How to fetch Code from Gitlab using SSH during packer image creation.

134 views
Skip to first unread message

Tekchand Dagar

unread,
Dec 31, 2018, 6:12:41 AM12/31/18
to Packer
Hello Team,

I am creating image using packer and i have used the the shell and ansible-local provisioners and all the required packages are installed successfully. Now i need to fetch my application code from gitlab in my image. I can use only SSH method because HTTP(S) method is disabled on our Gitlab. I have attached my json builder file as well as some other files for reference. Please refer the attached file.

 To fetch the application code from Gitlab I have followed the below steps:

Step 1: I have copied the private ssh key in a file on packer host. The file permission is 600 and ownership is deploy:deploy. Because i need to fetch the code as deploy user.
Step 2: I have run the command eval "$(ssh-agent)" to run the ssh agent.
Step 3: On the host running Packer loaded  ssh key that have access to git repository ssh-add <path to private key>.


But when i am running my packer builder all provisioners are completed successfully except ch.yml part. Which is used to clone the repository from gitlab. I am getting the below error:

fatal: [127.0.0.1]: FAILED! => {"changed": true, "cmd": "git clone g...@xyz.com:rana/test-packr-clone.git", "delta": "0:00:00.012369", "end": "2018-12-31 11:03:04.843409", "msg": "non-zero return code", "rc": 128, "start": "2018-12-31 11:03:04.831040", "stderr": "fatal: could not create work tree dir 'test-packr-clone': Permission denied", "stderr_lines": ["fatal: could not create work tree dir 'test-packr-clone': Permission denied"], "stdout": "", "stdout_lines": []}


Can you please help me to fix this issue? Its roadblock to complete my project.

Any help will be appreciated.

Thanks.

ch.sh.odt
builder.json.odt
ch.yml.odt

Rickard von Essen

unread,
Jan 1, 2019, 8:58:08 AM1/1/19
to packe...@googlegroups.com
To troubleshot this provide the following info:

On the Packer host, what's the output of:

set | grep SSH_
ssh-add -L

In your packer template add

"provisioners": [{
  "type": "shell",
  "inline": [
     "set | grep SSH_",
     "ssh-add -L",
     "ssh -vvv g...@xyz.com"
  ]
},

And rerun the packer build and provide the output.

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/mitchellh/packer/issues
IRC: #packer-tool on Freenode
---
You received this message because you are subscribed to the Google Groups "Packer" group.
To unsubscribe from this group and stop receiving emails from it, send an email to packer-tool...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/packer-tool/24c7e0fe-8662-40cd-9203-1026ffcdffd1%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Tekchand Dagar

unread,
Jan 2, 2019, 2:18:36 AM1/2/19
to Packer
Hello Team,

I have run the command suggested by you please find the output of both the commands:

Command 1:

root@packer:~/packer# set | grep SSH_
SSH_AGENT_PID=4482
SSH_AUTH_SOCK=/tmp/ssh-SVokQwOeRx7G/agent.4481

Command 2:

root@packer:~/packer# ssh-add -L
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjnEEn4+sO3U9o4+Xr9KEtjrDX+i2jMPazXNPnMFoZNwFG3XPDrnl+Whb+SHjBsdfXx+iQkasASKCo1ap118g0hSFMgLVtIlFyD0GqePId4uejLrYZG79AbbEWn0kB+RitaG2S2S2OMHcUAeGtmoyIXHqvPEo9tDoSht6ReFk9UY2eGQUjy8QFz/2TIbF8IpEZz5JvGkmuGF0PqPn0GQZw6sw4VJlE5Zre52qyEMQel4mHAKXQiWhSG0wpK5IOfPuUmXXLCzJp0 id_rsa

I have added the provisioners also in my build and getting the SSH connnection time out error on port 22.

Because we are running our gitlab on port 971.

I have copied the config file using file provisioner which specify our gitlab domain and port. Yet why it still trying to connect on port 22? 

I have attached my builder and config file. Please refer the attached file for configuration.

Error:

