Ansible ping模块执行失败，SSH连接权限被拒求助

Let’s work through this SSH permission issue step by step—since Ansible relies entirely on SSH to communicate with hosts, we need to first rule out basic SSH connectivity problems before digging into Ansible-specific configs.

Step 1: Verify Manual SSH Connectivity #

First, test if you can manually connect to both hosts via SSH—this will tell us if the problem is with SSH itself or Ansible:

• For the local host:

  ssh root@127.0.0.1
  

• For the remote web host:

  ssh root@10.0.0.112
  

If either of these commands fails with the same Permission denied error, the issue is with your SSH setup, not Ansible. Let’s cover the most common fixes below.

Common Causes & Fixes #

1. Root SSH Login Is Disabled #

Most Linux distributions disable root remote login by default for security. Check the SSH daemon config on your target hosts:

1. Open /etc/ssh/sshd_config with a text editor (e.g., nano /etc/ssh/sshd_config)
2. Look for the PermitRootLogin directive:
   • If it’s set to no: Root can’t log in remotely at all
   • If it’s set to prohibit-password: Root can only log in via SSH keys, not password
3. To allow root password login (note: this is less secure, but useful for testing), change it to:

   PermitRootLogin yes
   

4. Restart the SSH service to apply changes:

   # For systemd-based systems (like Ubuntu 16.04+)
   systemctl restart sshd
   # For older Ubuntu/Debian
   service ssh restart
   

2. No SSH Key Pair Configured & No Password Provided #

Ansible defaults to SSH key authentication. If you haven’t set up key-based login and aren’t supplying a password, it’ll fail. Here are two fixes:

Option A: Set Up SSH Key Authentication

1. Generate a key pair (if you don’t already have one):

   ssh-keygen
   

   Press Enter through all prompts to use default settings.
2. Copy your public key to the target hosts:

   # Local host
   ssh-copy-id root@127.0.0.1
   # Remote web host
   ssh-copy-id root@10.0.0.112
   

3. Now re-run your Ansible ping command—it should use the key to authenticate.

Option B: Supply Password in the Ansible Command

Add the --ask-pass flag to your command to prompt for the root password:

ansible all -m ping -vv --ask-pass

3. Root Password Is Missing or Incorrect #

• If the root user on either host doesn’t have a password set, SSH will block password-based login. Set a password with:

  passwd root
  

• Double-check that you’re using the correct root password when prompted or for key setup.

4. Network/Firewall Blocking SSH #

While your error says "Permission denied," it’s worth confirming the SSH port (22) is reachable:

• Test connectivity to the remote host:

  nc -zv 10.0.0.112 22
  

If this fails, check the firewall on the remote host (e.g., ufw status on Ubuntu) to ensure port 22 is open.

Final Check #

After fixing the SSH issue, re-run your original Ansible command:

ansible all -m ping -vv

It should now succeed if the underlying SSH connectivity is working.

内容的提问来源于stack exchange，提问作者user4017080