ProxyJump Conuguration

[ignis-draco]

Hi,

I am trying to convert my existing Ansible system to semaphore. I can only reach a few clients via a JumpHost.

Initial situation
From the command line it is not a problem.
ansible-playbook -i host_rsshTest.yml playbooks/ping.yaml
runs successfully.

I have made the communication settings in the
/root/.ssh/config

Host rSSHserver
        HostName 192.168.XXX.XXX
        User myName
        Port 1234
        IdentityFile ~/.ssh/keyA

Host rIndianer
        HostName localhost
        ProxyJump rSSHserver
        Port 54321
        User otheName
        IdentityFile ~/.ssh/keyB

host_rsshTest.yml

myHostes:
  hosts:
    rIndianer
  vars:
    ansible_user: otheName

What I have done:

1. create Inventory in Semaphorewith the same content as host_rsshTest.yml
2. add Private ssh keys ( keyA and keyB)
3. add Git Repositore
4. create Task with the ping.yaml playbook and the Inventory.
5. run Task

Output

Task 35 added to queue
1:36:56 PM Started: 35
1:36:56 PM Run TaskRunner with template: Ping
1:36:56 PM Preparing: 35
1:36:57 PM Warning: Permanently added 'XXXXXX' (ED25519) to the list of known hosts.
1:36:57 PM Updating Repository XXXXXX
1:36:57 PM Warning: Permanently added 'XXXX' (ED25519) to the list of known hosts.
1:36:58 PM From ssh://xxxxxx
1:36:58 PM  * branch            develop    -> FETCH_HEAD
1:36:58 PM Already up to date.
1:36:58 PM installing static inventory
1:36:58 PM No collection/requirements.yml file found. Skip galaxy install process.
1:36:58 PM No collection/requirements.yml file found. Skip galaxy install process.
1:36:58 PM No role/requirements.yml file found. Skip galaxy install process.
1:36:58 PM No role/requirements.yml file found. Skip galaxy install process.
1:36:58 PM ansible-playbook [core 2.14.3]
1:36:58 PM   config file = None
1:36:58 PM   configured module search path = ['/opt/semaphore/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
1:36:58 PM   ansible python module location = /usr/lib/python3/dist-packages/ansible
1:36:58 PM   ansible collection location = /opt/semaphore/.ansible/collections:/usr/share/ansible/collections
1:36:58 PM   executable location = /usr/bin/ansible-playbook
1:36:58 PM   python version = 3.11.2 (main, May  2 2024, 11:59:08) [GCC 12.2.0] (/usr/bin/python3)
1:36:58 PM   jinja version = 3.1.2
1:36:58 PM   libyaml = True
1:36:58 PM No config file found; using defaults
1:36:58 PM setting up inventory plugins
1:36:58 PM host_list declined parsing /opt/semaphore/inventory_35.yml as it did not pass its verify_file() method
1:36:58 PM script declined parsing /opt/semaphore/inventory_35.yml as it did not pass its verify_file() method
1:36:58 PM Parsed /opt/semaphore/inventory_35.yml inventory source with yaml plugin
1:36:58 PM Loading callback plugin default of type stdout, v2.0 from /usr/lib/python3/dist-packages/ansible/plugins/callback/default.py
1:36:58 PM Skipping callback 'default', as we already have a stdout callback.
1:36:58 PM Skipping callback 'minimal', as we already have a stdout callback.
1:36:58 PM Skipping callback 'oneline', as we already have a stdout callback.
1:36:58 PM 
1:36:58 PM PLAYBOOK: ping.yaml ************************************************************
1:36:58 PM Positional arguments: playbooks/ping.yaml
1:36:58 PM verbosity: 4
1:36:58 PM remote_user: root
1:36:58 PM connection: smart
1:36:58 PM timeout: 10
1:36:58 PM become_method: sudo
1:36:58 PM tags: ('all',)
1:36:58 PM inventory: ('/opt/semaphore/inventory_35.yml',)
1:36:58 PM extra_vars: ('{"semaphore_vars":{"task_details":{"id":35,"url":null,"username":"semaphorUserName"}}}',)
1:36:58 PM forks: 5
1:36:58 PM 1 plays in playbooks/ping.yaml
1:36:58 PM 1:36:58 PM
PLAY [Test Ping] ***************************************************************
1:36:58 PM 1:36:58 PM
TASK [Gathering Facts] *********************************************************
1:36:58 PM task path: /opt/semaphore/repository_2_2/playbooks/ping.yaml:1
1:36:58 PM  ESTABLISH SSH CONNECTION FOR USER: otheName
1:36:58 PM  SSH: EXEC ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="otheName"' -o ConnectTimeout=10 -o 'ControlPath="/opt/semaphore/.ansible/cp/7278a5c672"' rIndianer '/bin/sh -c '"'"'echo ~otheName && sleep 0'"'"''
1:36:58 PM  (255, b'', b'OpenSSH_9.2p1 Debian-2+deb12u3, OpenSSL 3.0.13 30 Jan 2024\r\ndebug1: Reading configuration data /root/.ssh/config\r\ndebug1: /root/.ssh/config line 17: Applying options for *\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files\r\ndebug1: /etc/ssh/ssh_config line 21: Applying options for *\r\ndebug3: expanded UserKnownHostsFile \'~/.ssh/known_hosts\' -> \'/root/.ssh/known_hosts\'\r\ndebug3: expanded UserKnownHostsFile \'~/.ssh/known_hosts2\' -> \'/root/.ssh/known_hosts2\'\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: Control socket "/opt/semaphore/.ansible/cp/7278a5c672" does not exist\r\ndebug2: resolving "rindianer" port 22\r\ndebug3: resolve_host: lookup rindianer:22\r\ndebug3: ssh_connect_direct: entering\r\ndebug1: Connecting to rindianer [XX.YY.ZZ.ZZZ] port 22.\r\ndebug3: set_sock_tos: set socket 3 IP_TOS 0x10\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug1: connect to address XX.YY.ZZ.ZZZ port 22: Connection refused\r\nssh: connect to host rindianer port 22: Connection refused\r\n')
1:36:58 PM fatal: [rIndianer]: UNREACHABLE! => {
1:36:58 PM    "changed": false,
1:36:58 PM    "msg": "Failed to connect to the host via ssh: OpenSSH_9.2p1 Debian-2+deb12u3, OpenSSL 3.0.13 30 Jan 2024\r\ndebug1: Reading configuration data /root/.ssh/config\r\ndebug1: /root/.ssh/config line 17: Applying options for *\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files\r\ndebug1: /etc/ssh/ssh_config line 21: Applying options for *\r\ndebug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/root/.ssh/known_hosts'\r\ndebug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/root/.ssh/known_hosts2'\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: Control socket \"/opt/semaphore/.ansible/cp/7278a5c672\" does not exist\r\ndebug2: resolving \"rindianer\" port 22\r\ndebug3: resolve_host: lookup rindianer:22\r\ndebug3: ssh_connect_direct: entering\r\ndebug1: Connecting to rindianer [XX.YY.ZZ.ZZZ] port 22.\r\ndebug3: set_sock_tos: set socket 3 IP_TOS 0x10\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug1: connect to address XX.YY.ZZ.ZZZ port 22: Connection refused\r\nssh: connect to host rindianer port 22: Connection refused",
1:36:58 PM    "unreachable": true
1:36:58 PM}
1:36:58 PM
1:36:58 PM
PLAY RECAP *********************************************************************
1:36:58 PM rIndianer                  : ok=0    changed=0    unreachable=1    failed=0    skipped=0    rescued=0    ignored=0   
1:36:58 PM
1:36:58 PM Running playbook failed: exit status 4

