# wait\_for, ssh config, & SOCKs **URL:** \ **Category:** Ansible Project\ **Tags:** ubuntu, aws\ **Created:** [June 2, 2015, 7:54pm UTC](https://forum.ansible.com/t/wait-for-ssh-config-socks/18382 "2015-06-02T19:54:18Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![fortescue](https://avatars.discourse-cdn.com/v4/letter/f/ee7513/32.png) [@fortescue](https://forum.ansible.com/u/fortescue)\ **Post date:** [June 2, 2015, 7:54pm UTC](https://forum.ansible.com/t/wait-for-ssh-config-socks/18382/1 "2015-06-02T19:54:18Z")
Hi, I am trying to figure out how to use wait\_for to start to detect ssh on a VPC host that needs to use 2 tunnels to be reached. I cannot use the IP address as it collides with my local network. DNS also doesn’t work but my tunnels work fine. I’m using SOCKs because I use a browser to access the VPC too. Here is my setup in pictograph: Dev → bastion.Prod → Bastion.AWS → VPC/internal There is ONLY ssh available via Dev & bastion.Prod, hence SOCKs tunnel1 for the rest of \*.example.com hosts. Bastion.AWS can only be reached via Prod via SSH hence a 2nd SOCKS tunnel. Bastion.AWS can only reach VPC via ssh. 10.0.0.0/24 is the bastion subnet. 10.0.1.0/24 is the internal subnet. I’m launching instances into VPC/10.0.1.0 I use Host namespaces in .ssh/config (which are generally NOT dns resolvable from Dev) to decide the tunnel to use. I can only reach [bastion.example.com](http://bastion.example.com) directly and by it’s resolvable dns name - the only dns resolvable name. My tunnel works as follows: ` Host \*.example.com ProxyCommand nc -x localhost:1080 %h %p Host ec2 ServerAliveInterval 50 DynamicForward localhost:1090 User ec2-user ProxyCommand nc -x localhost:1080 54.165.xx.yy 22 Host ip-10-0-1-\*.ec2.internal ProxyCommand nc -x localhost:1090 %h %p User ubuntu IdentityFile /home/me/.ssh/soc-proto-internal.pem # bastion Host ip-10-0-0-\*.ec2.internal ProxyCommand nc -x localhost:1090 %h %p User ec2-user IdentityFile /home/fortescu/.ssh/soc-proto-useast1.pem ` tunnel1: ` dev # ssh -vvv -D 1080 -N -q [me@bastion.example.com](mailto:me@bastion.example.com) OpenSSH\_6.2p2, OSSLShim 0.9.8r 8 Dec 2011 ` tunnel2: ` dev # ssh ec2 Amazon Linux version 2015.03 is available. [ec2-user@ip-10-0-0-188 ~]$ ` Now, from Dev the following works fine: ` dev # ssh ip-10.0.1.32 Last login: Tue Jun 2 19:15:07 2015 from ip-10-0-0-188.ec2.internal ubuntu@ip-10-0-1-32:~$ ` So how can I get this to work with wait\_for?! The ‘private\_dns\_name’ emits and is in the tmp wait\_for python script so it’s got the right form. I can even grab the that same address while waiting on wait\_for and ssh into it! Here’s the relevant ansible play: ` ` - name: Launch Opscenter instances ec2: key\_name: “{{ key\_name }}” group\_id: “{{ security\_group }}” instance\_type: “{{ instance\_type }}” image: “{{ image }}” wait: true region: “{{ region }}” vpc\_subnet\_id: “{{ subnet\_id }}” assign\_public\_ip: no ebs\_optimized: no instance\_tags: Name: “cassandra\_opscenter” dbtype: cassandra register: ec2 - name: Logging debug: msg=“{{ item }}” with\_items: ec2.instances - name: Add new instance to host group add\_host: hostname={{ item[‘private\_dns\_name’] }} ansible\_ssh\_host={{ item[‘private\_dns\_name’] }} groups=launched,opscenter\_nodes with\_items: ec2.instances - name: Wait for SSH to come up local\_action: wait\_for port=22 host=“{{ item[‘private\_dns\_name’] }}” search\_regex=OpenSSH delay=10 with\_items: ec2.instances I know I must be missing something obvious but it seems like wait\_for is stubborning trying to use DNS (which will fail) instead of .ssh/config. Am I chasing a unicorn here? Can this be made to work? Any and all advice deeply appreciated. Chris ---
**Author:** ![benno\_joy](https://avatars.discourse-cdn.com/v4/letter/b/73ab20/32.png) [@benno\_joy](https://forum.ansible.com/u/benno_joy)\ **Post date:** [June 3, 2015, 4:51am UTC](https://forum.ansible.com/t/wait-for-ssh-config-socks/18382/2 "2015-06-03T04:51:03Z")
Hi Chris, wait\_for doesnt not use ssh/config files and will uses tcp connection to test if port 22 is open for connection and hence tries to lookup the ip via dns. maybe you could try the below to test if ssh has come up or not. local\_action: shell ssh “{{item[‘private\_dns\_name’] }}” echo hello register: foo retries: 5 delay: 5 until: foo.stdout.find(‘hello’) != -1 ---
**Author:** ![fortescue](https://avatars.discourse-cdn.com/v4/letter/f/ee7513/32.png) [@fortescue](https://forum.ansible.com/u/fortescue)\ **Post date:** [June 5, 2015, 6:32am UTC](https://forum.ansible.com/t/wait-for-ssh-config-socks/18382/3 "2015-06-05T06:32:31Z")
Hi Benno, Et voila! That worked great. A deep bow. Chris