ‘-o’, ‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/home/myuserid/.ansible/cp/ansible-ssh-%h-%p-%r’, ‘-o’, ‘Port=22’, ‘-o’, ‘IdentityFile=/home/myuserid/.ec2/myprivatekey.pem’, ‘-o’, ‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’, ‘User=ubuntu’, ‘-o’, ‘ConnectTimeout=10’, u’10.128.3.113’, “/bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-1382457536.35-172524262324962 && chmod a+rx $HOME/.ansible/tmp/ansible-1382457536.35-172524262324962 && echo $HOME/.ansible/tmp/ansible-1382457536.35-172524262324962’”] fatal: [10.128.3.113] =\> SSH encountered an unknown error. The output was: OpenSSH\_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012 debug1: Reading configuration data /etc/ssh/ssh\_config debug1: /etc/ssh/ssh\_config line 19: Applying options for \* debug1: auto-mux: Trying existing master debug1: Control socket “/home/myuserid/.ansible/cp/ansible-ssh-10.128.3.113-22-ubuntu” does not exist debug2: ssh\_connect: needpriv 0 debug1: Connecting to 10.128.3.113 [10.128.3.113] port 22. debug2: fd 3 setting O\_NONBLOCK debug1: fd 3 clearing O\_NONBLOCK debug1: Connection established. debug3: timeout: 9999 ms remain after connect debug3: Incorrect RSA1 identifier debug3: Could not load “/home/myuserid/.ec2/myprivatekey.pem” as a RSA1 public key debug1: identity file /home/myuserid/.ec2/myprivatekey.pem type -1 debug1: identity file /home/myuserid/.ec2/myprivatekey.pem-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH\_5.9p1 Debian-5ubuntu1 debug1: match: OpenSSH\_5.9p1 Debian-5ubuntu1 pat OpenSSH\* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH\_5.9p1 Debian-5ubuntu1 debug2: fd 3 setting O\_NONBLOCK debug3: load\_hostkeys: loading entries for host “10.128.3.113” from file “/home/myuserid/.ssh/known\_hosts” debug3: load\_hostkeys: found key type ECDSA in file /home/myuserid/.ssh/known\_hosts:35 debug3: load\_hostkeys: loaded 1 keys debug3: order\_hostkeyalgs: prefer hostkeyalgs: [ecdsa-sha2-nistp256-cert-v01@openssh.com](mailto:ecdsa-sha2-nistp256-cert-v01@openssh.com),ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 debug1: SSH2\_MSG\_KEXINIT sent debug1: SSH2\_MSG\_KEXINIT received debug2: kex\_parse\_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex\_parse\_kexinit: [ecdsa-sha2-nistp256-cert-v01@openssh.com](mailto:ecdsa-sha2-nistp256-cert-v01@openssh.com),ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-rsa,ssh-dss debug2: kex\_parse\_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex\_parse\_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex\_parse\_kexinit: [hmac-md5,hmac-sha1,umac-64@openssh.com](mailto:hmac-md5,hmac-sha1,umac-64@openssh.com),hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex\_parse\_kexinit: [hmac-md5,hmac-sha1,umac-64@openssh.com](mailto:hmac-md5,hmac-sha1,umac-64@openssh.com),hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex\_parse\_kexinit: [none,zlib@openssh.com](mailto:none,zlib@openssh.com),zlib debug2: kex\_parse\_kexinit: [none,zlib@openssh.com](mailto:none,zlib@openssh.com),zlib debug2: kex\_parse\_kexinit: debug2: kex\_parse\_kexinit: debug2: kex\_parse\_kexinit: first\_kex\_follows 0 debug2: kex\_parse\_kexinit: reserved 0 debug2: kex\_parse\_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex\_parse\_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256 debug2: kex\_parse\_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex\_parse\_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se debug2: kex\_parse\_kexinit: [hmac-md5,hmac-sha1,umac-64@openssh.com](mailto:hmac-md5,hmac-sha1,umac-64@openssh.com),hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex\_parse\_kexinit: [hmac-md5,hmac-sha1,umac-64@openssh.com](mailto:hmac-md5,hmac-sha1,umac-64@openssh.com),hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex\_parse\_kexinit: [none,zlib@openssh.com](mailto:none,zlib@openssh.com) debug2: kex\_parse\_kexinit: [none,zlib@openssh.com](mailto:none,zlib@openssh.com) debug2: kex\_parse\_kexinit: debug2: kex\_parse\_kexinit: debug2: kex\_parse\_kexinit: first\_kex\_follows 0 debug2: kex\_parse\_kexinit: reserved 0 debug2: mac\_setup: found hmac-md5 debug1: kex: server-\>client aes128-ctr hmac-md5 none debug2: mac\_setup: found hmac-md5 debug1: kex: client-\>server aes128-ctr hmac-md5 none debug1: sending SSH2\_MSG\_KEX\_ECDH\_INIT debug1: expecting SSH2\_MSG\_KEX\_ECDH\_REPLY debug1: Server host key: ECDSA cc:cc:cc:cc:cc:29:f7:62:c4:21:4a:cc:cc:cc:cc:02 debug3: load\_hostkeys: loading entries for host “10.128.3.113” from file “/home/myuserid/.ssh/known\_hosts” debug3: load\_hostkeys: found key type ECDSA in file /home/myuserid/.ssh/known\_hosts:35 debug3: load\_hostkeys: loaded 1 keys @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the ECDSA key sent by the remote host is Please contact your system administrator. Add correct host key in /home/myuserid/.ssh/known\_hosts to get rid of this message. Offending ECDSA key in /home/myuserid/.ssh/known\_hosts:35 remove with: ssh-keygen -f “/home/myuserid/.ssh/known\_hosts” -R 10.128.3.113 ECDSA host key for 10.128.3.113 has changed and you have requested strict checking. Host key verification failed. ---
