Início / unix / Perguntas / 784713
Accepted
Stefan Lelieveld
Asked: 2024-10-08 16:03:00 +0800 CST

Acesso Ansible ao servidor EL9 após ele ter sido 'ELevado' do EL8

  • 772

Obrigado por reservar um tempo e dar uma olhada,

Recentemente, elevei (projeto AlmaLinux ELevate) 3 servidores do AlmaLinux 8 para o AlmaLinux 9 (2 anos atrás, esses mesmos servidores foram elevados do CentOS 7 para o AlmaLinux 8). A atualização funcionou perfeitamente e, após a atualização, só precisei reinstalar 1 pacote, Zabbix-Agent2. Consegui acessar os serviços em execução nesses servidores, os sites estavam perfeitamente acessíveis, via SSH, consegui acessar o sistema sem problemas. Até mesmo o ansibleuser pôde ser usado para uma autenticação ssh de par de chaves sem problemas. Mas quando uso o ansible para executar um playbook nesses servidores que funcionou Always no passado e ainda funciona em todas as nossas outras máquinas Ubuntu e AlmaLinux, recebo os seguintes erros nas 3 máquinas em questão:

[ /etc/ansible ]$ ansible-playbook playbooks/update-linux.yml -C -l ClamAV -vvv
ansible-playbook [core 2.14.14]
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/ansibleuser/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.9/site-packages/ansible
  ansible collection location = /home/ansibleuser/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible-playbook
  python version = 3.9.18 (main, Aug 23 2024, 00:00:00) [GCC 11.4.1 20231218 (Red Hat 11.4.1-3)] (/usr/bin/python3)
  jinja version = 3.1.2
  libyaml = True
Using /etc/ansible/ansible.cfg as config file
BECOME password: 
[WARNING]: Error in vault password file loading (default): A vault password must be specified to decrypt data
Vault password: 
host_list declined parsing /etc/ansible/hosts as it did not pass its verify_file() method
script declined parsing /etc/ansible/hosts as it did not pass its verify_file() method
auto declined parsing /etc/ansible/hosts as it did not pass its verify_file() method
Parsed /etc/ansible/hosts inventory source with yaml plugin
Skipping callback 'default', as we already have a stdout callback.
Skipping callback 'minimal', as we already have a stdout callback.
Skipping callback 'oneline', as we already have a stdout callback.

PLAYBOOK: update-linux.yml *******************************************************************************************************************************
2 plays in playbooks/update-linux.yml

PLAY [landauer] ******************************************************************************************************************************************

