Ansible-playbook Permission denied: /opt/morpheus/.ssh/ansible

Automation/IaC
1

When trying to run an ansible playbook for a cisco switch we receive “Permission denied: /opt/morpheus/.ssh/ansible”. The morpheus-app user is running the ansible-playbook task and is also the owner of the /opt/morpheus/.ssh/ansible file. The other strange fact is that we are not using keys to access the cisco switches, only username/password.

I’m trying to run a playbook against a cisco switch. My inventory file looks like this:

[cisco_switches]
 toc-lab-gw ansible_ssh_user=morpheus ansible_ssh_pass="<%=cypher.read('secret/morpheus_cisco_pass')%>"

[cisco_switches:vars]
 ansible_connection=network_cli
 ansible_network_os=ios
 ansible_port=22

And my playbook looks like this:

---


- name: gatherAllFacts
  hosts: cisco_switches
  connection: network_cli
  gather_facts: false
  tasks:
    - name: Gather All Facts
      ios_facts:

Has anyone else seen this issue?

2

Just high level, it looks like your cypher reference is incorrect. You should be using the cypher lookup similar to this:

{{ lookup('cypher','secret=secret/mypassword') }}

https://docs.morpheusdata.com/en/latest/integration_guides/Automation/ansible.html#using-secrets

My guess that is throwing some sort of conflict and causing improper execution.

3

Good point. I updated the relevant section to:

[cisco_switches]
 toc-lab-gw ansible_ssh_user=morpheus ansible_ssh_pass="{{ lookup('cypher','secret=secret/morpheus_cisco_pass') }}"

I still get the same error :cry:

4

the ansible verbose logs show:

PLAYBOOK: cisco.yml ************************************************************
Positional arguments: ./playbooks/cisco.yml
subset: cisco_switches
private_key_file: /opt/morpheus/.ssh/ansible
become_method: sudo
<snip>

Morpheus appears to be adding the private_key_file and become_method parameters.

5

I found private_key_file setting was set in /etc/ansible/ansible.cfg. I removed the default and it works now. I still am wondering where become_method: sudo is coming from and why the morpheus_app user could not access its own private key file though.