==> digitalocean: Uploading /root/packer/config => /home/deploy/.ssh/
1 items:  37 B / 37 B [=================================================================================================================================================================================] 2s
==> digitalocean: Provisioning with shell script: ch.sh
==> digitalocean: Provisioning with shell script: /tmp/packer-shell281110143
    digitalocean: SSH_AUTH_SOCK='/tmp/ssh-wi6xZWcfsn/agent.1643'
    digitalocean: SSH_CLIENT='2.3.4.5 56914 22'
    digitalocean: SSH_CONNECTION='2.3.4.5 56914 3.4.5.6 22'
    digitalocean: OpenSSH_7.2p2 Ubuntu-4ubuntu2.6, OpenSSL 1.0.2g  1 Mar 2016
    digitalocean: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjnEEn4+sO3U9o4+Xr9KEtjrDX+i2jMPazXNPnMFoZNwFG3XPDrnl+Whb+SHjBsdfXx+iQkasASKCo1ap118g0hSFMgLVtIlFyD0GqePId4uejLrYZG79AbbEWn0kB+RitaG2S2S2OMHcUAeGtmoyIXHqvPEo9tDoSht6ReFk9UY2eGQUjy8QFz/2TIbF8IpEZz5JvGkmuGF0PqPn0GQZw6sw4VJlE5Zre52qyEMQel4mHAKXQiWhSG0wpK5IOfPuUmXXLCzJp0 id_rsa
    digitalocean: debug1: Reading configuration data /etc/ssh/ssh_config
    digitalocean: debug1: /etc/ssh/ssh_config line 19: Applying options for *
    digitalocean: Pseudo-terminal will not be allocated because stdin is not a terminal.
    digitalocean: debug2: resolving "git.xyz.com" port 22
    digitalocean: debug2: ssh_connect_direct: needpriv 0
    digitalocean: debug1: Connecting to git.xyz.com [1.2.3.4] port 22.
    digitalocean: debug1: connect to address 1.2.3.4 port 22: Connection timed out
    digitalocean: ssh: connect to host git.xyz.com port 22: Connection timed out

Note:  I have changed the some part of SSH key, Domain of our gitlab and some IP's with other regular digit like 1.2.3.4 etc.
builder.json.odt
ch.sh.odt
config.odt

Rickard von Essen

unread,
Jan 2, 2019, 7:29:33 AM1/2/19
to packe...@googlegroups.com
Change the inline command to:

"ssh -vvv -p 987 g...@xyz.com"

This should be successful and give something like:

"Welcome to GitLab, John Doe!"

I expect that to work, the problem you the face is when you switch to the deploy user (become_user: deploy) that user can't access the Unix socket forwarding the ssh-agent, on root can do that since root is the owner of it.

There is no way around that that and my recommendation is that you instead let root clone the repo and then move/chown it to deploy. 

Vincent Rubiolo

unread,
Jan 2, 2019, 12:32:52 PM1/2/19
to packe...@googlegroups.com
Hi  Tekchand,

Rickard already provided a lot of useful information about the SSH connection. On my end, I wanted to ask: could this be a file permission issue?
I see
fatal: could not create work tree dir 'test-packr-clone': Permission denied"
which hints to me at a file permission problem when creating the clone (i.e during sth like 'mkdir').

Which directory are you calling the 'git clone' command from (this is not obvious from your Playbook)? I'd check you have write rights to that directory with your user or switch to one where you do.

HTH,

Vincent 

Tekchand Dagar

unread,
Jan 3, 2019, 12:20:32 AM1/3/19
to Packer
Hello Vincent,

Thank you for your response.

fatal: could not create work tree dir 'test-packr-clone': Permission denied"

'test-packr-clone' is the repository which i need to clone in my image. Please refer the attached file for permission details which is created by ansible playbook.

As per my knowledge, when we clone git as deploy user then the ownership of the file (directory) should be deploy by default if it able to fetch the repository.

The issue i am facing is how I can fetch my code from Gitlab during image creation still i am out of ideas.

Tekchand Dagar

unread,
Jan 3, 2019, 12:24:40 AM1/3/19
to Packer
Hello Vincent,

Thank you for your response.

I have added the -p 987 (my port is 971 and used same) but i am still getting the same error. 

Error:

==> digitalocean: Uploading /root/packer/config => /home/deploy/.ssh/
1 items:  37 B / 37 B [=================================================================================================================================================================================] 1s
==> digitalocean: Provisioning with shell script: ch.sh
==> digitalocean: Provisioning with shell script: /tmp/packer-shell441758894
    digitalocean: SSH_CLIENT='1.2.3.4 54238 22'
    digitalocean: SSH_CONNECTION='1.2.3.4 54238 2.3.4.5 22'
    digitalocean: Could not open a connection to your authentication agent.

Please help me to fix this issue. I am really run out of ideas.

Really appreciated your help and guidance.



On Wednesday, January 2, 2019 at 11:02:52 PM UTC+5:30, Vincent Rubiolo wrote:

Vincent Rubiolo

unread,
Jan 3, 2019, 12:37:01 AM1/3/19
to packe...@googlegroups.com
Hi again Tekchand,

Thanks for your answer. It looks like you are still looking into the SSH connection side. My advice was to look into the file permission problem, cf for instance https://stackoverflow.com/questions/20276895/could-not-create-work-tree-dir-example-com-permission-denied which details what I was mentioning.

You also said:
As per my knowledge, when we clone git as deploy user then the ownership of the file (directory) should be deploy by default if it able to fetch the repository.

You are correct about the permission issue (i.e. the ownership of the file/directory should be that of the 'deploy' user). My feeling is that you get the error because the directory you are cloning into does not have proper write permissions for the 'deploy' user. This is the reason I was asking where you were cloning in. Unless you manually cd into a directory of your choice, you can't know where you will end up (maybe this is '/' you are cloning in ...).

