GIT over SSH in Ansible hangs, eventhough ssh-agent forwarding is set up

Question

I have set up everyhing I could find, but still cloning a repo from GitHub hangs the provisioning process.

I have:

server in known_hosts

.ssh/config

Host github.com
  ForwardAgent yes
  StrictHostKeyChecking no

copied private key
public key is in authorized_keys
the command runs as vagrant user

the play is:

- name: Checkout from git
  git: repo=git@github.com:username/repositoryname.git dest=/srv/website

Make sure you're not running this task with `sudo`, because it breaks agent forwarding. — anatoly techtonik, Jul 23 '14 at 15:47
@cvsguimaraes forwarding is a chain from your `ssh-agent` port to remote SSH port, and going through `sudo` breaks this chain unless you work around this. See http://stackoverflow.com/a/24134109/239247 — anatoly techtonik, Sep 24 '15 at 07:35

score 61 · Answer 1 · answered Mar 31 '14 at 08:37

Just to expand on tillda's answer, that config can be placed in an ansible.cfg file alongside your playbook. e.g.:

ansible.cfg

[defaults]
transport = ssh

[ssh_connection]
ssh_args = -o ForwardAgent=yes

I'd say it's better to do that than setting as an env variable, as placing it in a conf file is both more declarative and also will minimise the steps needed for other people you may be working with to going with a project.

Conf docs: http://docs.ansible.com/intro_configuration.html#the-ansible-configuration-file

Example config file: https://raw.github.com/ansible/ansible/devel/examples/ansible.cfg

score 14 · Answer 2 · edited Jun 20 '20 at 09:12

I want to share the answer that worked for me:

https://groups.google.com/forum/#!msg/ansible-project/u6o-sWynMjo/69UwJfJPq7cJ - From Ansible Google Group

For ansible, ssh-add to load ssh keys in your host machine first. Then use "ssh" as connection type with forwarding enabled.

Such as:
$ ssh-add  
$ export ANSIBLE_TRANSPORT="ssh"  
$ export  ANSIBLE_SSH_ARGS="-o ForwardAgent=yes"
See manual for ssh-add for running the agent.

The Ansible docs for ssh-args are http://docs.ansible.com/intro_configuration.html#ssh-args

score 7 · Answer 3 · edited Dec 06 '14 at 05:36

7

this works for me

- name: ensure known hosts
  shell: touch ~/.ssh/known_hosts
- name: remove github.com from known host
  shell: ssh-keygen -R github.com
  # >> instead of > to keep existing known_hosts file
- name: ensure github.com in known host
  shell: ssh-keyscan -H github.com >> ~/.ssh/known_hosts

edited Dec 06 '14 at 05:36

Steve Midgley

2,226
2
18
20

answered Feb 04 '14 at 18:48

jassinm

7,323
3
33
42

14

no need as git ansible module has a flag accept_hostkey to ensure it. Just turn it on. – kaji Mar 27 '14 at 16:27
1

A module for Ansible to maintain the /etc/ssh/ssh_known_hosts file https://github.com/bfmartin/ansible-sshknownhosts – jitter Aug 10 '14 at 07:05

score 1 · Answer 4 · answered Jul 14 '16 at 17:44

1

Add to ansible.cfg the following parameter:

[defaults]
sudo_flags=-HE

answered Jul 14 '16 at 17:44

Lebnik

628
8
11

score 1 · Answer 5 · answered Mar 20 '17 at 16:16

In my case the issue was the repository string. I had a bitbucket private repository set as:

git@tsrs...

but it should be:

ssh://git@tsrs...

Notice the subtle absence of the prefix "ssh". The weird part is that if I clone a github repository without the "ssh", it works fine!

score 0 · Answer 6 · answered Feb 18 '16 at 14:35

I had an error :

bitbucket.org has an unknown hostkey. Set accept_hostkey to True or manually add the hostkey prior to running the git module

I had to add a accept_hostkey parameter to my git module command :

playbook :

tasks:
    - name: clone
      git: repo=git@bitbucket.org:robusta-code/xyz.git
           dest=/app
           accept_hostkey=yes

ansible.cfg

[ssh_connection]
ssh_args = -o ForwardAgent=yes

GIT over SSH in Ansible hangs, eventhough ssh-agent forwarding is set up

6 Answers6