Unable to connect to Ansible via SSH

Question

I create a host file with the below content

[web]
167.172.xxx.xxx

I have a user root and dojo360 on the web server and the public key has also been added to authorized_keys file.

When I run the command ansible web -m ping -i hosts I get the below error

167.172.xxx.xxx | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: ssh: connect to host 167.172.xxx.xxx port 22: Operation timed out",
    "unreachable": true
}

I have tried other variations of the hosts file, below is another one I have tried that also doesn't work

[web]
167.172.xxx.xxx ansible_connection=ssh ansible_user=user ansible_ssh_private_key_file=~/.ssh/id_rsa.pub

However, I can ssh into the server using ssh [email protected] with no problem, I am new to Ansible, but this shouldn't take over 24 hours, please help, I am stuck.

Running with -vvv I get

ansible 2.9.6
  config file = None
  configured module search path = ['/Users/g.james/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /Users/g.james/Library/Python/3.7/lib/python/site-packages/ansible
  executable location = /Users/g.james/Library/Python/3.7/bin/ansible
  python version = 3.7.6 (default, Dec 30 2019, 19:38:26) [Clang 11.0.0 (clang-1100.0.33.16)]
No config file found; using defaults
setting up inventory plugins
host_list declined parsing /Users/g.james/dojo360/d3-scripts/server/hosts as it did not pass its verify_file() method
script declined parsing /Users/g.james/dojo360/d3-scripts/server/hosts as it did not pass its verify_file() method
auto declined parsing /Users/g.james/dojo360/d3-scripts/server/hosts as it did not pass its verify_file() method
Parsed /Users/g.james/dojo360/d3-scripts/server/hosts inventory source with ini plugin
Loading callback plugin minimal of type stdout, v2.0 from /Users/g.james/Library/Python/3.7/lib/python/site-packages/ansible/plugins/callback/minimal.py
META: ran handlers
<67.172.xxx.xxx> ESTABLISH SSH CONNECTION FOR USER: root
<67.172.xxx.xxx> SSH: EXEC ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o 'IdentityFile="/Users/g.james/.ssh/id_rsa.pub"' -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="root"' -o ConnectTimeout=10 -o ControlPath=/Users/g.james/.ansible/cp/5d3d6b8351 67.172.xxx.xxx '/bin/sh -c '"'"'echo ~root && sleep 0'"'"''
<67.172.xxx.xxx> (255, b'', b'OpenSSH_7.9p1, LibreSSL 2.7.3\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 48: Applying options for *\r\ndebug2: resolve_canonicalize: hostname 67.172.xxx.xxx is address\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: Control socket "/Users/g.james/.ansible/cp/5d3d6b8351" does not exist\r\ndebug2: ssh_connect_direct\r\ndebug1: Connecting to 67.172.xxx.xxx [67.172.xxx.xxx] port 22.\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug1: connect to address 67.172.xxx.xxx port 22: Operation timed out\r\nssh: connect to host 67.172.xxx.xxx port 22: Operation timed out\r\n')
67.172.xxx.xxx | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: OpenSSH_7.9p1, LibreSSL 2.7.3\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 48: Applying options for *\r\ndebug2: resolve_canonicalize: hostname 67.172.xxx.xxx is address\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: Control socket \"/Users/g.james/.ansible/cp/5d3d6b8351\" does not exist\r\ndebug2: ssh_connect_direct\r\ndebug1: Connecting to 67.172.xxx.xxx [67.172.xxx.xxx] port 22.\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug1: connect to address 67.172.xxx.xxx port 22: Operation timed out\r\nssh: connect to host 67.172.xxx.xxx port 22: Operation timed out",
    "unreachable": true
}

Solution

Try to connect using the same command used by ansible:

ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o 'IdentityFile="/Users/g.james/.ssh/id_rsa.pub"' -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="root"' -o ConnectTimeout=10 -o ControlPath=/Users/g.james/.ansible/cp/5d3d6b8351 67.172.xxx.xxx

Then if it fail, try to remove arguments from the command in order to isolate the problem's cause

Comments

[dortegaoh]

A timeout usually points toward a firewall issue.

[James Okpe George]

@GeraldSchneider In that case shouldn't ssh [email protected] also be blocked?

[dortegaoh]

True. Please add relevant entries from your server logs to your question.

[James Okpe George]

I have done that and all I have now is ssh -vvv -C -o 'User="root"' 67.172.xxx.xxx

[NoNoNo]

So it seems a problem related to ssh and the ssh's argument used by ansible. What about removing also the argument "-C"? Which is the output of "ssh -vvv -C -o 'User="root"' 67.172.xxx.xxx" and "ssh -vvv [email protected]" maybe you can compare them to find useful differences and integrate your question with this addition. Have you verified /var/log/secure of 67.172.xxx.xxx during a failed ssh connection?