In short, to me, if it were a connection issue w/ SSH you would not get a 'permission denied' problem when creating the directory, rather sth like 'connection refused' or something similar.

Let us know how it goes,

Vincent 

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/mitchellh/packer/issues
IRC: #packer-tool on Freenode
---
You received this message because you are subscribed to the Google Groups "Packer" group.
To unsubscribe from this group and stop receiving emails from it, send an email to packer-tool...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.


--

--------
Vincent Rubiolo
Senior Platform Engineer
www.datameer.com

Slack: Vincent





Datameer, Inc.
577 2nd Street, Suite 200, San Francisco, CA 94107

Tekchand Dagar

unread,
Jan 3, 2019, 12:52:16 AM1/3/19
to Packer
Hello Vincent,

Thank you for your prompt response.

Please refer the attach file of ansible-playbook which us used for clone from git. I am switching the user from root to deploy so when it switch the user deploy then it will go into deploy user home directory. And user deploy have full right to create a file in his/her home directory. I am correct? 

Please correct me if i am going in wrong way.

Thanks.
ch.yml.odt

Vincent Rubiolo

unread,
Jan 3, 2019, 1:06:48 AM1/3/19
to packe...@googlegroups.com
Hi again Tekchand,

On Wed, Jan 2, 2019 at 9:52 PM Tekchand Dagar <tekcha...@gmail.com> wrote:
Hello Vincent,

Thank you for your prompt response.

Please refer the attach file of ansible-playbook which us used for clone from git. I am switching the user from root to deploy so when it switch the user deploy then it will go into deploy user home directory.

There is no guarantee about the directory switch being made when changing users, this will depend on the internal implementation of the 'become' command within Ansible. As you can see at https://docs.ansible.com/ansible/latest/user_guide/become.html?highlight=become, 'become' has 'become_method' which can provide different means to do so (su, sudo, etc).

For instance, with the 'su' command, it will depend on whether this is a login shell ('su' does not switch directories, 'su -' or 'su -l' does switch directories).
 
And user deploy have full right to create a file in his/her home directory. I am correct? 

You are right _if_ the directory is the 'deploy' user home dir.

I suggest adding a simple call to 'pwd' in your shell 'git clone' command to check you are where you expect to be (another way would be to do a 'touch test_file ./' before running the 'git clone' command). Then past the output here.

Note that I do not doubt you also have a connection issue (cf your unability to connect via ssh), I just think there might be 2 issues, with the 'permission denied' one masking the other (you have seen that your SSH connection fails with a timeout for instance, not a permission problem).

HTH,

Vincent

Tekchand Dagar

unread,
Jan 3, 2019, 1:50:35 AM1/3/19
to Packer
Hello Vincent,

Thank you for your response and suggestion.

Yes...after adding -p 987 in my SSH command getting connection time out error. I need to fix it first and you are right in my build json file the connection part is coming first and then clone part. So now its not reaching on clone because it fail at SSH connection.

Thanks a lot for your time and support.

Tekchand Dagar

unread,
Jan 4, 2019, 2:51:51 AM1/4/19
to Packer
Hello Rickard,

I have added the -p 987 (my port is 971 and used same) but i am still getting the same error and seems that it still trying to connect over port number 22.

Please refer the below logs:

Error:

==> digitalocean: Uploading /root/packer/config => /home/deploy/.ssh/
1 items:  37 B / 37 B [=================================================================================================================================================================================] 1s
==> digitalocean: Provisioning with shell script: ch.sh
==> digitalocean: Provisioning with shell script: /tmp/packer-shell441758894
    digitalocean: SSH_CLIENT='1.2.3.4 54238 22'
    digitalocean: SSH_CONNECTION='1.2.3.4 54238 2.3.4.5 22'
    digitalocean: Could not open a connection to your authentication agent.

Vincent Rubiolo

unread,
Jan 4, 2019, 12:06:15 PM1/4/19
to packe...@googlegroups.com
Hi Tekchand,

Thank you for your response and suggestion.

You're welcome, but you did not try what I had suggested (putting 'pwd' in your git clone command and reporting the output). Can you do that?
 
Yes...after adding -p 987 in my SSH command getting connection time out error. I need to fix it first and you are right in my build json file the connection part is coming first and then clone part. So now its not reaching on clone because it fail at SSH connection.

I will let you check that with Rickard.

Vincent
 

On Wed, Jan 2, 2019 at 10:50 PM Tekchand Dagar <tekcha...@gmail.com> wrote:
Hello Vincent,

Thank you for your response and suggestion.

Yes...after adding -p 987 in my SSH command getting connection time out error. I need to fix it first and you are right in my build json file the connection part is coming first and then clone part. So now its not reaching on clone because it fail at SSH connection.

