Cannot ssh into new Vagrant install of 13.04

Question

I used the Vagrant image for 13.04 from http://cloud-images.ubuntu.com/vagrant/raring/current/raring-server-cloudimg-i386-vagrant-disk1.box to create a new virtual machine and tried to connect to it using ssh. However, the SSH always disconnected immediately, without even getting to the stage where it tried to authenticate.

I opened the VM in the VirtualBox GUI and looked at the SSH log file (auth.log). It was full of lines like this:

Jul 25 17:57:02 vagrant-ubuntu-raring-32 sshd[898]: error: Could not load host key: /etc/ssh/ssh_host_rsa_key
Jul 25 17:57:02 vagrant-ubuntu-raring-32 sshd[898]: error: Could not load host key: /etc/ssh/ssh_host_dsa_key
Jul 25 17:57:02 vagrant-ubuntu-raring-32 sshd[898]: error: Could not load host key: /etc/ssh/ssh_host_ecdsa_key
Jul 25 17:57:02 vagrant-ubuntu-raring-32 sshd[898]: fatal: No supported key exchange algorithms [preauth]

The problem was solved by executing the following commands:

sudo ssh-keygen -f /etc/ssh/ssh_host_ecdsa_key -N '' -t ecdsa
sudo ssh-keygen -f /etc/ssh/ssh_host_dsa_key -N '' -t dsa
sudo ssh-keygen -f /etc/ssh/ssh_host_rsa_key -N '' -t rsa

I would assume that these should run automatically at some point, especially given that (a) I did not have to run them myself when I installed Ubuntu from an ISO image, and (b) because Vagrant is supposed to be designed that after you run vagrant up you can immediately use the VM without any additional configuration.

I may need to create a large number of Virtual Machines in the near future and I was hoping that I could use Vagrant to do it, but I can't do it if I'm going to have to manually fix SSH on each one.

Does anyone know why this happens and what can be done to fix it? Should I report it as a bug?

Solution 1

This appears to have been a bug in the older base boxes. In the current base box images (generated August 20th, 2013), the keys appear to be created automatically when the box boots up for the first time.

Solution 2

Workaroud:

• Import ~/.vagrant.d/boxes/raring/box.ovf appliance in VirtualBox

  VBoxManage import ~/.vagrant.d/boxes/raring/box.ovf
  

• Get VM Name

  VBoxManage list vms
  

• Start the VM

  VBoxManage startvm ubuntu-cloudimg-raring-vagrant-amd64
  

• Include the following line in /etc/rc.local (Of course in the VM itself!):

  test -f /etc/ssh/ssh_host_dsa_key || dpkg-reconfigure openssh-server
  

• Shutdown VM

  sudo halt
  

• Delete old images

  rm ~/.vagrant.d/boxes/raring/box.ovf ~/.vagrant.d/boxes/raring/box-disk1.vmdk
  

• Export VM in .ovf format

  VBoxManage export ubuntu-cloudimg-raring-vagrant-amd64 --output ~/.vagrant.d/boxes/raring/box.ovf
  

Done :)

Did also an bugreport: https://bugs.launchpad.net/ubuntu/+source/cloud-init/+bug/1217950

Solution 3

This is SSH host key problem (NOT related to public key authentication).

Looks like the problem was that the ubuntu cloud vagrant image failed to generate the new host keys (if they are not there in /etc/ssh/) during the 1st boot (vagrant up).

In addition to manually generate the SSH host keys mentioned by Moshe

sudo ssh-keygen -f /etc/ssh/ssh_host_ecdsa_key -N '' -t ecdsa
sudo ssh-keygen -f /etc/ssh/ssh_host_dsa_key -N '' -t dsa
sudo ssh-keygen -f /etc/ssh/ssh_host_rsa_key -N '' -t rsa

It can also be done by adding the following command in the /etc/rc.local

test -f /etc/ssh/ssh_host_dsa_key || dpkg-reconfigure openssh-server

Hope it helps.

Comments

[Terry Wang]

Did you install latest vagrant on you host? How about turning on vagrant debug and see what happnes? vagrant ssh uses vagrant's insecure keypair for pub key authentication.

[Moshe Katz]

Yes, this is the newest vagrant. Note that my problem isn't the vagrant key pair, it's the SSH server's Machine key not being set. If the SSH server has no machine key, there is no way to connect to it.

[Moshe Katz]

I just tried a fresh 12.10 VM and the same thing happened.

[Terry Wang]

Sorry, didn't read the question carefully. I was sshd host key problem not public key authentication. Looks like during the 1st boot Ubuntu cloud image failed to generate the new host keys (if NOT found). It can be done by test -f /etc/ssh/ssh_host_dsa_key || dpkg-reconfigure openssh-server or use the ssh-keygen to generate the keys.

[Terry Wang]

There should be test -e /etc/ssh/ssh_host_dsa_key || dpkg-reconfigure openssh-server in /etc/rc.local script.

[S0me0ne]

Can't confirm this as fixed. With today's (August 28th, 2013) images this problem retured. Edit: Can't also confirm this for the August 20th, 2013 images! At least not for the amd64 images... Edit2: I've got an workaround for this problem: * Import ~/.vagrant.d/boxes/raring/box.ovf appliance in VritualBox VBoxManage import ~/.vagrant.d/boxes/raring/box.ovf * Get VM Name VBoxManage list vms * Start the VM VBoxManage startvm ubuntu-cloudimg-raring-vagrant-amd64 * Include the following line in /etc/rc.local (Of course in the VM itself!): test -f /etc/ssh/ssh_host_dsa_key || dpkg-reconfigure opens

[Radek Simko]

That's a temporary solution, but shouldn't we report it as a bug within that image? Shouldn't all keys be already pregenerated?

[malvim]

I'm running into this bug (again) right now, and it seems by @S0me0ne's bug report that other people are too. I confirmed in /etc/ssh that the key files are not there. This was using the September 24th images.