Ansible communication medium

Question

I am a little confused as to what is the protocol that Ansible uses for communication between Controller node and Managed Remote nodes.

I believed that it was "SSH" protocol.

However, the official documentation mentions this "On the managed nodes, you need a way to communicate, which is normally ssh. By default this uses sftp. If that’s not available, you can switch to scp in ansible.cfg"

I am a little confused as I used to believe SSH and SFTP and SCP are completely different protocol. AFAIK, SFTP is used to securely transfer files and SCP is for secure copy. This may be over SSH connection, but why would ansible use SFTP or SCP?

Is it about transferring some files/python modules using these protocols? If yes, what files are getting transferred actually?

Kindly Excuse me if this question sounded silly, nevertheless any elaborate response would be much appreciated.

Answer 1

This is a great question as some of the terminology can be very confusing - particularly surrounding the (unfortunate) use of "SFTP" to describe multiple similar technologies.

Will the real SFTP please stand up

This comes mainly from the fact, that RFC 913 defines one SFTP protocol, the "Simple File Transfer Protocol" which offers no encryption and went largely unadopted, with users favoring TFTP and FTP depending on their needed application.

Since the FTP protocol, defined in RFC 1738 in 1985 is completely encrypted and packet sniffers are able to dumping plaintext passwords from this protocol, Some thought that it would be a good idea to secure this protocol by implementing FTP over an SSL connection. In 1997 a mechanism for doing that was released in RFC 2228 which often was referred to as SFTP.

Meanwhile, back at the ranch...

Meanwhile, a similar security issue was occurring around the telnet protocol - passwords and sensitive information were unencrypted and subject to sniffing. In response, SSH-1 was released in 1995 which provided an encrypted equivelent to telnet for use over network connections.

This protocol became very popular very quickly and before a formal specification allowing for FTP over SSH was released, users of the SSH protocol had implemented a version of BSDs rcp (remote copy) over SSH. This protocol was extremely limited however, which led to a revision in SSH - SSH2 which added an SSH File Transfer Protocol (not to be confused with FTP over SSH, another SFTP) because, according to wikipedia:

Compared to the SCP protocol, which only allows file transfers, the SFTP protocol allows for a range of operations on remote files which make it more like a remote file system protocol. An SFTP client's extra capabilities include resuming interrupted transfers, directory listings, and remote file removal.

And In fact, the IETF set up a working group to codify a formal standard for SSH-2 (released as RFC 4251) but

Eventually, development stalled as some committee members began to view SFTP as a file system protocol, not just a file access or file transfer protocol, which places it beyond the purview of the working group.

And eventually SSHFS was released as just that.

Conclusion

So the answer is a bit complicated.

SSH and SFTP and SCP could be regarded as completely different protocols depending on which SFTP you are referring to and which version of the SSH protocol you are referring to. Yet, the command for actually doing a file transfer remained "scp" even after the SFTP and SSH-2 protocol was developed. If one is referring to SSH-2 however, these could arguably all be considered the same protocol.

Side note: SSH was released by Tatu Ylönen of the Helsinki University of Technology in 1995. As Linus Torvalds released Linux in 1991 as a student at the University of Helsinki until 1996, it was kismet that SSH would be so popular and widely used in Linux.

Answer 2

Yes, Ansible transfers packaged task file to remote host and executes it there. Still, the process can be different with pipelining mode.

This is how task execution looks like in general (without pipelining):

• Generate Python-file with module and its parameters for remote execution
• Connect via SSH to detect remote user home directory
• Connect via SSH to create temporary work directory
• Connect via SSH to upload Python-file via SFTP
• Connect via SSH to execute Python-file and cleanup temp dir
• Get module's result from SSH standard output