# Server provisioning works but deploy doesn't

**URL:** https://discourse.roots.io/t/server-provisioning-works-but-deploy-doesnt/9406
**Category:** trellis
**Created:** 2017-04-18T08:53:35Z
**Posts:** 7

## Post 1 by @aaronjpitts — 2017-04-18T08:53:36Z

Running the server provisioning works and connects fine but when running the deploy script I get the below. Any ideas on what could be wrong? SSH was fine with server provisioning.

Thanks!

```
PLAY [Ensure necessary variables are defined] **********************************************************************************************************
```

TASK [Ensure environment is defined] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
skipping: [localhost]

PLAY [Test Connection] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

TASK [connection : Require manual definition of remote-user] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
skipping: [**.** _.__._\*]

TASK [connection : Specify preferred HostKeyAlgorithms for unknown hosts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
skipping: [**.** _.__._\*]

TASK [connection : Check whether Ansible can connect as web] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [**.** _.__._\* -\> localhost]

TASK [connection : Warn about change in host keys] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
skipping: [**.** _.__._\*]

TASK [connection : Set remote user for each host] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
skipping: [**.** _.__._\*]

TASK [connection : Announce which user was selected] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
skipping: [**.** _.__._\*]

TASK [connection : Load become password] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
skipping: [**.** _.__._\*]

PLAY [Deploy WP site] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

## TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* System info: Ansible 2.3.0.0; Darwin Trellis at “Remove potentially dangerous `db_import` option”

SSH Error: data could not be sent to remote host " **.** _. __.__". Make sure  
this host can be reached over ssh  
fatal: [__._ **.**.\*\*]: UNREACHABLE! =\> {“changed”: false, “unreachable”: true}  
to retry, use: --limit @/Users/aaronpitts/Sites/papayapods/trellis/deploy.retry

PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
**.** _.__._\* : ok=1 changed=0 unreachable=1 failed=0  
localhost : ok=0 changed=0 unreachable=0 failed=0

---

## Post 2 by @nathobson — 2017-04-18T12:52:58Z

Can you manually SSH into the server?

---

## Post 3 by @aaronjpitts — 2017-04-18T13:20:51Z

Yes, and the server playbook connected via SSH and worked. But the deploy playbook no.

Thanks

---

## Post 4 by @fullyint — 2017-04-18T15:13:12Z

Looks like you’re using Ansible 2.3. You’ll probably want to add the Trellis updates for Ansible 2.3 compatibility ([roots/trellis#813](https://github.com/roots/trellis/pull/813)), or just try older Ansible:  
`pip install ansible==2.2.2`

The troubleshooting docs show an example error message that looks similar, possible with a [host key change](https://roots.io/trellis/docs/troubleshooting/#host-key-change), so you might need to clear the server’s host key from your local known\_hosts and try again.

The troubleshooting docs also mention a tip that could potentially provide more [debug information](https://roots.io/trellis/docs/troubleshooting/#debugging):

> Golden rule to debugging any failed command with Ansible:  
> … 3. Re-run the command in verbose mode  
> `ansible-playbook deploy.yml -vvvv -e "site=<domain> env=<environment>"`  
> if necessary to get more details.

---

## Post 5 by @MWDelaney — 2017-04-18T15:15:21Z

For anyone else who finds this thread, Trellis recently added a step to provisioning that regenerates the host’s key and I have yet to remember that when deploying. My first deploy always fails and I panic for 3 seconds until I remember to delete my `known_hosts` entry and try again.

---

## Post 6 by @fullyint — 2017-04-18T16:29:59Z

In other contexts, I’ve heard people express frustration about having to switch to more secure host keys, so here are a few more notes to help people understand and take control of their situation. See also this [overview of SSH keys and known\_hosts](https://discourse.roots.io/t/known-hosts-yml-headaches/8867/4).

* * *

The host key the server offers is based on what your local machine **SSH client** requests and what the **server** is allowed to offer (per its configuration).

Trellis doesn’t cause regeneration of host keys, but the Trellis default configures the server to offer only the most secure host key types (ed25519 or rsa). If you have to change host keys, it means that an older less secure host key type (probably ecdsa type) slipped in to your known\_hosts, probably because you built the server with a Trellis version prior to [roots/trellis#744](https://github.com/roots/trellis/pull/744) (back when the **server** didn’t control key type) or made your first SSH connection to the server manually instead of via Trellis and your **SSH client** didn’t control key type.

You could configure your `~/.ssh/config` SSH client in your local machine to only request secure host key types and never again have an issue (i.e., specify preferred [`HostKeyAlgorithms`](http://manpages.ubuntu.com/manpages/xenial/en/man5/ssh_config.5.html)). If your `ssh -V` shows version 6.5 or newer, you may specify both the ed25519 and rsa types. If older, the rsa types only. ([example lists](https://github.com/roots/trellis/blob/1f165ead7b22d8dd1dd88294ae4d7c71849b5a74/roles/connection/defaults/main.yml#L5)).

Even if you haven’t specified secure `HostKeyAlgorithms` in your own `~/.ssh/config`, Trellis does what it can to prevent host key changes, trying to help you get a secure host key type (ed25519 or rsa) from the very beginning with new servers. There are details in [roots/trellis#798](https://github.com/roots/trellis/pull/798) about how Trellis tries to help you use secure host keys with minimal inconvenience (via a one time `HostKeyAlgorithms` SSH connection option). If your known\_hosts happens to have the less secure ecdsa host key type, it’s a one-time procedure per server to a change to a more secure key for that server (update key type in known\_hosts).

* * *

If someone doesn’t care for security, but only convenience, and doesn’t want to adjust `HostKeyAlgorithms` in `~/.ssh/config`, here is a workaround (not recommended). The `sshd` role README describes how to [customize [the sshd role] via variables](https://github.com/roots/trellis/tree/1f165ead7b22d8dd1dd88294ae4d7c71849b5a74/roles/sshd#customize-via-variables):

> You may redefine any variable found in `templates/sshd_config.j2` or `templates/ssh_config.j2`. The default settings are viewable in `defaults/main.yml`. To override a setting, you could redefine your chosen variable in a file such as `group_vars/all/main.yml` or `group_vars/all/security.yml`.

The relevant variable to redefine in the case of host keys is [`sshd_host_keys`](https://github.com/roots/trellis/blob/1f165ead7b22d8dd1dd88294ae4d7c71849b5a74/roles/sshd/defaults/main.yml#L34-L36). You would need to add back the less secure ecdsa type. Trellis doesn’t regenerate host keys, but this setting tells your server which of its host keys it is allowed to offer SSH clients that are trying to connect. Here is an example of allowing the server to offer the less secure ecdsa host key type:

```
# group_vars/all/main.yml -- this is less secure
sshd_host_keys:
  - /etc/ssh/ssh_host_ecdsa_key
  - /etc/ssh/ssh_host_ed25519_key
  - /etc/ssh/ssh_host_rsa_key
```

---

## Post 7 by @ian — 2019-02-22T07:57:36Z

For me the issue was the server was provided to me from vendor with only port 2224 open. This required [Using Non-standard SSH Port](https://discourse.roots.io/t/using-non-standard-ssh-port/5146/2?u=ian)

```
[production]
12.34.56.67 ansible_ssh_port=2224
```

Then after provisioning I needed to delete the entry in my known hosts and remove `ansible_ssh_port=2224`.

Then all was honky dory.