**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\ **Post date:** [October 22, 2013, 4:35pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/8 "2013-10-22T16:35:21Z")
Take a look at [http://www.ansibleworks.com/docs/intro\_getting\_started.html#host-key-checking](http://www.ansibleworks.com/docs/intro_getting_started.html#host-key-checking) ---
**Author:** ![Soumya\_Simanta](https://avatars.discourse-cdn.com/v4/letter/s/57b2e6/32.png) [@Soumya\_Simanta](https://forum.ansible.com/u/Soumya_Simanta)\ **Post date:** [October 22, 2013, 5:41pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/9 "2013-10-22T17:41:52Z")
@James - thanks. Looks like it worked. Now the “gathering facts” part works. GATHERING FACTS \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* \<10.128.3.96\> ESTABLISH CONNECTION FOR USER: ubuntu \<10.128.3.96\> EXEC [‘ssh’, ‘-tt’, ‘-vvv’, ‘-o’, ‘ControlMaster=auto’, ‘-o’, ‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/home/dhkarimi/.ansible/cp/ansible-ssh-%h-%p-%r’, ‘-o’, ‘StrictHostKeyChecking=no’, ‘-o’, ‘Port=22’, ‘-o’, ‘IdentityFile=/home/myuserid/.ec2/myprivatekey.pem’, ‘-o’, ‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’, ‘User=ubuntu’, ‘-o’, ‘ConnectTimeout=10’, u’10.128.3.96’, “/bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-1382460221.33-1627522380647 && chmod a+rx $HOME/.ansible/tmp/ansible-1382460221.33-1627522380647 && echo $HOME/.ansible/tmp/ansible-1382460221.33-1627522380647’”] \<10.128.3.96\> REMOTE\_MODULE setup \<10.128.3.96\> PUT /tmp/tmpoW\_ql9 TO /home/ubuntu/.ansible/tmp/ansible-1382460221.33-1627522380647/setup \<10.128.3.96\> EXEC [‘ssh’, ‘-tt’, ‘-vvv’, ‘-o’, ‘ControlMaster=auto’, ‘-o’, ‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/home/dhkarimi/.ansible/cp/ansible-ssh-%h-%p-%r’, ‘-o’, ‘StrictHostKeyChecking=no’, ‘-o’, ‘Port=22’, ‘-o’, ‘IdentityFile=/home/myuserid/.ec2/myprivatekey.pem’, ‘-o’, ‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’, ‘User=ubuntu’, ‘-o’, ‘ConnectTimeout=10’, u’10.128.3.96’, ‘/bin/sh -c 'sudo -k && sudo -H -S -p “[sudo via ansible, key=rvylffsgfldcrdflelruftijxekjhdqu] password: " -u root /bin/sh -c '”'“'/usr/bin/python /home/ubuntu/.ansible/tmp/ansible-1382460221.33-1627522380647/setup; rm -rf /home/ubuntu/.ansible/tmp/ansible-1382460221.33-1627522380647/ \>/dev/null 2\>&1'”'"''’] ok: [10.128.3.96] However, it fails in the next step in the playbook. I believe that is because it’s trying to log in as myuserid and not as ubuntu as defined in the following section of the playbook. The keys on the launched instance are set for the user ubuntu and not the user myuserid. - name: Configure instance hosts: **deploy #must match groupname in “add\_host” above** user: ubuntu sudo: yes gather\_facts: true My understanding was that all tasks will use the user defined in the above section of the playbook. But looks like I’ve resolved most of the important issues. Thanks all for the help. -Soumya ---
**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\ **Post date:** [October 22, 2013, 5:47pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/10 "2013-10-22T17:47:41Z")
When passing "-vvvv" to ansible playbook, every task will output something like ... \<10.128.3.96\> ESTABLISH CONNECTION FOR USER: ubuntu If you suspect a task is connecting as the wrong user, take a look at the -vvvv outputs to confirm. ---
**Author:** ![Soumya\_Simanta](https://avatars.discourse-cdn.com/v4/letter/s/57b2e6/32.png) [@Soumya\_Simanta](https://forum.ansible.com/u/Soumya_Simanta)\ **Post date:** [October 22, 2013, 5:52pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/11 "2013-10-22T17:52:24Z")
@James - I know that it is trying to connect a different user (myuserid) [see log below] and the ssh connection fails because the EC2 instance is configured for user ubuntu and not user myuserid. Any idea how to fix this ? TASK: [Get the latest updates for instance] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* \<10.128.3.240\> ESTABLISH CONNECTION FOR USER: **myuserid** ---
**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\ **Post date:** [October 22, 2013, 5:53pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/12 "2013-10-22T17:53:49Z")
Can we see an example playbook? ---
