1

I've been fighting through Terraform Provisioner connection issues with ssh today. So far I've tried what I thought was working previously with this:

  provisioner "remote-exec" {
    inline = [
      "echo ${google_compute_instance.testing-elastic-1.network_interface.0.access_config.0.assigned_nat_ip}"]
      connection {
        type = "ssh"
        user = "root"
        private_key = "${file("~/.ssh/google_compute_engine")}"
        timeout = "45s"
      }
  }

But I keep getting the following error to this.

Error applying plan:

1 error(s) occurred:

* ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain

I also tried logging in directly to the IP with ssh itself at the terminal.

ssh -i ~/.ssh/google_compute_engine.pub 122.122.122.122

This worked fine. So I also tried this in the configuration, or what I thought would mimic this in the configuration.

provisioner "remote-exec" {
  inline = [
    "echo ${google_compute_instance.testing-elastic-1.network_interface.0.access_config.0.assigned_nat_ip}"]
    connection {
      type = "ssh"
      user = ""
      private_key = "${file("~/.ssh/google_compute_engine")}"
      timeout = "45s"
    }
}

Got another error.

Error applying plan:

1 error(s) occurred:

  • ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain

So then I tried this.

provisioner "remote-exec" {
  inline = [
    "echo ${google_compute_instance.testing-elastic-1.network_interface.0.access_config.0.assigned_nat_ip}"]
    connection {
      type = "ssh"
      private_key = "${file("~/.ssh/google_compute_engine")}"
      timeout = "45s"
    }
}

In the end, it seemed nothing had changed. I was right back with this error message.

Error applying plan:

1 error(s) occurred:

* ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain

I'm not really sure what else I should have or need for the ssh authentication to work.

3

Chances are you have the wrong sshKey set in your project. Assuming you have something like the following attached to either your provisioner or resource:

resource "google_compute_instance" "my-host" {
  // ...
  connection {
    type        = "ssh"
    agent       = false
    user        = "${var.gce_ssh_user}"
    port        = "${var.gce_ssh_port}"
    timeout     = "5m"
    private_key = "${file("${var.gce_ssh_private_key_file}")}"
  }
  // ...
}

You should be able to verify the project's sshKey:

$ gcloud compute project-info describe

My guess is the sshKey values set part of the project aren't well formed according to GCE. If you step through something like the following you may find the configuration snafu that's causing this problem:

$ gcloud compute project-info describe > project.yaml
$ cat project.yaml| egrep 'ssh-' | awk '{print $1 " " $2 " " $3}' > existing_project_keys.pub
$ awk -v USER="$USER" '{print USER ":" $1 " " $2 " " USER}' .ssh_id_rsa.pub > new_keys.pub
$ cat existing_project_keys.pub >> new_keys.pub
$ gcloud compute project-info add-metadata --metadata-from-file sshKeys=new_keys.pub

(or, it could be something simple like you have too many keys loaded into your agent, which is why I've disabled the agent in the connection above)

  • It was the fact the machine I was attempting to run from had mismatched multiple ssh keys for a multitude of agents. When it came down to it, I grabbed another machine and was able to execute it quickly with your mentioned fix. – Adron Sep 20 '16 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.