How do I configure SSH keys in a Vagrant multi-machine setup?

Question

I have 4 VMs in my Vagrantfile - 3 application servers and an Ansible control host.

I only use Vagrant to create the VMs as I provision them manually from the ansible control host because I am still creating/editing the ansible scripts.

I can do vagrant ssh ansible and vagrant ssh app1/2/3 etc. but when I try to do ansible-playbook oracle.yml from the Ansible control host, SSH fails with

fatal: [192.168.60.10]: UNREACHABLE! => {"changed": false, "msg": "SSH encountered an unknown error during the connection. We recommend you re-run the command using -vvvv, which will enable SSH debugging output to help diagnose the issue", "unreachable": true}

I can successfully ssh from the Ansible VM to the Oracle VM using user vagrant and password vagrant.

The key parts of my Vagrantfile are:

config.ssh.insert_key = false

config.vm.define "db" do |db|
    db.vm.box = "boxcutter/ol67"
    db.vm.hostname = "oracle-vm"
    db.vm.network "forwarded_port", guest: 22, host: 2201, id: "ssh", auto_correct: false
    db.vm.network "forwarded_port", guest: 1521, host: 1521
    db.vm.network "private_network", ip: "192.168.60.10"
    db.vm.provider "virtualbox" do |v|
        v.name = "oracle-vm"
        v.linked_clone = true
        v.memory = 2048
        v.cpus = 2
    end
end

#Optional ansible control machine for Windows users
config.vm.define "ansible", autostart: false do |ansible|
    ansible.vm.box = "williamyeh/ansible"
    ansible.vm.hostname = "ansible-vm"
    ansible.vm.network "forwarded_port", guest: 22, host: 2204, id: "ssh", auto_correct: false
    ansible.vm.network "private_network", ip: "192.168.60.50"
    ansible.vm.provider "virtualbox" do |v|
        v.linked_clone = true
    end
    #Mount the project directory on the guest so we can run the playbooks from there
    ansible.vm.synced_folder ".", "/data/ansible", create: true
end

What do I need to put in the Vagrantfile to allow the Ansible VM to connect to the other VMs without requiring a password or extra manual steps after vagrant up?

This is just for development testing on a private network on developers PCs so security is not really an issue and comes second to ease of implementation and smooth user experience.

I stated quite clearly that I can ssh between VMs it is just that ansible cannot because it requires keys set up. He cannot ssh. The questions are clearly different. — opticyclic, Commented May 25, 2017 at 2:34
@JamesShewey: I don't think that any answer for that question is relevant to that. The answer given refers to communications from the host to the guests; the needed answer needs to apply between guests. — Torenware Networks, Commented Mar 15, 2018 at 0:36

techraf · Accepted Answer · 2017-05-25 08:28:32Z

There is no general method and it might depend on how boxcutter/ol67 was packed.

The easiest method would be to define the password in the Ansible inventory file:
```
[oracle-vm:vars]
ansible_ssh_user=vagrant
ansible_ssh_pass=vagrant
```

The second method would be to leave the insecure private key configured on the oracle-vm machine and inject the private key to the ansible VM:

config.vm.provision "shell" do |s|
  ssh_insecure_key = File.readlines("#{Dir.home}/.vagrant.d/insecure_private_key").first.strip
  s.inline = <<-SHELL
    echo #{ssh_insecure_key} >> /home/vagrant/.ssh/id_rsa
    chown vagrant /home/vagrant/.ssh/id_rsa
    chmod 400 /home/vagrant/.ssh/id_rsa
  SHELL
end

Generate the key pair beforehand on the host machine, inject private key to Ansible VM, public key to Oracle's authorized_keys.
Generate the key pair on Ansible VM, copy the public key to Oracle VM using shell provisioner and inject vagrant as password for ssh-copy-id.

And the list does not end here, it depends on required security.

