无法使用 AWS Key 使用 Ansible 访问 SSH 远程主机

Question

我正在尝试使用 ansible ping服务器，但收到一些错误消息

[ec2-user@ip-172-30-0-64 kafka-scripts]$ ansible zook1 -m ping -vvv
Using /home/ec2-user/kafka-scripts/ansible.cfg as config file
<172.30.0.113> ESTABLISH SSH CONNECTION FOR USER: None
<172.30.0.113> SSH: EXEC ssh -C -q -o ControlMaster=auto -o ControlPersist=60s -o 'IdentityFile="/home/ec2-user/kafka-scripts/keys/kafka_broker.pem"' -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/ec2-user/.ansible/cp/ansible-ssh-%h-%p-%r -tt 172.30.0.113 '/bin/sh -c '"'"'( umask 22 && mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1461268838.85-234429685988133 `" && echo "` echo $HOME/.ansible/tmp/ansible-tmp-1461268838.85-234429685988133 `" )'"'"''
zook1 | UNREACHABLE! => {
     "changed": false,
     "msg": "SSH encountered an unknown error during the connection. We recommend you re-run the command using -vvvv, which will enable SSH debugging output to help diagnose the issue",
     "unreachable": true
}

与 -vvvv

[ec2-user@ip-172-30-0-64 kafka-scripts]$ ansible zookservers -m ping -vvvv
Using /home/ec2-user/kafka-scripts/ansible.cfg as config file
Loaded callback minimal of type stdout, v2.0
<172.30.0.113> ESTABLISH SSH CONNECTION FOR USER: None
<172.30.0.113> SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o 'IdentityFile="/home/ec2-user/kafka-scripts/keys/kafka_broker.pem"' -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/ec2-user/.ansible/cp/ansible-ssh-%h-%p-%r -tt 172.30.0.113 '/bin/sh -c '"'"'( umask 22 && mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1461270664.7-212192719472156 `" && echo "` echo $HOME/.ansible/tmp/ansible-tmp-1461270664.7-212192719472156 `" )'"'"''
 zook1 | UNREACHABLE! => {
"changed": false,
"msg": "SSH encountered an unknown error. The output was:nOpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013rndebug1: Reading configuration data /etc/ssh/ssh_configrndebug1: /etc/ssh/ssh_config line 56: Applying options for *rndebug1: auto-mux: Trying existing masterrndebug1: Control socket "/home/ec2-user/.ansible/cp/ansible-ssh-172.30.0.113-22-ec2-user" does not existrndebug2: ssh_connect: needpriv 0rndebug1: Connecting to 172.30.0.113 [172.30.0.113] port 22.rndebug2: fd 3 setting O_NONBLOCKrndebug1: fd 3 clearing O_NONBLOCKrndebug1: Connection established.rndebug3: timeout: 10000 ms remain after connectrndebug3: Incorrect RSA1 identifierrndebug3: Could not load "/home/ec2-user/kafka-scripts/keys/kafka_broker.pem" as a RSA1 public keyrndebug1: identity file /home/ec2-user/kafka-scripts/keys/kafka_broker.pem type -1rndebug1: identity file /home/ec2-user/kafka-scripts/keys/kafka_broker.pem-cert type -1rndebug1: Enabling compatibility mode for protocol 2.0rndebug1: Local version string SSH-2.0-OpenSSH_6.6.1rndebug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1rndebug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000rndebug2: fd 3 setting O_NONBLOCKrndebug3: load_hostkeys: loading entries for host "172.30.0.113" from file "/home/ec2-user/.ssh/known_hosts"rndebug3: load_hostkeys: found key type ECDSA in file /home/ec2-user/.ssh/known_hosts:1rndebug3: load_hostkeys: loaded 1 keysrndebug3: order_hostkeyalgs: prefer hostkeyalgs: [e-mail],[e-mail],[e-mail],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521rndebug1: SSH2_MSG_KEXINIT sentrndebug1: SSH2_MSG_KEXINIT receivedrndebug2: kex_parse_kexinit: [e-mail],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1rndebug2: kex_parse_kexinit: [e-mail],[e-mail],[e-mail],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],ssh-ed25519,ssh-rsa,ssh-dssrndebug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[e-mail],[e-mail],[e-mail],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[e-mail]2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[e-mail],[e-mail],[e-mail],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[e-mail]2: kex_parse_kexinit: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-md5,hmac-sha1,[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[e-mail],hmac-sha1-96,hmac-md5-96rndebug2: kex_parse_kexinit: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-md5,hmac-sha1,[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[e-mail],hmac-sha1-96,hmac-md5-96rndebug2: kex_parse_kexinit: [e-mail],zlib,nonerndebug2: kex_parse_kexinit: [e-mail],zlib,nonerndebug2: kex_parse_kexinit: rndebug2: kex_parse_kexinit: rndebug2: kex_parse_kexinit: first_kex_follows 0 rndebug2: kex_parse_kexinit: reserved 0 rndebug2: kex_parse_kexinit: [e-mail],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1rndebug2: kex_parse_kexinit: ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519rndebug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[e-mail],[e-mail],[e-mail],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[e-mail]2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[e-mail],[e-mail],[e-mail],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[e-mail]2: kex_parse_kexinit: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-md5,hmac-sha1,[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[e-mail],hmac-sha1-96,hmac-md5-96rndebug2: kex_parse_kexinit: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-md5,hmac-sha1,[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[e-mail],hmac-sha1-96,hmac-md5-96rndebug2: kex_parse_kexinit: none,[e-mail]2: kex_parse_kexinit: none,[e-mail]2: kex_parse_kexinit: rndebug2: kex_parse_kexinit: rndebug2: kex_parse_kexinit: first_kex_follows 0 rndebug2: kex_parse_kexinit: reserved 0 rndebug2: mac_setup: setup [e-mail]1: kex: server->client aes128-ctr [e-mail] [e-mail]2: mac_setup: setup [e-mail]1: kex: client->server aes128-ctr [e-mail] [e-mail]1: kex: [e-mail] need=16 dh_need=16rndebug1: kex: [e-mail] need=16 dh_need=16rndebug1: sending SSH2_MSG_KEX_ECDH_INITrndebug1: expecting SSH2_MSG_KEX_ECDH_REPLYrndebug1: Server host key: ECDSA 55:88:b1:5a:cd:bb:87:ff:dd:54:b0:36:39:c7:e2:earndebug3: load_hostkeys: loading entries for host "172.30.0.113" from file "/home/ec2-user/.ssh/known_hosts"rndebug3: load_hostkeys: found key type ECDSA in file /home/ec2-user/.ssh/known_hosts:1rndebug3: load_hostkeys: loaded 1 keysrndebug1: Host '172.30.0.113' is known and matches the ECDSA host key.rndebug1: Found key in /home/ec2-user/.ssh/known_hosts:1rndebug1: ssh_ecdsa_verify: signature correctrndebug2: kex_derive_keysrndebug2: set_newkeys: mode 1rndebug1: SSH2_MSG_NEWKEYS sentrndebug1: expecting SSH2_MSG_NEWKEYSrndebug2: set_newkeys: mode 0rndebug1: SSH2_MSG_NEWKEYS receivedrndebug1: SSH2_MSG_SERVICE_REQUEST sentrndebug2: service_accept: ssh-userauthrndebug1: SSH2_MSG_SERVICE_ACCEPT receivedrndebug2: key: /home/ec2-user/kafka-scripts/keys/kafka_broker.pem ((nil)), explicitrndebug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-micrndebug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-micrndebug3: preferred gssapi-with-mic,gssapi-keyex,hostbased,publickeyrndebug3: authmethod_lookup gssapi-with-micrndebug3: remaining preferred: gssapi-keyex,hostbased,publickeyrndebug3: authmethod_is_enabled gssapi-with-micrndebug1: Next authentication method: gssapi-with-micrndebug1: Unspecified GSS failure.  Minor code may provide more informationnNo Kerberos credentials availablenrndebug1: Unspecified GSS failure.  Minor code may provide more informationnNo Kerberos credentials availablenrndebug1: Unspecified GSS failure.  Minor code may provide more informationnnrndebug1: Unspecified GSS failure.  Minor code may provide more informationnNo Kerberos credentials availablenrndebug2: we did not send a packet, disable methodrndebug3: authmethod_lookup gssapi-keyexrndebug3: remaining preferred: hostbased,publickeyrndebug3: authmethod_is_enabled gssapi-keyexrndebug1: Next authentication method: gssapi-keyexrndebug1: No valid Key exchange contextrndebug2: we did not send a packet, disable methodrndebug3: authmethod_lookup publickeyrndebug3: remaining preferred: ,publickeyrndebug3: authmethod_is_enabled publickeyrndebug1: Next authentication method: publickeyrndebug1: Trying private key: /home/ec2-user/kafka-scripts/keys/kafka_broker.pemrn@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@rn@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @rn@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@rnPermissions 0777 for '/home/ec2-user/kafka-scripts/keys/kafka_broker.pem' are too open.rnIt is required that your private key files are NOT accessible by others.rnThis private key will be ignored.rnbad permissions: ignore key: /home/ec2-user/kafka-scripts/keys/kafka_broker.pemrndebug2: we did not send a packet, disable methodrndebug1: No more authentication methods to try.rnPermission denied (publickey,gssapi-keyex,gssapi-with-mic).rn",
"unreachable": true
 }