Thanks a lot for your time and support.

On Thursday, January 3, 2019 at 11:36:48 AM UTC+5:30, Vincent Rubiolo wrote:
Hi again Tekchand,

On Wed, Jan 2, 2019 at 9:52 PM Tekchand Dagar <tekcha...@gmail.com> wrote:
Hello Vincent,

Thank you for your prompt response.

Please refer the attach file of ansible-playbook which us used for clone from git. I am switching the user from root to deploy so when it switch the user deploy then it will go into deploy user home directory.

There is no guarantee about the directory switch being made when changing users, this will depend on the internal implementation of the 'become' command within Ansible. As you can see at https://docs.ansible.com/ansible/latest/user_guide/become.html?highlight=become, 'become' has 'become_method' which can provide different means to do so (su, sudo, etc).

For instance, with the 'su' command, it will depend on whether this is a login shell ('su' does not switch directories, 'su -' or 'su -l' does switch directories).
 
And user deploy have full right to create a file in his/her home directory. I am correct? 

You are right _if_ the directory is the 'deploy' user home dir.

I suggest adding a simple call to 'pwd' in your shell 'git clone' command to check you are where you expect to be (another way would be to do a 'touch test_file ./' before running the 'git clone' command). Then past the output here.

Note that I do not doubt you also have a connection issue (cf your unability to connect via ssh), I just think there might be 2 issues, with the 'permission denied' one masking the other (you have seen that your SSH connection fails with a timeout for instance, not a permission problem).

HTH,

Vincent

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/mitchellh/packer/issues
IRC: #packer-tool on Freenode
---
You received this message because you are subscribed to the Google Groups "Packer" group.
To unsubscribe from this group and stop receiving emails from it, send an email to packer-tool...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

Rickard von Essen

unread,
Jan 5, 2019, 4:03:44 PM1/5/19
to packe...@googlegroups.com
I already explained that you can't really do it this way. You get:

digitalocean: Could not open a connection to your authentication agent.

Since the deploy user is not allowed to connect to the ssh agent socket owned by the root user. To quote my self:

"when you switch to the deploy user (become_user: deploy) that user can't access the Unix socket forwarding the ssh-agent, only root can do that since root is the owner of it.

There is no way around that that and my recommendation is that you instead let root clone the repo and then move/chown it to deploy."
Message has been deleted

Rickard von Essen

unread,
Jan 7, 2019, 2:25:02 AM1/7/19
to packe...@googlegroups.com
Google "Host key verification failed"

On Mon, Jan 7, 2019 at 8:20 AM Tekchand Dagar <tekcha...@gmail.com> wrote:
Hello Rickard,

Thank you for your response and apologies for late reply from my side.

Now i have made the changes in my `.yml` file and now i am trying to clone the git as root user rather than deploy user.  Please refer the attached files for my builder and yml files.

Below are the Error logs:

