Can't connect to server by SSH after applying this role

[artemnikitin]

I tried to apply the role to a server and after successful applying, I can't connect to a server by SSH. I read the FAQ and tried to change different settings, but it doesn't help. Server using Ubuntu 16.04.

SSH client log:

OpenSSH_7.4p1, LibreSSL 2.5.0
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to x.x.x.x [x.x.x.x] port 22.
debug1: Connection established.
debug1: identity file /xxx/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /xxx/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /xxx/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /xxx/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /xxx/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /xxx/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /xxx/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /xxx/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1
debug1: match: OpenSSH_6.6.1p1 pat OpenSSH_6.6.1* compat 0x04000000
debug1: Authenticating to x.x.x.x:22 as 'artem'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:TY3W4ZY8ysTNV33FH5gnJUQuNWjJ2zdc0M3nMo2rHbI
debug1: Host 'x.x.x.x' is known and matches the ECDSA host key.
debug1: Found key in /xxx/.ssh/known_hosts:32
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /xxx/.ssh/id_rsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: /xxx/.ssh/id_dsa
debug1: Trying private key: /xxx/.ssh/id_ecdsa
debug1: Trying private key: /xxx/.ssh/id_ed25519
debug1: No more authentication methods to try.
Permission denied (publickey).

[CafeLungo]

I believe I am running into this same problem. Version 4.0.0 and 4.1.2.

[rndmh3ro]

Thanks for mentioning this @CafeLungo!
Can you give us your complete playbook (and roles) so I can try to reproduce the issue? Also the name of the operating system, please. :)

[StefanoAgazzi]

I remember I had to add the user to a group called sshuser or sshusers, cannot remember exactly the group name sorry

…

On Tue, Jun 20, 2017, 18:04 Sebastian Gumprich ***@***.***> wrote: Thanks for mentioning this @CafeLungo <https://github.com/cafelungo>! Can you give us your complete playbook (and roles) so I can try to reproduce the issue? Also the name of the operating system, please. :) — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#115 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACj_4RaN7Oncf9aZ9sjabO30s8hnMSc-ks5sF-19gaJpZM4Nmv-p> .

[thbar]

FWIW I think I had a similar error message because the user password wasn't defined. Setting a password fixed the error. It may be completely different but in case!

[CafeLungo]

@rndmh3ro FYI, I was working last night trying to come up with a minimal playbook to produce this issue. I investigated what @thbar suggested, deleting user password, but that didn't seem to do it either. Is deleting different from not defining one somehow? I was doing passwd -d ubuntu.

I'll investigate next what @StefanoAgazzi suggested with the user group... I didn't look into that yet.

I do know, I haven't seen this with Vagrant ubuntu boxes (yet). But, I first saw this when deploying/provisioing to an AWS EC2 Ubuntu 16.04 instance. Does anyone here know what could be different about AWS instances vs a virtualbox VM that might cause this? I can do some further testing.

I'll publish what I have once I figure out a minimal playbook to cause it. (I don't want to publish my companies playbook, but haven't figured out what is relevant yet)

[jschmoelz]

@thbar Setting a password for my SSH user resolved the issue for me. Thank you very much.

[Rockstar04]

I'm running into this as well. I've just set ssh_client_hardening and ssh_server_hardening both to false for now, after resetting my ssh(d)_config files to Ubuntu default to get me through deploying my dev servers. I'll try to circle back.

[rndmh3ro]

@Rockstar04, do you also use AWS EC2 Ubuntu 16.04 instances?

[Rockstar04]

Not on EC2, but its a 16.04.3 VM I installed this morning. Its KVM virt on Proxmox.

OpenSSH_7.2p2 Ubuntu-4ubuntu2.2, OpenSSL 1.0.2g 1 Mar 2016

[rndmh3ro]

So I finally got the time to try to reproduce this.
When creating a EC2-instance, the default user is ubuntu, so this one has to be include into the AllowedUsers. I'm thinking about doing that by default.
And setting the password for that user then allows him to login.

I'll try to think of something. Maybe a note in the readme?

[gruzewski]

I hit the same problem with Ubuntu 16.04 on AWS. In my case, enabling PAM module (UsePAM yes) in sshd_config solved the problem for me. You can workaround it in the dev-sec role with setting ssh_use_pam: true.

Example:

---
- name: Example Playbook
  hosts: all

  roles:
    - dev-sec.ssh-hardening

  vars:
    ssh_use_pam: true # https://github.com/dev-sec/ansible-ssh-hardening/issues/115

I might look into it at some point, if time allows. Btw, great project!

[mwakerman]

@gruzewski's solution worked for us.

Edit: realise now that it is in the README ¯\_(ツ)_/¯