Community · Accepted Answer · 2018-08-30 17:48:40Z

Based on techraf's 3rd suggestion I did the following:

vagrant up ansible
ssh-keygen (no password just pressed Enter)
copied .ssh/id_rsa and .ssh/id_rsa.pub to the project directory
vagrant destroy ansible
modified the Vagrantfile to copy the id_rsa to all hosts
modified the Vagrantfile to copy the id_rsa.pub into authorized_keys on all hosts
modified the Vagrantfile to disable host checking

Vagrantfile snippet:

 config.vm.provision "file", source: "id_rsa", destination: "/home/vagrant/.ssh/id_rsa"
 public_key = File.read("id_rsa.pub")
 config.vm.provision :shell, :inline =>"
     echo 'Copying ansible-vm public SSH Keys to the VM'
     mkdir -p /home/vagrant/.ssh
     chmod 700 /home/vagrant/.ssh
     echo '#{public_key}' >> /home/vagrant/.ssh/authorized_keys
     chmod -R 600 /home/vagrant/.ssh/authorized_keys
     echo 'Host 192.168.*.*' >> /home/vagrant/.ssh/config
     echo 'StrictHostKeyChecking no' >> /home/vagrant/.ssh/config
     echo 'UserKnownHostsFile /dev/null' >> /home/vagrant/.ssh/config
     chmod -R 600 /home/vagrant/.ssh/config
     ", privileged: false

This solution worked well for me but I had to change Host 192.168.*.* to just *. Not sure why. Thanks! — Zacho, Commented Oct 2, 2018 at 19:04

tar tu · Accepted Answer · 2018-08-20 01:32:04Z

If you want to have a preformatted block within a list, indent by eight spaces:

generate public/private key

cd vagrant-home
ssh-keygen // just pressed enter
copy ~/.ssh/id_rsa .
copy ~/.ssh/id_rsa.pub .

edit Vagrantfile,add follow lines: config.vm.provision "file", source: "id_rsa", destination: "/home/vagrant/.ssh/id_rsa"

    public_key = File.read("id_rsa.pub")
    config.vm.provision "shell", inline: <<-SCRIPT
        chmod 600 /home/vagrant/.ssh/is_rsa
        echo 'Copying ansible-vm public SSH Keys to the VM'
        #mkdir -p /home/vagrant/.ssh
        chmod 700 /home/vagrant/.ssh
        echo '#{public_key}' >> /home/vagrant/.ssh/authorized_keys
        chmod -R 600 /home/vagrant/.ssh/authorized_keys
        echo 'Host 192.168.*.*' >> /home/vagrant/.ssh/config
        echo 'StrictHostKeyChecking no' >> /home/vagrant/.ssh/config
        echo 'UserKnownHostsFile /dev/null' >> /home/vagrant/.ssh/config
        chmod -R 600 /home/vagrant/.ssh/config
        SCRIPT

        vagrant up // or vagrant reload --provision

Is this just a reformatted version of my answer? If so you should probably just edit my answer rather than adding a new one. — opticyclic, Commented Aug 21, 2018 at 17:14

samueldc · Accepted Answer · 2022-01-31 20:19:12Z

You could generate the keys using shell provisioner ssh-keygen quiet mode, copy the pub key to the project folder and then copy it to the other(s) machine(s) using file provisioner. Assuming /vagrant/ is the project synced folder, it should be something like this:

machine1.vm.provision "shell", inline: "[ ! -f '/home/vagrant/.ssh/id_rsa' ] && ssh-keygen -q -f /home/vagrant/.ssh/id_rsa -N ''"

machine1.vm.provision "shell", inline: "cp /home/vagrant/.ssh/id_rsa.pub /vagrant/"

machine2.vm.provision "file", source: "id_rsa.pub", destination: "/home/vagrant/.ssh/"

machine2.vm.provision "shell", inline: "[ ! -f '/home/vagrant/.ssh/id_rsa_machine1.pub' ] && cat /vagrant/id_rsa.pub >> /home/vagrant/.ssh/authorized_keys"

machine2.vm.provision "file", source: "id_rsa.pub", destination: "/home/vagrant/.ssh/id_rsa_machine1.pub"

Stack Exchange Network

How do I configure SSH keys in a Vagrant multi-machine setup?

4 Answers 4

Your Answer

Not the answer you're looking for? Browse other questions tagged
ansible
vagrant
or ask your own question.

Linked

Hot Network Questions

How do I configure SSH keys in a Vagrant multi-machine setup?

4 Answers 4

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged ansiblevagrant or ask your own question.

Linked

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
ansible
vagrant
or ask your own question.