==> digitalocean: Provisioning with shell script: ch.sh
==> digitalocean: Provisioning with shell script: /tmp/packer-shell176262049
    digitalocean: SSH_AUTH_SOCK='/tmp/ssh-lq0EZ6xnBa/agent.1617'
    digitalocean: SSH_CLIENT='1.2.3.4 57414 22'
    digitalocean: SSH_CONNECTION='1.2.3.4 57414 3.4.5.6 22'
    digitalocean: OpenSSH_7.2p2 Ubuntu-4ubuntu2.6, OpenSSL 1.0.2g  1 Mar 2016
    digitalocean: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjnEEn4+sO3U9o4+Xr9KEtjrDX+i2jMPazXNPnMFoZNwFG3XPDrnl+Whb+SHjBsdfXx+iQkasASKCo1ap118g0hSFMgLVtIlFyD0GqePId4uejLrYZG79AbbEWn0kB+RitaG2S2S2OMHcUAeGtmoyIXHqvPEo9tDoSht6ReFk9UY2eGQUjy8QFz/2TIbF8IpEZz5JvGkmuGF0PqPn0GQZw6sw4VJlE5Zre52qyEMQel4mHAKXQiWhSG0wpK5IOfPuUmXXLCzJp07tYqZR/lcKsJMBm6BkqVG3JRf/cpJo0n9oB id_rsa
    digitalocean: debug1: Reading configuration data /etc/ssh/ssh_config
    digitalocean: debug1: /etc/ssh/ssh_config line 19: Applying options for *
    digitalocean: Pseudo-terminal will not be allocated because stdin is not a terminal.
    digitalocean: /root
    digitalocean: debug2: resolving "ab.xyz.com" port 971
    digitalocean: debug2: ssh_connect_direct: needpriv 0
    digitalocean: debug1: Connecting to git.promobitech.com [5.6.7.8] port 971.
    digitalocean: debug1: Connection established.
    digitalocean: debug1: permanently_set_uid: 0/0
    digitalocean: debug1: key_load_public: No such file or directory
    digitalocean: debug1: identity file /root/.ssh/id_rsa type -1
    digitalocean: debug1: key_load_public: No such file or directory
    digitalocean: debug1: identity file /root/.ssh/id_rsa-cert type -1
    digitalocean: debug1: key_load_public: No such file or directory
    digitalocean: debug1: identity file /root/.ssh/id_dsa type -1
    digitalocean: debug1: key_load_public: No such file or directory
    digitalocean: debug1: identity file /root/.ssh/id_dsa-cert type -1
    digitalocean: debug1: key_load_public: No such file or directory
    digitalocean: debug1: identity file /root/.ssh/id_ecdsa type -1
    digitalocean: debug1: key_load_public: No such file or directory
    digitalocean: debug1: identity file /root/.ssh/id_ecdsa-cert type -1
    digitalocean: debug1: key_load_public: No such file or directory
    digitalocean: debug1: identity file /root/.ssh/id_ed25519 type -1
    digitalocean: debug1: key_load_public: No such file or directory
    digitalocean: debug1: identity file /root/.ssh/id_ed25519-cert type -1
    digitalocean: debug1: Enabling compatibility mode for protocol 2.0
    digitalocean: debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.6
    digitalocean: debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10
    digitalocean: debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10 pat OpenSSH_6.6.1* compat 0x04000000
    digitalocean: debug2: fd 3 setting O_NONBLOCK
    digitalocean: debug1: Authenticating to ab.xyz.com:971 as 'git'
    digitalocean: debug3: put_host_port: [ab.xyz.com]:971
    digitalocean: debug3: send packet: type 20
    digitalocean: debug1: SSH2_MSG_KEXINIT sent
    digitalocean: debug3: receive packet: type 20
    digitalocean: debug1: SSH2_MSG_KEXINIT received
    digitalocean: debug2: local client KEXINIT proposal
    digitalocean: debug2: KEX algorithms: curve255...@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,ext-info-c
    digitalocean: debug2: host key algorithms: ecdsa-sha2-nis...@openssh.com,ecdsa-sha2-nis...@openssh.com,ecdsa-sha2-nis...@openssh.com,ssh-ed2551...@openssh.com,ssh-rsa-...@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
    digitalocean: debug2: ciphers ctos: chacha20...@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes12...@openssh.com,aes25...@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
    digitalocean: debug2: ciphers stoc: chacha20...@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes12...@openssh.com,aes25...@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
    digitalocean: debug2: compression ctos: none,zl...@openssh.com,zlib
    digitalocean: debug2: compression stoc: none,zl...@openssh.com,zlib
    digitalocean: debug2: languages ctos:
    digitalocean: debug2: languages stoc:
    digitalocean: debug2: first_kex_follows 0
    digitalocean: debug2: reserved 0
    digitalocean: debug2: peer server KEXINIT proposal
    digitalocean: debug2: KEX algorithms: curve255...@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    digitalocean: debug2: host key algorithms: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
    digitalocean: debug2: ciphers ctos: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes12...@openssh.com,aes25...@openssh.com,chacha20...@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijnda...@lysator.liu.se
    digitalocean: debug2: ciphers stoc: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes12...@openssh.com,aes25...@openssh.com,chacha20...@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijnda...@lysator.liu.se
    digitalocean: debug2: compression ctos: none,zl...@openssh.com
    digitalocean: debug2: compression stoc: none,zl...@openssh.com
    digitalocean: debug2: languages ctos:
    digitalocean: debug2: languages stoc:
    digitalocean: debug2: first_kex_follows 0
    digitalocean: debug2: reserved 0
    digitalocean: debug1: kex: algorithm: curve255...@libssh.org
    digitalocean: debug1: kex: host key algorithm: ecdsa-sha2-nistp256
    digitalocean: debug1: kex: server->client cipher: chacha20...@openssh.com MAC: <implicit> compression: none
    digitalocean: debug1: kex: client->server cipher: chacha20...@openssh.com MAC: <implicit> compression: none
    digitalocean: debug3: send packet: type 30
    digitalocean: debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
    digitalocean: debug3: receive packet: type 31
    digitalocean: debug1: Server host key: ecdsa-sha2-nistp256 SHA256:RurlZ68vkLDzi8UiN1CwbAqlD8Ogmxw+E4hxYZ1RU9g
    digitalocean: debug3: put_host_port: [4.5.6.7]:971
    digitalocean: debug3: put_host_port: [ab.xyz.com]:971
    digitalocean: debug1: checking without port identifier
    digitalocean: debug1: read_passphrase: can't open /dev/tty: No such device or address
    digitalocean: Host key verification failed.


