0

I'm quite new to Ansible. Using Ansible 2.10 on my laptop (ansible master), and I'm trying to copy some files and directories from a remote serverA to a remote serverB.

In serverA I created an SSH key (id_rsa) using the sudo user, and copied the public key into serverB (into authorized_keys file of the same sudo user).

Hosts file

[servers]
prod_server ansible_host=IP_prod
new_server ansible_host=IP_new

[servers:vars]
ansible_user=sudo_user
ansible_sudo_pass=password
ansible_ssh_private_key_file=~/.ssh/id_rsa

Playbook

- name: Transfer files from prod to new server
  hosts: new_server
  gather_facts: false
  become: true
  roles:
  - rsync

Role

- name: Copy files to new server
  synchronize:
    src: /etc/letsencrypt/live/domain/fullchain.pem
    dest: /opt
  delegate_to: prod_server

Running the playbook an error shows up:

fatal: [new_server -> IP_new]: FAILED! => {"changed": false, "cmd": "/usr/bin/rsync --delay-updates
-F --compress --archive --rsh=/usr/bin/ssh -S none -i /root/.ssh/id_rsa -o StrictHostKeyChecking=no
-o UserKnownHostsFile=/dev/null --rsync-path=sudo rsync --out-format=<<CHANGED>>%i %n%L 
/etc/letsencrypt/live/domain/fullchain.pem sudo_user@IP_new:/opt", "msg": "Warning: Identity 
file /root/.ssh/id_rsa not accessible: No such file or directory.\nWarning: Permanently added
'IP_new' (ECDSA) to the list of known hosts.\r\nsudo_user@IP_new: Permission denied (publickey).....

Any help would be much appreciated.

Regards

Improve this question

1 Answer 1

Reset to default
0

delegate_to: prod_server in the task synchronize: means that the file should be copied from prod_server to new_server. Because of become: true the task is run by root and rsync tries to use the public key -i /root/.ssh/id_rsa which is missing

Warning: Identity file /root/.ssh/id_rsa not accessible: No such file or directory.

To solve the problem, either create the ssh keys for root at prod_server and make sure she can connect to new_server (if you want root to copy the file) or remove global become: true from the play and make sure sudo_user is able to connect from prod_server to new_server and copy the file.

When you remove global become: true from the play you'll have to selectively enable it in any task when needed. In this case, to simplify the escalation in the playbook, you might want to put the file's synchronization into a separate play.

Improve this answer
3
  • Hi Vladimir, Thanks for your explanation. I removed become: true from the play and changed the private key to ~/.ssh/my_laptop_ssh_key. Now the error that shows up is: Identity file /home/sudo_user/.ssh/my_laptop_ssh_key not accessible: No such file or directory Where do I must store the path to the SSH key created in the prod_server? Maybe in the hosts file? In a separate group?
    – Roberto Jobet
    Commented May 20, 2021 at 21:11
  • I don't know. I haven't tried to redefine delegated private key yet. In my testing, I've always used defaults, in this case, e.g. /home/sudo_user/.ssh/id_rsa. It's an interesting problem. Open a new question, please.
    – Vladimir Botka
    Commented May 21, 2021 at 4:09
  • Hi Vladimir, I opened a new question, this time on Stackoverflow site: stackoverflow.com/questions/67643503/…
    – Roberto Jobet
    Commented May 22, 2021 at 13:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .