jmgilman
commented
4 years ago This is what the vm that Packer is attempting to connect to is seeing in the ssh log:
Feb 16 10:02:29 ubuntu1804 sshd[597]: Connection from 192.168.10.196 port 34212 on 192.168.10.190 port 22
Feb 16 10:02:29 ubuntu1804 sshd[598]: Connection from 192.168.10.196 port 34214 on 192.168.10.190 port 22
Feb 16 10:02:29 ubuntu1804 sshd[597]: Did not receive identification string from 192.168.10.196 port 34212
Feb 16 10:02:29 ubuntu1804 sshd[598]: Failed publickey for josh from 192.168.10.196 port 34214 ssh2: RSA SHA256:fF6+1kmfhyRtnX+eJOEsEZALiX4uU0EMixXcs8PaZyM
Feb 16 10:02:29 ubuntu1804 sshd[598]: Connection closed by authenticating user josh 192.168.10.196 port 34214 [preauth]
Feb 16 10:02:45 ubuntu1804 sshd[600]: Connection from 192.168.10.196 port 48792 on 192.168.10.190 port 22
Feb 16 10:02:45 ubuntu1804 sshd[600]: Failed publickey for josh from 192.168.10.196 port 48792 ssh2: RSA SHA256:KgSKl0gWtDcOLy+v8ilB9ZOuYNml+heCGaQ3HcqE4pY
Feb 16 10:02:45 ubuntu1804 sshd[600]: Accepted certificate ID "vault-radius-jmgilman-2a048a974816b4370e2f2faff22941f593ae60d9a5fa178219a4371dca84e296" (serial 7257757255081811737) signed by RSA CA SHA256:bXANuNBDOpIhy8aeeFW0KGkX4YwWXDyNxr1xKxR5Yvw via /etc/ssh/trusted
Feb 16 10:02:45 ubuntu1804 sshd[600]: Postponed publickey for josh from 192.168.10.196 port 48792 ssh2 [preauth]
Feb 16 10:02:45 ubuntu1804 sshd[600]: Accepted certificate ID "vault-radius-jmgilman-2a048a974816b4370e2f2faff22941f593ae60d9a5fa178219a4371dca84e296" (serial 7257757255081811737) signed by RSA CA SHA256:bXANuNBDOpIhy8aeeFW0KGkX4YwWXDyNxr1xKxR5Yvw via /etc/ssh/trusted
Feb 16 10:02:45 ubuntu1804 sshd[600]: Accepted publickey for josh from 192.168.10.196 port 48792 ssh2: RSA-CERT ID vault-radius-jmgilman-2a048a974816b4370e2f2faff22941f593ae60d9a5fa178219a4371dca84e296 (serial 7257757255081811737) CA RSA SHA256:bXANuNBDOpIhy8aeeFW0KGkX4YwWXDyNxr1xKxR5Yvw
Feb 16 10:02:45 ubuntu1804 sshd[600]: pam_unix(sshd:session): session opened for user josh by (uid=0)
Feb 16 10:02:45 ubuntu1804 systemd-logind[466]: New session 1 of user josh.
Feb 16 10:02:45 ubuntu1804 systemd: pam_unix(systemd-user:session): session opened for user josh by (uid=0)
Feb 16 10:02:46 ubuntu1804 sshd[600]: User child is on pid 637
Feb 16 10:02:46 ubuntu1804 sshd[637]: Starting session: shell on pts/0 for josh from 192.168.10.196 port 48792 id 0192.168.10.196 is the host running Packer
192.168.10.190 is the virtual machine its trying to connect to
The last bit of the log at 10:02:45 is where I connected successfully from the container using the ssh client. It appears Packer simply has no idea what to do with a signed SSH certificate - as in it doesn't appear to be attempting to pass it at all.
Here is the associated sshd_config:
# What ports, IPs and protocols we listen for
Port 22
Protocol 2
# Supported HostKey algorithms by order of preference.
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
# Password based logins are disabled - only public key based logins are allowed.
AuthenticationMethods publickey
# Logging
SyslogFacility AUTH
LogLevel VERBOSE
# Authentication:
LoginGraceTime 120
PermitRootLogin No
StrictModes yes
# Trust signed keys
TrustedUserCAKeys /etc/ssh/trusted
# Do not permit empty passwords
PermitEmptyPasswords no
# No need for X11 forwarding
X11Forwarding no
# Should be safe to perform this check
UseDNS yes
# Limit attempts to 15 to stop bruteforcing
MaxAuthTries 15
# Log sftp level file access (read/write/etc.) that would not be easily logged otherwise.
Subsystem sftp /usr/lib/openssh/sftp-server -f AUTHPRIV -l INFO
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yesIn the meantime, I was able to circumvent this issue by temporarily adding the generated Docker public key to ~/.ssh/authorized_keys on the virtual machine and then deleting it after the bootstrap process. I'm fairly certain this is a bug in Packer with it not being able to deal with signed certificates (for example, Ansible supports this out of the box).
schiller256
nmische
SwampDragons
sylviamoss
ghost
Overview of the Issue
Packer is failing to connect to a vmware virtual machine after cloning. Packer is being run inside of a container and upon connecting to the container in interactive mode I'm able to manually SSH into the respective vmware machine with no issues. Unfortunately forcing Packer into debug mode doesn't reveal the actual command being run, so I have no way to validate it's using the username and private key file I specified.
With the docker container I can successfully connect:
Here is the Dockerfile for reference.
It may be worth noting that I'm using signed public SSH keys. In other words, sshd_config has the following in it:
Reproduction Steps
Packer version
From
packer version: 1.4.5Simplified Packer Buildfile
The respective variables for reference:
I've tried manually specifying ssh_host (I know the IP ahead of time) as well as removing ssh_private_key entirely with no change in the result.
Operating system and Environment details
Ubuntu 18.04
Here is the specific Docker digest:
FROM ubuntu@sha256:bc025862c3e8ec4a8754ea4756e33da6c41cba38330d7e324abd25c8e0b93300Log Fragments and crash.log files