Above is the error please help me.
Message has been deleted
Message has been deleted

Tekchand Dagar

unread,
Jan 7, 2019, 3:31:43 AM1/7/19
to Packer
Hello Rickard,

I am aware about the below error:

Host key verification failed

Below is the scenario at my end:

1. We have gitlab server and my laptop public SSH key is there for a repository and  i am able to clone it over my laptop.
2. I have installed Virtualbox over my laptop and packer is running there.
3. I have copied my laptop Private SSH key on packer machine in a file and run the below command on packer machine:
   eval "$(ssh-agent)"
   ps aux | grep ssh
   ssh-add /path/to/my/private/ssh/key/file

Can you please help me why its showing this error? Where i need to add my private key?

Thanks.
    digitalocean: debug2: host key algorithms: ecdsa-sha2-nis...@openssh.com,ecdsa-sha2-nistp384...@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v...@openssh.com,ssh-rsa-cert-v...@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
    digitalocean: debug2: ciphers ctos: chacha20...@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes12...@openssh.com,aes256...@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
    digitalocean: debug2: ciphers stoc: chacha20...@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes12...@openssh.com,aes256...@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
    digitalocean: debug2: compression ctos: none,zl...@openssh.com,zlib
    digitalocean: debug2: compression stoc: none,zl...@openssh.com,zlib
    digitalocean: debug2: languages ctos:
    digitalocean: debug2: languages stoc:
    digitalocean: debug2: first_kex_follows 0
    digitalocean: debug2: reserved 0
    digitalocean: debug2: peer server KEXINIT proposal
    digitalocean: debug2: KEX algorithms: curve255...@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    digitalocean: debug2: host key algorithms: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
    digitalocean: debug2: ciphers ctos: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-...@openssh.com,aes25...@openssh.com,chacha20...@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijnda...@lysator.liu.se
    digitalocean: debug2: ciphers stoc: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-...@openssh.com,aes25...@openssh.com,chacha20...@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijnda...@lysator.liu.se

Rickard von Essen

unread,
Jan 7, 2019, 3:48:00 AM1/7/19
to packe...@googlegroups.com
I don't think you understand the error message. 

You don't have a tty so you can't type yes to add the hsot key to the known hosts file. Just add:
 -o StrictHostKeyChecking=no
To your ssh commands. 

    digitalocean: debug2: host key algorithms: ecdsa-sha2-nis...@openssh.com,ecdsa-sha2-nis...@openssh.com,ecdsa-sha2-nis...@openssh.com,ssh-ed2551...@openssh.com,ssh-rsa-...@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
    digitalocean: debug2: ciphers ctos: chacha20...@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes12...@openssh.com,aes25...@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
    digitalocean: debug2: ciphers stoc: chacha20...@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes12...@openssh.com,aes25...@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
    digitalocean: debug2: compression ctos: none,zl...@openssh.com,zlib
    digitalocean: debug2: compression stoc: none,zl...@openssh.com,zlib
    digitalocean: debug2: languages ctos:
    digitalocean: debug2: languages stoc:
    digitalocean: debug2: first_kex_follows 0
    digitalocean: debug2: reserved 0
    digitalocean: debug2: peer server KEXINIT proposal
    digitalocean: debug2: KEX algorithms: curve255...@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    digitalocean: debug2: host key algorithms: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
    digitalocean: debug2: ciphers ctos: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes12...@openssh.com,aes25...@openssh.com,chacha20...@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijnda...@lysator.liu.se
    digitalocean: debug2: ciphers stoc: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes12...@openssh.com,aes25...@openssh.com,chacha20...@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijnda...@lysator.liu.se

Tekchand Dagar

unread,
Jan 7, 2019, 6:24:43 AM1/7/19
to Packer
Hello Rickard,

Thanks to correct me.

Now i am able to clone the repository as root user. But when try to switch the user deploy getting permission denied error. Which you already explained to me.

Really appreciated and thanks for your time and support. 
    digitalocean: debug1: Connecting to ab.xyz.com [5.6.7.8] port 971.
    digitalocean: debug2: host key algorithms: ecdsa-sha2-nis...@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521...@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
    digitalocean: debug2: ciphers ctos: chacha20...@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes12...@openssh.com,aes256-...@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
    digitalocean: debug2: ciphers stoc: chacha20...@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes12...@openssh.com,aes256-...@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
    digitalocean: debug2: compression ctos: none,zl...@openssh.com,zlib
    digitalocean: debug2: compression stoc: none,zl...@openssh.com,zlib
    digitalocean: debug2: languages ctos:
    digitalocean: debug2: languages stoc:
    digitalocean: debug2: first_kex_follows 0
    digitalocean: debug2: reserved 0
    digitalocean: debug2: peer server KEXINIT proposal
    digitalocean: debug2: KEX algorithms: curve255...@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    digitalocean: debug2: host key algorithms: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
    digitalocean: debug2: ciphers ctos: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-...@openssh.com,aes25...@openssh.com,chacha20...@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijnda...@lysator.liu.se
    digitalocean: debug2: ciphers stoc: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-...@openssh.com,aes25...@openssh.com,chacha20...@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijnda...@lysator.liu.se

Tekchand Dagar

unread,
Jan 8, 2019, 1:22:25 AM1/8/19
to Packer
Hello Rickard,

According to logs of packer my repository is clone and image is created successfully. But now i have created droplet (machine) using that image and i have tried to locate and find my repository but not available here. Can you please help me where it store the clone repository?

