29

I'm fairly certain I've seen a feature in the ansible documentation where you can tell it that to connect to certain hosts it first needs to tunnel through a DMZ host. I can't however seem to find any documentation outside of some debates on the mailing lists.

I'm aware of hacking this in with an ssh config like on this page http://alexbilbie.com/2014/07/using-ansible-with-a-bastion-host/ however that's an overcomplicated kludge for an extremely common requirement in any kind of mildly regulated environment.

Is there a way to do this without using custom ssh config includes and voodoo netcat sorcery?

0

3 Answers 3

30

With Ansible 2, this is a built-in option:

How do I configure a jump host to access servers that I have no direct access to?

With Ansible 2, you can set a ProxyCommand in the ansible_ssh_common_args inventory variable. Any arguments specified in this variable are added to the sftp/scp/ssh command line when connecting to the relevant host(s). Consider the following inventory group:

[gatewayed]
foo ansible_host=192.0.2.1
bar ansible_host=192.0.2.2

You can create group_vars/gatewayed.yml with the following contents:

ansible_ssh_common_args: '-o ProxyCommand="ssh -W %h:%p -q [email protected]"'

Ansible will append these arguments to the command line when trying to connect to any hosts in the group gatewayed. (These arguments are used in addition to any ssh_args from ansible.cfg, so you do not need to repeat global ControlPersist settings in ansible_ssh_common_args.)

Note that ssh -W is available only with OpenSSH 5.4 or later. With older versions, it’s necessary to execute nc %h:%p or some equivalent command on the bastion host.

3
  • 13
    Note that if you copy the ansible_ssh_common_args line into your inventory file, you need equal signs instead of colons! Boy that took a while to catch...
    – mlissner
    May 9, 2017 at 22:19
  • How to specify a jump box one the command line, for a given playbook? Feb 21, 2019 at 8:35
  • Link in built-in-option is expired. I just want to update new link for other people.
    – PaPu
    Sep 21, 2021 at 19:02
15

If your jump box needs a private key file to connect (even if it's the same key as the one used for the private subnet instances), use this instead:

ansible_ssh_common_args: '-o ProxyCommand="ssh -i <path-to-pem-file> -W %h:%p -q [email protected]"'

I spent hours trying to fix a problem that now seems like a simple and obvious solution.

2
  • If the private key file is in a standard location, specifying the path explicitly should not be necessary.
    – crishoj
    Sep 24, 2016 at 18:43
  • I also needed to download the private key from the jump box/gateway and specify the path to it. Seems not ideal. If there is a way to not have to do that download, and specifying, I would be curious to know.
    – Corey
    May 2, 2020 at 3:35
2

As Ansible uses SSH, you can specify a bastion host in the standard SSH config way:

e.g. to connect through a bastion host for all servers that have a name like "*.amazonaws.com":

Host *.amazonaws.com
  ProxyCommand ssh -W %h:%p my_bastion_host.example.org

When ansible or ansible-playbook runs, it will read in your SSH configuration file and apply it for connections. You can also specify which SSH configuration file is read by using the ANSIBLE_SSH_ARGS environmental variable or by using the -F flag when calling the command.

You are also able to specify more SSH arguments in the ansible.cfg.

3
  • Yeah that's what I was afraid of and what I could consider the wrong way to do it ( if I was designing ansible ). In Capistrano this is literally a one liner.
    – user5076297
    Jul 14, 2015 at 13:38
  • I ran into a similar case and would have liked to be able to specify a "config file/option factory" script on the command line. Out of curiosity, can you add your one-liner approach to your question?
    – user559633
    Jul 14, 2015 at 13:40
  • 2
    There's a gateway host option in Capistrano (a similar tool) that really should be in ansible. If I'm copying 15 lines of boilerplate for something i feel like it should be built into the tool.
    – user5076297
    Jul 14, 2015 at 13:56