# SSH private key invalid ? Ansible Mikrotik RouterOS configuration **URL:** \ **Category:** Ansible Project\ **Tags:** ubuntu\ **Created:** [May 28, 2019, 6:06pm UTC](https://forum.ansible.com/t/ssh-private-key-invalid-ansible-mikrotik-routeros-configuration/30441 "2019-05-28T18:06:28Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![samudra.haque](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@samudra.haque](https://forum.ansible.com/u/samudra.haque)\ **Post date:** [May 28, 2019, 6:06pm UTC](https://forum.ansible.com/t/ssh-private-key-invalid-ansible-mikrotik-routeros-configuration/30441/1 "2019-05-28T18:06:28Z")
Hello Ansible gurus, I am new to Ansible and have installed from Git source branch. I am not changing anything at this time. I am investigating ways to use Ansible with Mikrotik RouterOS ([www.mt.lv](http://www.mt.lv) or [www.mikrotik.com](http://www.mikrotik.com)). My test environment is a Ubuntu 18.xx linux box on a local area network. The two devices are on the same ethernet switch. ` dev1@s5:~/TTLLC\_ansible$ uname -a Linux s5 5.0.0-15-generic #16-Ubuntu SMP Mon May 6 17:41:33 UTC 2019 x86\_64 x86\_64 x86\_64 GNU/Linux dev1@s5:~/TTLLC\_ansible$ ansible --version 22073 1559065845.13968: starting run ansible 2.9.0.dev0 config file = /etc/ansible/ansible.cfg configured module search path = [u’/home/dev1/.ansible/plugins/modules’, u’/usr/share/ansible/plugins/modules’] ansible python module location = /home/dev1/src/ansible/lib/ansible executable location = /home/dev1/src/ansible/bin/ansible python version = 2.7.16 (default, Apr 6 2019, 01:42:57) [GCC 8.3.0] dev1@s5:~/TTLLC\_ansible$ ` I have SSH private-key and public-key setup to allow me to access the Mikrotik RouterOS session without an interactive password from the Ubuntu box. For now, I am testing DSA file private key/public key ` dev1@s5:~/.ssh$ ls -l total 16 -rw------- 1 dev1 dev1 1373 May 26 23:10 3101\_dsa -rw-r–r-- 1 dev1 dev1 597 May 26 23:10 3101\_dsa.pub dev1@s5:~/.ssh$ file \* 3101\_dsa: OpenSSH private key 3101\_dsa.pub: OpenSSH DSA public key ` Here is the proof that SSH works from the command line. ` dev1@s5:~/TTLLC\_ansible$ ssh -i ~/.ssh/3101\_dsa [ttadmins@10.0.0.99](mailto:ttadmins@10.0.0.99) -p 22222 MMM MMM KKK TTTTTTTTTTT KKK MMMM MMMM KKK TTTTTTTTTTT KKK MMM MMMM MMM III KKK KKK RRRRRR OOOOOO TTT III KKK KKK MMM MM MMM III KKKKK RRR RRR OOO OOO TTT III KKKKK MMM MMM III KKK KKK RRRRRR OOO OOO TTT III KKK KKK MMM MMM III KKK KKK RRR RRR OOOOOO TTT III KKK KKK MikroTik RouterOS 6.43.2 (c) 1999-2018 [http://www.mikrotik.com/](http://www.mikrotik.com/) [?] Gives the list of available commands command [?] Gives help on the command and list of arguments [Tab] Completes the command/word. If the input is ambiguous, a second [Tab] gives possible options / Move up to base level .. Move up one level /command Use command at the base level ` Here is my problem (the full debug output is at the end of this message, sorry for the length) - Ansible reports the SSH module complains it is an Invalid key. ` The full traceback is: Traceback (most recent call last): File “/home/dev1/src/ansible/bin/ansible-connection”, line 104, in start self.connection.\_connect() File “/home/dev1/src/ansible/lib/ansible/plugins/connection/network\_cli.py”, line 327, in \_connect ssh = self.paramiko\_conn.\_connect() File “/home/dev1/src/ansible/lib/ansible/plugins/connection/paramiko\_ssh.py”, line 245, in \_connect self.ssh = SSH\_CONNECTION\_CACHE[cache\_key] = self.