Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

GIT over SSH in Ansible hangs, eventhough ssh-agent forwarding is set up

I have set up everyhing I could find, but still cloning a repo from GitHub hangs the provisioning process.

I have:

  • server in known_hosts
  • .ssh/config

    Host github.com   ForwardAgent yes   StrictHostKeyChecking no 
  • copied private key

  • public key is in authorized_keys
  • the command runs as vagrant user
  • the play is:

    - name: Checkout from git   git: [email protected]:username/repositoryname.git dest=/srv/website 
like image 928
tillda Avatar asked Jan 29 '14 09:01

tillda


People also ask

How do I know if SSH forwarding is working?

Testing SSH agent forwarding To test that agent forwarding is working with your server, you can SSH into your server and run ssh -T [email protected] once more. If all is well, you'll get back the same prompt as you did locally.

Does Ansible use SSH agent?

By default, Ansible assumes you are using SSH keys to connect to remote machines. SSH keys are encouraged, but you can use password authentication if needed with the --ask-pass option. If you need to provide a password for privilege escalation (sudo, pbrun, and so on), use --ask-become-pass .

Is SSH agent forwarding safe?

Agent forwarding comes with a risk When you forward ssh-agent 's Unix domain socket to a remote host, it creates a security risk: anyone with root access on the remote host can discreetly access your local SSH agent through the socket. They can use your keys to impersonate you on other machines on the network.

How do I forward a SSH key?

From the configuration, go to Connection > SSH > Auth and enable “Allow agent forwarding.” You can also add your private key file from the same pane. PuTTY will handle the SSH agent for you, so you don't have to mess around with any config files.


2 Answers

Just to expand on tillda's answer, that config can be placed in an ansible.cfg file alongside your playbook. e.g.:

ansible.cfg

[defaults] transport = ssh  [ssh_connection] ssh_args = -o ForwardAgent=yes 

I'd say it's better to do that than setting as an env variable, as placing it in a conf file is both more declarative and also will minimise the steps needed for other people you may be working with to going with a project.

Conf docs: http://docs.ansible.com/intro_configuration.html#the-ansible-configuration-file

Example config file: https://raw.github.com/ansible/ansible/devel/examples/ansible.cfg

like image 90
Tom Seldon Avatar answered Sep 21 '22 13:09

Tom Seldon


I want to share the answer that worked for me:

https://groups.google.com/forum/#!msg/ansible-project/u6o-sWynMjo/69UwJfJPq7cJ - From Ansible Google Group

For ansible, ssh-add to load ssh keys in your host machine first. Then use "ssh" as connection type with forwarding enabled.

Such as:

$ ssh-add   $ export ANSIBLE_TRANSPORT="ssh"   $ export  ANSIBLE_SSH_ARGS="-o ForwardAgent=yes" 

See manual for ssh-add for running the agent.

The Ansible docs for ssh-args are http://docs.ansible.com/intro_configuration.html#ssh-args

like image 20
tillda Avatar answered Sep 19 '22 13:09

tillda