In principle, it must first connect to the rSSHserver computer. There it is possible to connect to the computer rIndianer via the local port 54321. Does anyone have an idea where the error lies with my semaphore configuration?

[ignis-draco]

Hi,

I got it to work. It is important that you only use one ssh-key because you can only enter one key in the inventory.

[tl87]

Have you setup proxyjump in your inventory file?

If you have alot of hosts, it seems like using 'ProxyJump' in ~/.ssh/config is a waste of time.

I have this inventory:

bastion:
  vars:
    ansible_connetion: ssh
    ansible_python_interpreter: /usr/bin/python3
    ansible_user: username
    ansible_port: 22
  hosts:
    proxyhost.lan:
      ansible_host: proxyhost.lan

servers:
  vars:
    ansible_connection: ssh
    ansible_python_interpreter: /usr/bin/python3
    ansible_user: username
    ansible_port: 22
    ansible_common_args: '-o ProxyCommand="ssh -W %h:%p -q [email protected]"'
  hosts:
    host1.com:
      ansible_host: host1.com
    host2.com:
      ansible_host: host2.com

It's not working in Semaphore, so I'm very curious about how you fixed it :-)

[ignis-draco]

Hey, I only use the ssh/config file for this.
The waste of time is irrelevant in my eyes because even an apt update takes longer than setting up the ssh connection. In my case, the connection to the ssh proxy is also a purely virtual network.

When solving my problem, it turned out that it is advantageous to create a new user on the semaphore host and test the Ansible things in the shell there, because this way you can make sure that it works without the semaphore part.