Issue remoting into a device and doing a simple ping test with Ansible

Question

After following instructions both online and in a couple of books, I am unsure of why this is happening. I have a feeling there is a missing setting, but here is the setup:

I am attempting to use the command:

ansible all -u $USER -m ping  -vvvv

Obviously using the -vvvv for debugging, but not much output aside from the fact it says it's attempting to connect. I get the following error:

S4 | FAILED => FAILED: Authentication failed.

S4 stands for switch 4, a Cisco switch I am attempting to automate configuration and show commands on. I know 100% the password I set in the host_vars file is correct, as it works when I use it from a standard SSH client.

Here are my non-default config settings in the ansible.cfg file:

[defaults]
transport=paramiko
hostfile = ./myhosts
host_key_checking=False
timeout = 5

My myhosts file:

[cisco-switches]
S4

And my host_vars file for S4:

ansible_ssh_host: 192.168.1.12
ansible_ssh_pass: password

My current version is 1.9.1, running on a Centos VM. I do have an ACL applied on the management interface of the switch, but it allows remote connections from this particular IP.

Please advise.

Answer 1

Since you are using ansible to automate commands in a Cisco switch, I guess you want to perform the SSH connection to the switch without been prompted for password or been requested to press [Y/N] to confirm the connection.

To do that I recommend to configure the Cisco IOS SSH Server on the switch to perform RSA-Based user authentication.

First of all you need to generate RSA key pair on your Linux box:

ssh-keygen -t rsa -b 1024

Note: You can use 2048 instead 1024 but consider that some IOS versions will accept maximum 254 characters for ssh public key.

At switch side:

conf t    
ip ssh pubkey-chain
     username test
          key-string
               Copy the entire public key as appears in the cat id_rsa.pub
               including the ssh-rsa and username@hostname.
               Please note that some IOS versions will accept 
               maximum 254 characters.
               You can paste multiple lines.     
          exit
     exit

If you need that 'test' user can execute privileged IOS commands:

username test privilege 15 secret _TEXT_CLEAR_PASSWORD_

Then, test your connection from your Linux box in order to add the switch to known_hosts file. This will only happen one time for each switch/host not found in the known_hosts file:

ssh test@10.0.0.1
The authenticity of host '10.0.0.1 (10.0.0.1)' can't be established.
RSA key fingerprint is xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:d6:4b:d1:67.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.0.0.1' (RSA) to the list of known hosts.

ciscoswitch#
ciscoswitch#exit

Finally test the connection using ansible over SSH and raw module, for example:

ansible inventory -m raw -a "show env all" -u test

I hope you find it useful.