\_connect\_uncached() File “/home/dev1/src/ansible/lib/ansible/plugins/connection/paramiko\_ssh.py”, line 368, in \_connect\_uncached raise AnsibleConnectionFailure(msg) AnsibleConnectionFailure: Invalid key 22502 1559065909.68461: done running TaskExecutor() for 10.0.0.99/TASK: Gathering Facts [8851fb63-ee9d-cebc-7778-00000000000c] 22502 1559065909.68478: sending task result for task 8851fb63-ee9d-cebc-7778-00000000000c 22502 1559065909.68512: done sending task result for task 8851fb63-ee9d-cebc-7778-00000000000c 22502 1559065909.68518: WORKER PROCESS EXITING 22489 1559065909.68718: marking 10.0.0.99 as failed 22489 1559065909.68731: marking host 10.0.0.99 failed, current state: HOST STATE: block=0, task=0, rescue=0, always=0, run\_state=ITERATING\_SETUP, fail\_state=FAILED\_NONE, pending\_setup=True, tasks child state? (None), rescue child state? (None), always child state? (None), did rescue? False, did start at task? False 22489 1559065909.68736: ^ failed state is now: HOST STATE: block=0, task=0, rescue=0, always=0, run\_state=ITERATING\_COMPLETE, fail\_state=FAILED\_SETUP, pending\_setup=True, tasks child state? (None), rescue child state? (None), always child state? (None), did rescue? False, did start at task? False 22489 1559065909.68741: getting the next task for host 10.0.0.99 22489 1559065909.68746: host 10.0.0.99 is done iterating, returning fatal: [10.0.0.99]: FAILED! =\> { “msg”: “Invalid key” } ` I would have assumed the following script would work - but it doesn’t, what am I doing wrong - how am I messing up the key definition? ` dev1@s5:~/TTLLC\_ansible$ cat doAnsible.sh #! /bin/bash # Specify the location for the log file export ANSIBLE\_LOG\_PATH=/tmp/foo # Enable Debug export ANSIBLE\_DEBUG=True cat /dev/null \> /tmp/foo # Run with 4\*v for connection level verbosity ansible-playbook -u ttadmins -vvvv -i TTLLC\_hosts ansibleRouterOS.yml ` YAML file ` dev1@s5:~/TTLLC\_ansible$ cat ansibleRouterOS.yml ---
**Author:** ![samudra.haque](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@samudra.haque](https://forum.ansible.com/u/samudra.haque)\ **Post date:** [May 28, 2019, 11:11pm UTC](https://forum.ansible.com/t/ssh-private-key-invalid-ansible-mikrotik-routeros-configuration/30441/2 "2019-05-28T23:11:20Z")
I have an update, after editing Hosts, Playbook and the script: ` dev1@s5:~/TTLLC\_ansible$ cat ansibleRouterOS.yml > **(attachments)** > > ![ansible1.png](https://us1.discourse-cdn.com/ansible/original/2X/1/1bdd6b2385fbfd4bdd2403641beeb4f1fd48dc9d.png) ---
**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\ **Post date:** [May 29, 2019, 4:02am UTC](https://forum.ansible.com/t/ssh-private-key-invalid-ansible-mikrotik-routeros-configuration/30441/3 "2019-05-29T04:02:53Z")
You’re using ansible from source. Could you try again using a released stable version that has been out for some time? For instance 2.7.10. Dick ---
**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\ **Post date:** [May 29, 2019, 4:15am UTC](https://forum.ansible.com/t/ssh-private-key-invalid-ansible-mikrotik-routeros-configuration/30441/4 "2019-05-29T04:15:18Z")
Hi, Note that since 2.7, Ansible has some support for RouterOS built-in: [https://docs.ansible.com/ansible/latest/network/user\_guide/platform\_routeros.html](https://docs.ansible.com/ansible/latest/network/user_guide/platform_routeros.html) There are currently two modules which should work: [https://docs.ansible.com/ansible/latest/modules/routeros\_command\_module.html](https://docs.ansible.com/ansible/latest/modules/routeros_command_module.html) [https://docs.ansible.com/ansible/latest/modules/routeros\_facts\_module.html](https://docs.ansible.com/ansible/latest/modules/routeros_facts_module.html) Cheers, Felix ---
**Author:** ![samudra.haque](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@samudra.haque](https://forum.ansible.com/u/samudra.haque)\ **Post date:** [May 29, 2019, 1:29pm UTC](https://forum.ansible.com/t/ssh-private-key-invalid-ansible-mikrotik-routeros-configuration/30441/5 "2019-05-29T13:29:54Z")
Interesting suggestion and I will attempt to revert back to a stable release as suggested. In the meantime, I can confirm the 2.9.0dev0 framework acts differently with routeros ssh connections (the key is invalid always), yet that same key (last night I changed from DSA to RSA) works fine with scripted SSH (example below). I am not strictly a developer type, so I can be happy with a stable version. Let the buyers beware. Is this is a bug worth reporting? dev1@s5:~$ !1816 ssh -i /home/dev1/.ssh/3101\_id\_rsa -p 22222 -t [ttadmins@10.0.0.99](mailto:ttadmins@10.0.0.99) \<\< “ENDSSH” > /system resource pr > /ip route pr > /interface bridge pr > ENDSSH Pseudo-terminal will not be allocated because stdin is not a terminal. X11 forwarding request failed on channel 0 uptime: 1d9h39m10s version: 6.43.2 (stable) build-time: Sep/18/2018 12:12:48 factory-software: 6.41.3 free-memory: 469.6MiB total-memory: 512.0MiB cpu: ARMv7 cpu-count: 1 cpu-frequency: 800MHz cpu-load: 17% free-hdd-space: 3700.0KiB total-hdd-space: 16.0MiB write-sect-since-reboot: 1302 write-sect-total: 3568 bad-blocks: 0% architecture-name: arm board-name: CRS328-24P-4S+ platform: MikroTik Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit # DST-ADDRESS PREF-SRC GATEWAY DISTANCE 0 A S ;;; 3101 default gw to Verizon Fios ONT 0.0.0.0/0 10.0.0.1 1 1 ADC 10.0.0.0/24 10.0.0.99 ether24 0 2 ADC 10.0.1.0/24 10.0.1.1 3101-bridge 0 Flags: X - disabled, R - running 0 R ;;; 26may19/SH/LAN for 3101 name=“3101-bridge” mtu=auto actual-mtu=1500 l2mtu=1592 arp=enabled arp-timeout=auto mac-address=B8:69:F4:AC:F5:4D protocol-mode=rstp fast-forward=no igmp-snooping=no auto-mac=yes ageing-time=5m priority=0x8000 max-message-age=20s forward-delay=15s transmit-hold-count=6 vlan-filtering=no dhcp-snooping=no ---
**Author:** ![samudra.haque](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@samudra.haque](https://forum.ansible.com/u/samudra.haque)\ **Post date:** [June 9, 2019, 6:56pm UTC](https://forum.ansible.com/t/ssh-private-key-invalid-ansible-mikrotik-routeros-configuration/30441/6 "2019-06-09T18:56:04Z")
update: I de-installed all components of the earlier from-source distribution and used the apt-get on Ubuntu to install a pre-packaged version - with not much different result. I upgraded the keys on the Mikrotik host to DSA and made sure plain ssh calls worked from the command line. But running the same ansible-playbook script did not work - what can I do to generate more debug info on the reason the system thinks it has an invalid key, when the Mikrotik log says nothing bad. Is the paramiko module not recognizing that it has already established the session? or, what is it expecting back? ` > uname -a; ansible --version Linux s5 5.0.0-15-generic #16-Ubuntu SMP Mon May 6 17:41:33 UTC 2019 x86\_64 x86\_64 x86\_64 GNU/Linux ansible 2.8.1 config file = /home/dev1/TTLLC\_ansible/ansible.cfg configured module search path = [u’/home/dev1/.ansible/plugins/modules’, u’/usr/share/ansible/plugins/modules’] ansible python module location = /usr/lib/python2.7/dist-packages/ansible executable location = /usr/bin/ansible python version = 2.7.16 (default, Apr 6 2019, 01:42:57) [GCC 8.3.0] … ` On the Ubuntu ` 2019-06-09 14:12:44,685 p=5254 u=dev1 | Parsed /home/dev1/TTLLC\_ansible/TTLLC\_hosts inventory source with ini plugin 2019-06-09 14:12:44,887 p=5254 u=dev1 | Loading callback plugin default of type stdout, v2.0 from /usr/lib/pyt hon2.7/dist-packages/ansible/plugins/callback/default.pyc 2019-06-09 14:12:44,927 p=5254 u=dev1 | PLAYBOOK: ansibleRouterOS.yml \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*