Hi,
cat /etc/ansible/hosts | grep dummy | grep ssh
dummy ansible_host=10.xx.xx.xx ansible_ssh_common_arg=“-o HostKeyAlgorithms=+ssh-dss”
when i try to execute against this host, I get this error.
ansible-playbook pre-prod_yaml_reconfig_12Mar2021.yml -vvvv
Using /etc/ansible/ansible.cfg as config file
Loaded callback skippy of type stdout, v2.0
1 plays in pre-prod_yaml_reconfig_12Mar2021.yml
PLAY [Update Newrelic yaml configuration files] ********************************
TASK [setup] *******************************************************************
<10.xx.xx.xx> ESTABLISH SSH CONNECTION FOR USER: None
<10.xx.xx.xx> SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/ansible-ssh-%h-%p-%r -tt 10.xx.xx.xx ‘( umask 22 && mkdir -p “$( echo $HOME/.ansible/tmp/ansible-tmp-1616140934.23-183416823411944 )” && echo “$( echo $HOME/.ansible/tmp/ansible-tmp-1616140934.23-183416823411944 )” )’
fatal: [dummy]: UNREACHABLE! => {“changed”: false, “msg”: “ERROR! SSH encountered an unknown error. The output was:\nOpenSSH_7.2p2 Ubuntu-4ubuntu2.8, OpenSSL 1.0.2g 1 Mar 2016\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 19: Applying options for *\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: Control socket "/root/.ansible/cp/ansible-ssh-10.xx.xx.xx-22-root" does not exist\r\ndebug2: resolving "10.xx.xx.xx" port 22\r\ndebug2: ssh_connect_direct: needpriv 0\r\ndebug1: Connecting to 10.xx.xx.xx [10.xx.xx.xx] port 22.\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug1: fd 3 clearing O_NONBLOCK\r\ndebug1: Connection established.\r\ndebug3: timeout: 9999 ms remain after connect\r\ndebug1: permanently_set_uid: 0/0\r\ndebug1: identity file /root/.ssh/id_rsa type 1\r\ndebug1: key_load_public: No such file or directory\r\ndebug1: identity file /root/.ssh/id_rsa-cert type -1\r\ndebug1: key_load_public: No such file or directory\r\ndebug1: identity file /root/.ssh/id_dsa type -1\r\ndebug1: key_load_public: No such file or directory\r\ndebug1: identity file /root/.ssh/id_dsa-cert type -1\r\ndebug1: key_load_public: No such file or directory\r\ndebug1: identity file /root/.ssh/id_ecdsa type -1\r\ndebug1: key_load_public: No such file or directory\r\ndebug1: identity file /root/.ssh/id_ecdsa-cert type -1\r\ndebug1: key_load_public: No such file or directory\r\ndebug1: identity file /root/.ssh/id_ed25519 type -1\r\ndebug1: key_load_public: No such file or directory\r\ndebug1: identity file /root/.ssh/id_ed25519-cert type -1\r\ndebug1: Enabling compatibility mode for protocol 2.0\r\ndebug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.8\r\ndebug1: Remote protocol version 2.0, remote software version ReflectionForSecureIT_7.2.1.99\r\ndebug1: no match: ReflectionForSecureIT_7.2.1.99\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug1: Authenticating to 10.xx.xx.xx:22 as ‘root’\r\ndebug3: hostkeys_foreach: reading file "/root/.ssh/known_hosts"\r\ndebug3: record_hostkey: found key type RSA in file /root/.ssh/known_hosts:222\r\ndebug3: load_hostkeys: loaded 1 keys from 10.xx.xx.xx\r\ndebug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-rsa-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa\r\ndebug3: send packet: type 20\r\ndebug1: SSH2_MSG_KEXINIT sent\r\ndebug3: receive packet: type 20\r\ndebug1: SSH2_MSG_KEXINIT received\r\ndebug2: local client KEXINIT proposal\r\ndebug2: KEX algorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,ext-info-c\r\ndebug2: host key algorithms: ssh-rsa-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519\r\ndebug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc\r\ndebug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc\r\ndebug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1\r\ndebug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1\r\ndebug2: compression ctos: zlib@openssh.com,zlib,none\r\ndebug2: compression stoc: zlib@openssh.com,zlib,none\r\ndebug2: languages ctos: \r\ndebug2: languages stoc: \r\ndebug2: first_kex_follows 0 \r\ndebug2: reserved 0 \r\ndebug2: peer server KEXINIT proposal\r\ndebug2: KEX algorithms: diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\r\ndebug2: host key algorithms: ssh-dss\r\ndebug2: ciphers ctos: aes128-ctr,aes128-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc,blowfish-cbc,3des-cbc,cast128-cbc,arcfour,arcfour128,arcfour256\r\ndebug2: ciphers stoc: aes128-ctr,aes128-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc,blowfish-cbc,3des-cbc,cast128-cbc,arcfour,arcfour128,arcfour256\r\ndebug2: MACs ctos: hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96\r\ndebug2: MACs stoc: hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96\r\ndebug2: compression ctos: none,zlib@openssh.com,zlib\r\ndebug2: compression stoc: none,zlib@openssh.com,zlib\r\ndebug2: languages ctos: \r\ndebug2: languages stoc: \r\ndebug2: first_kex_follows 0 \r\ndebug2: reserved 0 \r\ndebug1: kex: algorithm: diffie-hellman-group14-sha1\r\ndebug1: kex: host key algorithm: (no match)\r\nUnable to negotiate with 10.xx.xx.xx port 22: no matching host key type found. Their offer: ssh-dss\r\n”, “unreachable”: true}
PLAY RECAP *********************************************************************
dummy : ok=0 changed=0 unreachable=1 failed=0
the same command with ssh works fine and I’m able to login -
ssh -oHostKeyAlgorithms=+ssh-dss 10.xx.xx.xx
my ansible version
root@bastionhost:/ansible/projects/newrelic# ansible --version
ansible 2.0.0.2
config file = /etc/ansible/ansible.cfg
configured module search path = Default w/o overrides
root@bastionhost:/ansible/projects/newrelic#