I have pass the pwd command also in my provisioners and it showing /root directory. But repository is not available there.

Please refer the below packer logs:

==> digitalocean: Provisioning with Ansible...
    digitalocean: Creating Ansible staging directory...
    digitalocean: Creating directory: /tmp/packer-provisioner-ansible-local/5c342b91-b086-8d52-d76a-ab82cab9204e
    digitalocean: Uploading main Playbook file...
    digitalocean: Uploading inventory file...
    digitalocean: Executing Ansible: cd /tmp/packer-provisioner-ansible-local/5c342b91-b086-8d52-d76a-ab82cab9204e && ANSIBLE_FORCE_COLOR=1 PYTHONUNBUFFERED=1 ansible-playbook /tmp/packer-provisioner-ansible-local/5c342b91-b086-8d52-d76a-ab82cab9204e/ch.yml --extra-vars "packer_build_name=digitalocean packer_builder_type=digitalocean packer_http_addr="  -c local -i /tmp/packer-provisioner-ansible-local/5c342b91-b086-8d52-d76a-ab82cab9204e/packer-provisioner-ansible-local593446373
    digitalocean:
    digitalocean: PLAY [all] *********************************************************************
    digitalocean:
    digitalocean: TASK [Gathering Facts] *********************************************************
    digitalocean: ok: [127.0.0.1]
    digitalocean:
    digitalocean: TASK [clone repository] ********************************************************
    digitalocean: changed: [127.0.0.1]
    digitalocean:
    digitalocean: PLAY RECAP *********************************************************************
    digitalocean: 127.0.0.1                  : ok=2    changed=1    unreachable=0    failed=0
    digitalocean:
==> digitalocean: Gracefully shutting down droplet...
==> digitalocean: Creating snapshot: packerimage
==> digitalocean: Waiting for snapshot to complete...
==> digitalocean: Destroying droplet...
==> digitalocean: Deleting temporary ssh key...
Build 'digitalocean' finished.

Rickard von Essen

unread,
Jan 8, 2019, 2:54:12 AM1/8/19
to packe...@googlegroups.com
On the newly launched droplet (based on the built image) as root run:

find / -name test-packr-clone -type d

That should find it for you if it exists (where test-packr-clone is the name of the repo you cloned).

    digitalocean: debug2: host key algorithms: ecdsa-sha2-nis...@openssh.com,ecdsa-sha2-nis...@openssh.com,ecdsa-sha2-nis...@openssh.com,ssh-ed2551...@openssh.com,ssh-rsa-...@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
    digitalocean: debug2: ciphers ctos: chacha20...@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes12...@openssh.com,aes25...@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
    digitalocean: debug2: ciphers stoc: chacha20...@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes12...@openssh.com,aes25...@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
    digitalocean: debug2: compression ctos: none,zl...@openssh.com,zlib
    digitalocean: debug2: compression stoc: none,zl...@openssh.com,zlib
    digitalocean: debug2: languages ctos:
    digitalocean: debug2: languages stoc:
    digitalocean: debug2: first_kex_follows 0
    digitalocean: debug2: reserved 0
    digitalocean: debug2: peer server KEXINIT proposal
    digitalocean: debug2: KEX algorithms: curve255...@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    digitalocean: debug2: host key algorithms: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
    digitalocean: debug2: ciphers ctos: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes12...@openssh.com,aes25...@openssh.com,chacha20...@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijnda...@lysator.liu.se
    digitalocean: debug2: ciphers stoc: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes12...@openssh.com,aes25...@openssh.com,chacha20...@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijnda...@lysator.liu.se

Tekchand Dagar

unread,
Jan 8, 2019, 3:42:05 AM1/8/19
to Packer
Hello Rickard,

i have logged in newly launched droplet from image which is created by packer and run the command below command:

root@packerimage-s-1vcpu-2gb-ams3-01:~# find / -name test-packr-clone -type d
root@packerimage-s-1vcpu-2gb-ams3-01:~# pwd
/root

But it didn't show anything.

Now its really frustrating and become road block to complete my project. 

