Handshake failed

[adriangabura]

Hi I have the following config:

`resource "ssh_resource" "init" {
host = "${var.host}"
user = "${var.user}"
host_user = "${var.user}"
private_key = "/home/${var.user}/.ssh/key"
agent = false

file {
source = "${var.haproxy_cfg_path}"
destination = "/home/${var.user}/haproxy/haproxy.cfg"
permissions = "0644"
owner = "${var.user}"
group = "${var.user}"
}

timeout = "15m"
commands = [
"mkdir -p /var/home/${var.user}/haproxy}"
]
}`

I get ssh_resource.init: Creating...
docker_container.haproxy: Destroying... [id=0e0d0589e1c133f8fd7ef7037362941b35e19b97e4b1249d684d145a50412e56]
docker_container.haproxy: Destruction complete after 0s
docker_container.haproxy: Creating...
docker_container.haproxy: Creation complete after 1s [id=a8c0035f20e6bd37343495f42f0d6cc968afdb29b3743b0f8e8823e0ec777911]
╷
│ Error: copying files to remote: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
│
│ with ssh_resource.init,
│ on sabik.tf line 15, in resource "ssh_resource" "init":
│ 15: resource "ssh_resource" "init" {
│

.ssh is 700
key is 600
I tried both loading via ssh-agent and directly via private key arg Nothing works.

This is Fedora 35 workstation

[loafoe]

Hi, the private_key expects the key as a string so just wrap the filename in a file() call:

private_key = file("/home/${var.user}/.ssh/key")

Also make sure the key does not have a passphrase as the provider will not be able to read it in that case

[adriangabura]

Hi, the private_key expects the key as a string so just wrap the filename in a file() call:

private_key = file("/home/${var.user}/.ssh/key")

Also make sure the key does not have a passphrase as the provider will not be able to read it in that case

Thanks for the reply just tried it didn't work:

sh_resource.init: Creating...
docker_container.haproxy: Destroying... [id=c2e1abc542827f1c87b2688e34551c4aae8c3993cd3ea4933b76c658f7e3b1bd]
docker_container.haproxy: Destruction complete after 1s
docker_container.haproxy: Creating...
docker_container.haproxy: Creation complete after 1s [id=2f866bea9a3e0ee45bbd5df7e5dfbc0ae3712ecf144dd35a99959efaef8ef447]
╷
│ Error: copying files to remote: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
│
│ with ssh_resource.init,
│ on sabik.tf line 15, in resource "ssh_resource" "init":
│ 15: resource "ssh_resource" "init" {
│

Also the key is passphrase-less

[loafoe]

Can you set a debug_log in the provider which should dump a bit more details:

provider "ssh" {
   debug_log = "/tmp/ssh.log"
}

Also when trying the agent method make sure agent = true in the resource and your key was loaded with ssh-add in the agent process.

[adriangabura]

I made sure agent was true and key loaded. Then I tested manually that I can ssh into the server using key from ssh-agent.

Then I tried to provide the key directly, also didn't work

This is what I get in log:

"Copied /home/alpha1138/Projects/sabik/config/haproxy.cfg to remote file 10.2.1.120:/var/data/haproxy/haproxy.cfg: 906 bytes
Permissions file /var/data/haproxy/haproxy.cfg:0644:
"
new config:

`resource "ssh_resource" "init" {
host = var.host
user = var.user
host_user = var.user

private_key = file("/home/alpha1138/.ssh/key")

file {
source = var.haproxy_cfg_path
destination = "/var/data/haproxy/haproxy.cfg"
permissions = "0644"
owner = var.user
group = var.user
}

timeout = "15m"
commands = [
"mkdir -p /var/data/haproxy}"
]
}

provider "ssh" {
debug_log = "/tmp/ssh.log"
}`

[adriangabura]

@loafoe Hi, thank you for your assistance.

After a ton of investigating I arrived at the conclusion the problem has to do with ssh-rsa and this deprecation. I still don't understand why I could log in with my ssh-rsa key to Fedora CoreOS 35 via ssh application. And at the same time I could provision container resources via kreuzwerker/docker. But clearly there is some kind of blunder somwhere related to Go language.

This is what I found. Exactly the issue I have.

Let me add another link maybe search engines will pick it up coreos/fedora-coreos-docs#220

God the HOURS I spent on this, I can't believe it.

Ok so a maintainer of fedora coreos docs says . So this is related to this issue. Terraform uses Go lang or smth?

So then this on go.

Someone tried to implement a fix but it's not merged here

[adriangabura]

Ok, looks like changing the cipher to ecdsa-key didn't solve anything. Before when using ssh-rsa I couldn't use the default terraform provisioners. Now they work. But your provider doesn't work. So clearly there is something wrong.

This is what I get in /tmp/ssh.log:

Copied /home/alpha1138/Projects/sabik/config/haproxy.cfg to remote file 10.2.1.120:/var/data/haproxy/haproxy.cfg: 906 bytes
Permissions file /var/data/haproxy/haproxy.cfg:0644: chmod: cannot access '/var/data/haproxy/haproxy.cfg': No such file or directory

Again, this is the code `resource "ssh_resource" "init" {
host = var.host
user = var.user
host_user = var.user

agent = true

file {
source = var.haproxy_cfg_path
destination = "/var/data/haproxy/haproxy.cfg"
permissions = "0644"
owner = var.user
group = var.user
}

timeout = "15m"
commands = [
"sudo mkdir -p /var/data/haproxy"
]
}`
Perhaps it tries to copy the file and then it tries to execute the commands?

[loafoe]

@adriangabura hi, yes first the files are copied and then the commands are executed. You could split this in 2 resources and create a depends_on dependency e.g. first a resource that sudo mkdir -p /var/data/haproxy and then the dependent one where you do the actual file copy? A bit convoluted maybe, but would solve the order issue.