**Author:** ![Soumya\_Simanta](https://avatars.discourse-cdn.com/v4/letter/s/57b2e6/32.png) [@Soumya\_Simanta](https://forum.ansible.com/u/Soumya_Simanta)\ **Post date:** [October 22, 2013, 6:01pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/13 "2013-10-22T18:01:14Z")
Sure. I posted a version with my initial question. But here is the updated one. I believe it fails here because of the incorrect user. **# Install the necessary software on each instance** - name: Stage instance(s) hosts: cfgsvr connection: local user: dhkarimi gather\_facts: false vars: keypair: mykeypair image: ami-2efa9d47 instance\_type: m1.small subnet: subnet-XXXXXX region: us-east-1 image: ami-2efa9d47 # Launch 1 instance with the following parameters. Register the output. # You can change the number of instances to lanuch by changing the “count” variable in the location action tasks: - name: Launch instance local\_action: ec2 keypair={{keypair}} vpc\_subnet\_id={{subnet}} instance\_type={{instance\_type}} image={{image}} wait=true count=1 register: ec2 # Use with\_items to add each instances public IP to a new hostgroup for use in the next play. - name: Add new instances to host group local\_action: add\_host hostname={{item.private\_ip}} groupname=deploy with\_items: ${ec2.instances} - name: Wait for the instances to boot by checking the ssh port local\_action: wait\_for host={{item.public\_dns\_name}} port=22 delay=60 timeout=320 state=started with\_items: ${ec2.instances} # This play targets the new host group - name: Configure instance hosts: deploy user: ubuntu sudo: yes gather\_facts: true **# Install the necessary software on each instance** **tasks:** **- name: Get the latest updates for instance** **action: command apt-get update** - name: Install JDK apt: pkg=openjdk-6-jre-headless state=latest install\_recommends=no update\_cache=yes #action: apt pkg=java-1.7.0-openjdk state=latest - name: Install Maven2 apt: pkg=maven2 state=latest update\_cache=yes ---
**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\ **Post date:** [October 22, 2013, 6:02pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/14 "2013-10-22T18:02:31Z")
Which task is connecting as dhkarimi when it should be connecting as ubuntu? ---
**Author:** ![Soumya\_Simanta](https://avatars.discourse-cdn.com/v4/letter/s/57b2e6/32.png) [@Soumya\_Simanta](https://forum.ansible.com/u/Soumya_Simanta)\ **Post date:** [October 22, 2013, 6:05pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/15 "2013-10-22T18:05:31Z")
The one marked in bold in the playbook. **# Install the necessary software on each instance** **tasks:** **- name: Get the latest updates for instance** **action: command apt-get update** ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [October 23, 2013, 6:41pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/16 "2013-10-23T18:41:17Z")
This conversation should probably occur on IRC as it is of an very interactive basic-user-question type feature and is transitioning between different types of questions. Rather than having a long thread about a lot of different topics, I would suggest taking it over there. ---
**Author:** ![Cynthia\_Hertzer](https://avatars.discourse-cdn.com/v4/letter/c/8e8cbc/32.png) [@Cynthia\_Hertzer](https://forum.ansible.com/u/Cynthia_Hertzer)\ **Post date:** [September 7, 2014, 8:08pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/17 "2014-09-07T20:08:37Z")
I had an issue that initially looked similar to this. I pored over this thread carefully, trying a number of different things. I found a workaround I hadn’t seen mentioned and wanted to mention it here in case this is useful for others. Background/Environment: Ansible 1.7.1 on OSX, provisioning and CentOS 6.5 EC2 instance My goal was to write scripts to dynamically determine the IP of an EC2 instance, then run yum update/installs against that new instance. wait\_for ssh consistently indicated that I’d correctly gained the IP of the new instance, and something was answering at the ssh port, but ssh -vvvv debug output would indicate yum installs failed because ssh to the instance was failing. The ssh trace looked nearly identical to debug traces from successful manual command-line ssh tests until it failed at the end. debug2: we did not send a packet, disable method debug1: No more authentication methods to try. Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password) I was suspicious that ssh was being run against the wrong user, but the ansible debug output said it was using the user id I’d specified. **Workaround:** I added a 1min pause before trying to run yum and have concluded that there was a race condition where the key had not been installed on the EC2 instance when ansible first tried to ssh there to run yum. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 7, 2014, 8:30pm UTC](https://forum.ansible.com/t/ssh-failing-for-a-newly-created-ec2-instances/13731/18 "2014-09-07T20:30:51Z")
Yep, that’s a thing. Typically you’ll only need to pause a few seconds after an SSH port comes up and before you can connect. I’d reduce the 1 minute pause to only 5 seconds (immediately following the existing wait\_for task), 10 if you are feeling like it.