TASK [Gathering Facts] ***********************************************************************************************************************************
task path: /etc/ansible/playbooks/update-linux.yml:2
<10.1.1.22> ESTABLISH SSH CONNECTION FOR USER: ansibleuser
<10.1.1.22> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="ansibleuser"' -o ConnectTimeout=5 -o 'ControlPath="/home/ansibleuser/.ansible/cp/267bb41463"' 10.1.1.22 '/bin/sh -c '"'"'echo ~ansibleuser && sleep 0'"'"''
<10.1.1.22> (0, b'/home/ansibleuser\n', b'')
<10.1.1.22> ESTABLISH SSH CONNECTION FOR USER: ansibleuser
<10.1.1.22> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="ansibleuser"' -o ConnectTimeout=5 -o 'ControlPath="/home/ansibleuser/.ansible/cp/267bb41463"' 10.1.1.22 '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo /home/ansibleuser/.ansible/tmp `"&& mkdir "` echo /home/ansibleuser/.ansible/tmp/ansible-tmp-1728362452.3175566-4768-111779545868462 `" && echo ansible-tmp-1728362452.3175566-4768-111779545868462="` echo /home/ansibleuser/.ansible/tmp/ansible-tmp-1728362452.3175566-4768-111779545868462 `" ) && sleep 0'"'"''
<10.1.1.22> (0, b'ansible-tmp-1728362452.3175566-4768-111779545868462=/home/ansibleuser/.ansible/tmp/ansible-tmp-1728362452.3175566-4768-111779545868462\n', b'')
<ClamAV> Attempting python interpreter discovery
<10.1.1.22> ESTABLISH SSH CONNECTION FOR USER: ansibleuser
<10.1.1.22> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="ansibleuser"' -o ConnectTimeout=5 -o 'ControlPath="/home/ansibleuser/.ansible/cp/267bb41463"' 10.1.1.22 '/bin/sh -c '"'"'echo PLATFORM; uname; echo FOUND; command -v '"'"'"'"'"'"'"'"'python3.11'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python3.10'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python3.9'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python3.8'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python3.7'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python3.6'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python3.5'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'/usr/bin/python3'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'/usr/libexec/platform-python'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python2.7'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'/usr/bin/python'"'"'"'"'"'"'"'"'; command -v '"'"'"'"'"'"'"'"'python'"'"'"'"'"'"'"'"'; echo ENDFOUND && sleep 0'"'"''
<10.1.1.22> (0, b'PLATFORM\nLinux\nFOUND\n/usr/bin/python3.9\n/usr/bin/python3\n/usr/libexec/platform-python\n/usr/bin/python\n/usr/bin/python\nENDFOUND\n', b'')
<10.1.1.22> ESTABLISH SSH CONNECTION FOR USER: ansibleuser
<10.1.1.22> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="ansibleuser"' -o ConnectTimeout=5 -o 'ControlPath="/home/ansibleuser/.ansible/cp/267bb41463"' 10.1.1.22 '/bin/sh -c '"'"'/usr/bin/python3.9 && sleep 0'"'"''
<10.1.1.22> (0, b'{"platform_dist_result": [], "osrelease_content": "NAME=\\"AlmaLinux\\"\\nVERSION=\\"9.4 (Seafoam Ocelot)\\"\\nID=\\"almalinux\\"\\nID_LIKE=\\"rhel centos fedora\\"\\nVERSION_ID=\\"9.4\\"\\nPLATFORM_ID=\\"platform:el9\\"\\nPRETTY_NAME=\\"AlmaLinux 9.4 (Seafoam Ocelot)\\"\\nANSI_COLOR=\\"0;34\\"\\nLOGO=\\"fedora-logo-icon\\"\\nCPE_NAME=\\"cpe:/o:almalinux:almalinux:9::baseos\\"\\nHOME_URL=\\"https://almalinux.org/\\"\\nDOCUMENTATION_URL=\\"https://wiki.almalinux.org/\\"\\nBUG_REPORT_URL=\\"https://bugs.almalinux.org/\\"\\n\\nALMALINUX_MANTISBT_PROJECT=\\"AlmaLinux-9\\"\\nALMALINUX_MANTISBT_PROJECT_VERSION=\\"9.4\\"\\nREDHAT_SUPPORT_PRODUCT=\\"AlmaLinux\\"\\nREDHAT_SUPPORT_PRODUCT_VERSION=\\"9.4\\"\\nSUPPORT_END=2032-06-01\\n"}\n', b'')
Using module file /usr/lib/python3.9/site-packages/ansible/modules/setup.py
<10.1.1.22> PUT /home/ansibleuser/.ansible/tmp/ansible-local-47643ehs1jje/tmprhb1042q TO /home/ansibleuser/.ansible/tmp/ansible-tmp-1728362452.3175566-4768-111779545868462/AnsiballZ_setup.py
<10.1.1.22> SSH: EXEC scp -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="ansibleuser"' -o ConnectTimeout=5 -o 'ControlPath="/home/ansibleuser/.ansible/cp/267bb41463"' /home/ansibleuser/.ansible/tmp/ansible-local-47643ehs1jje/tmprhb1042q '[10.1.1.22]:/home/ansibleuser/.ansible/tmp/ansible-tmp-1728362452.3175566-4768-111779545868462/AnsiballZ_setup.py'
<10.1.1.22> ESTABLISH SSH CONNECTION FOR USER: ansibleuser
<10.1.1.22> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="ansibleuser"' -o ConnectTimeout=5 -o 'ControlPath="/home/ansibleuser/.ansible/cp/267bb41463"' 10.1.1.22 '/bin/sh -c '"'"'rm -f -r /home/ansibleuser/.ansible/tmp/ansible-tmp-1728362452.3175566-4768-111779545868462/ > /dev/null 2>&1 && sleep 0'"'"''
<10.1.1.22> (0, b'', b'')
fatal: [ClamAV]: UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via scp: Connection closed\r\n",
    "unreachable": true
}

No exemplo usei o servidor ClamAV, mas em outros 2 servidores tive o mesmo problema.

As outras máquinas AlmaLinux em nossa configuração foram instaladas do zero com o AlmaLinux9 e o manual funcionam bem.

Também notei que ao executar o DNF ele me dá 1 aviso: warning: Signature not supported. Hash algorithm SHA1 not available. Já encontrei um artigo sobre isso no redHat explicando que com o comando: "update-crypto-policies --set FUTURE" eu poderia definir o servidor para a política de criptografia SHA256/512 mais recente. Mas então eu perco TODAS as comunicações possíveis para esse servidor, exceto HTTP(s) e console físico (via vCenter). Acho que deve ser algo relacionado a isso, ou preciso regenerar algo. Mas há alguém que já encontrou uma solução/thread para me ajudar a resolver o problema? Tenho mais 2 servidores para fazer que são um pouco mais críticos para a empresa, então não quero que eles sofram muito tempo com esse problema.

Muito obrigado por qualquer ajuda.

ansible

1 respostas

  1. Best Answer

    Ah, encontrei uma diferença no arquivo sshd_config: Na máquina mais antiga do CentOS para EL8 --> EL9 atualizada, a linha: Subsystem sftp /usr/lib/openssh/sftp-server e nas outras máquinas AlmaLinux recém-instaladas, está definida como: Subsystem sftp internal-sftp, depois de alterar o parâmetro e reiniciar o serviço, ele voltou a funcionar como deveria. Quero agradecer ao Fórum AlmaLinux pelas dicas fornecidas.

    • 1

relate perguntas