Below are the packer logs and everything seems fine:

==> digitalocean: Provisioning with Ansible...
    digitalocean: Creating Ansible staging directory...
    digitalocean: Creating directory: /tmp/packer-provisioner-ansible-local/5c345586-3f29-5dcf-d865-c2b88820da8c
    digitalocean: Uploading main Playbook file...
    digitalocean: Uploading inventory file...
    digitalocean: Executing Ansible: cd /tmp/packer-provisioner-ansible-local/5c345586-3f29-5dcf-d865-c2b88820da8c && ANSIBLE_FORCE_COLOR=1 PYTHONUNBUFFERED=1 ansible-playbook /tmp/packer-provisioner-ansible-local/5c345586-3f29-5dcf-d865-c2b88820da8c/ch.yml --extra-vars "packer_build_name=digitalocean packer_builder_type=digitalocean packer_http_addr="  -c local -i /tmp/packer-provisioner-ansible-local/5c345586-3f29-5dcf-d865-c2b88820da8c/packer-provisioner-ansible-local268313433
    digitalocean:
    digitalocean: PLAY [all] *********************************************************************
    digitalocean:
    digitalocean: TASK [Gathering Facts] *********************************************************
    digitalocean: ok: [127.0.0.1]
    digitalocean:
    digitalocean: TASK [clone repository] ********************************************************
    digitalocean: changed: [127.0.0.1] => (item=git clone ssh://g...@ab.xyz:971/rana/test-packr-clone.git)
    digitalocean: changed: [127.0.0.1] => (item=pwd)
    digitalocean: changed: [127.0.0.1] => (item=ls)
    digitalocean:
    digitalocean: TASK [Debug log_level] *********************************************************
    digitalocean: skipping: [127.0.0.1]
    digitalocean:
    digitalocean: PLAY RECAP *********************************************************************
    digitalocean: 127.0.0.1                  : ok=2    changed=1    unreachable=0    failed=0
    digitalocean:
==> digitalocean: Gracefully shutting down droplet...
==> digitalocean: Creating snapshot: packerimage
==> digitalocean: Waiting for snapshot to complete...
==> digitalocean: Destroying droplet...
==> digitalocean: Deleting temporary ssh key...
Build 'digitalocean' finished.


Now without any error how we can troubleshoot it? Please suggest.

Thanks.
    digitalocean: debug2: host key algorithms: ecdsa-sha2-nis...@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521...@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
    digitalocean: debug2: ciphers ctos: chacha20...@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes12...@openssh.com,aes256-...@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
    digitalocean: debug2: ciphers stoc: chacha20...@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes12...@openssh.com,aes256-...@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
    digitalocean: debug2: compression ctos: none,zl...@openssh.com,zlib
    digitalocean: debug2: compression stoc: none,zl...@openssh.com,zlib
    digitalocean: debug2: languages ctos:
    digitalocean: debug2: languages stoc:
    digitalocean: debug2: first_kex_follows 0
    digitalocean: debug2: reserved 0
    digitalocean: debug2: peer server KEXINIT proposal
    digitalocean: debug2: KEX algorithms: curve255...@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    digitalocean: debug2: host key algorithms: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
    digitalocean: debug2: ciphers ctos: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-...@openssh.com,aes25...@openssh.com,chacha20...@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijnda...@lysator.liu.se
    digitalocean: debug2: ciphers stoc: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-...@openssh.com,aes25...@openssh.com,chacha20...@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijnda...@lysator.liu.se
ch.yml.odt

Rickard von Essen

unread,
Jan 8, 2019, 4:21:40 AM1/8/19
to packe...@googlegroups.com
Verify your workflow, if you are sure everything is in order try adding a sync and a short sleep (10s) last in your provisioning to ensure the image captures all changes to the fs.


    digitalocean: debug2: host key algorithms: ecdsa-sha2-nis...@openssh.com,ecdsa-sha2-nis...@openssh.com,ecdsa-sha2-nis...@openssh.com,ssh-ed2551...@openssh.com,ssh-rsa-...@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
    digitalocean: debug2: ciphers ctos: chacha20...@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes12...@openssh.com,aes25...@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
    digitalocean: debug2: ciphers stoc: chacha20...@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes12...@openssh.com,aes25...@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
    digitalocean: debug2: compression ctos: none,zl...@openssh.com,zlib
    digitalocean: debug2: compression stoc: none,zl...@openssh.com,zlib
    digitalocean: debug2: languages ctos:
    digitalocean: debug2: languages stoc:
    digitalocean: debug2: first_kex_follows 0
    digitalocean: debug2: reserved 0
    digitalocean: debug2: peer server KEXINIT proposal
    digitalocean: debug2: KEX algorithms: curve255...@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    digitalocean: debug2: host key algorithms: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
    digitalocean: debug2: ciphers ctos: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes12...@openssh.com,aes25...@openssh.com,chacha20...@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijnda...@lysator.liu.se
    digitalocean: debug2: ciphers stoc: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes12...@openssh.com,aes25...@openssh.com,chacha20...@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijnda...@lysator.liu.se
Reply all
Reply to author
Forward
Message has been deleted
0 new messages