SSH 调试输出：

SSH encountered an unknown error. The output was:nOpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug1: auto-mux: Trying existing master
debug1: Control socket "/home/ec2-user/.ansible/cp/ansible-ssh-172.30.0.113-22-ec2-user" does not exist
debug2: ssh_connect: needpriv 0
debug1: Connecting to 172.30.0.113 [172.30.0.113] port 22.
debug2: fd 3 setting O_NONBLOCK
debug1: fd 3 clearing O_NONBLOCK
debug1: Connection established.
debug3: timeout: 10000 ms remain after connect
debug3: Incorrect RSA1 identifier
debug3: Could not load "/home/ec2-user/kafka-scripts/keys/kafka_broker.pem" as a RSA1 public key
debug1: identity file /home/ec2-user/kafka-scripts/keys/kafka_broker.pem type -1
debug1: identity file /home/ec2-user/kafka-scripts/keys/kafka_broker.pem-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "172.30.0.113" from file "/home/ec2-user/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/ec2-user/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: [e-mail],[e-mail],[e-mail],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: [e-mail],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [e-mail],[e-mail],[e-mail],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],ssh-ed25519,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[e-mail],[e-mail],[e-mail],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[e-mail]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[e-mail],[e-mail],[e-mail],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[e-mail]
debug2: kex_parse_kexinit: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-md5,hmac-sha1,[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[e-mail],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-md5,hmac-sha1,[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[e-mail],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [e-mail],zlib,none
debug2: kex_parse_kexinit: [e-mail],zlib,none
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: [e-mail],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[e-mail],[e-mail],[e-mail],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[e-mail]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[e-mail],[e-mail],[e-mail],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[e-mail]
debug2: kex_parse_kexinit: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-md5,hmac-sha1,[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[e-mail],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-md5,hmac-sha1,[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[e-mail],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[e-mail]
debug2: kex_parse_kexinit: none,[e-mail]
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: setup [e-mail]
debug1: kex: server->client aes128-ctr [e-mail] [e-mail]
debug2: mac_setup: setup [e-mail]
debug1: kex: client->server aes128-ctr [e-mail] [e-mail]
debug1: kex: [e-mail] need=16 dh_need=16
debug1: kex: [e-mail] need=16 dh_need=16
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 55:88:b1:5a:cd:bb:87:ff:dd:54:b0:36:39:c7:e2:ea
debug3: load_hostkeys: loading entries for host "172.30.0.113" from file "/home/ec2-user/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/ec2-user/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys
debug1: Host '172.30.0.113' is known and matches the ECDSA host key.
debug1: Found key in /home/ec2-user/.ssh/known_hosts:1
debug1: ssh_ecdsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/ec2-user/kafka-scripts/keys/kafka_broker.pem ((nil)), explicit
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic
debug3: preferred gssapi-with-mic,gssapi-keyex,hostbased,publickey
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: gssapi-keyex,hostbased,publickey
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more informationnNo Kerberos credentials availablen
debug1: Unspecified GSS failure.  Minor code may provide more informationnNo Kerberos credentials availablen
debug1: Unspecified GSS failure.  Minor code may provide more informationnn
debug1: Unspecified GSS failure.  Minor code may provide more informationnNo Kerberos credentials availablen
debug2: we did not send a packet, disable method
debug3: authmethod_lookup gssapi-keyex
debug3: remaining preferred: hostbased,publickey
debug3: authmethod_is_enabled gssapi-keyex
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: ,publickey
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/ec2-user/kafka-scripts/keys/kafka_broker.pem
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0777 for '/home/ec2-user/kafka-scripts/keys/kafka_broker.pem' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: /home/ec2-user/kafka-scripts/keys/kafka_broker.pem
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

Answer 1

如错误消息中所述，您的密钥文件未受到应有的保护。

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0777 for '/home/ec2-user/kafka-scripts/keys/kafka_broker.pem' are too open.
It is required that your private key files are NOT accessible by others.

运行以下命令应该可以通过删除其他人读取密钥文件的授权来解决您的问题。

chmod 600 /home/ec2-user/kafka-scripts/keys/kafka_broker.pem