Vagrant requires vagrant user password on any vm interaction

[EvanK]

Installed evolve wp 1.0.15 and wp 4.2.2 on osx with vagrant 1.7.2

Perhaps there is something I'm not doing with passwords/keys that I should be.
All new provisions of evolve require a vagrant password when interacting with the vm. Whether shell or not for instance, vagrant reload asks for password before allowing :

Text will be echoed in the clear. Please install the HighLine or Termios libraries to suppress echoed text.
vagrant@127.0.0.1's password:

Using cap staging evolve:down same thing. It won't import the database or rsync the files until I authenticate as the vagrant user.

Maybe not symptomatic of evolve, but I thought either the insecure_key or evolve key was being placed in root/vagrant user for password-less operations.

Thanks for any help you can provide.

[EvanK]

I know that, in the Vagrantfile, we currently have ssh.insert_key set to false and ssh.forward_agent set to true, to allow us seamless access with the vagrant insecure public keys.

I removed said insecure key from my authorized_hosts file (on my osx host machine), but was unable to reproduce this...but the capistrano tasks should be using your generated deploy keypair. Can you confirm that:

1. you have a keypair in your project: ./lib/ansible/files/ssh/
2. the same keypair is in your vagrant machine at /home/deploy/.ssh/
3. the public key is in your vagrant machine's /home/deploy/.ssh/authorized_keys

[mcheck]

Yes, I can confirm 1,2,3. As long as I can get the server provisioned. Provisioning has stopped working for me.

My vagrant_insecure_key is not in my host's (real, not virtual) authorized_keys file, should it be?

Once I get a server provisioned, either virtual local or virtual on Digital Ocean, I can confirm that the deploy keys are being used to log in to the server, but when it communicates with the local server, it asks for a password as above.

Moreso, I've noticed that on my laptop, I cannot provision servers any longer. This may have something to do with it the vagrant_insecure_key. There is some combination of ansible and vagrant that is having trouble on provision. With either: vg provision local or cap local evolve:provision I get:
TypeError: run() got an unexpected keyword argument 'vault_password'

So maybe different issues, but they seem related. Sorry so ambiguous, I appreciate your helping me resolve this. Any Error logs I can send?

[mcheck]

Ok I see that the Vagrantfile in each of a different Evolution version is different:
v 1.0.15 has config.ssh.insert_key = false
v1.0.12 does not

v1.0.12 still asks me for the vagrant@127.0.0.1 password:
but v1.0.15 will not provision, giving me the vault_password issue from ansible on vagrant up.

So it appears that the 1.0.15 did NOT insert a private key, but 1.0.12 did.
v1.0.12 vagrant ssh-config:

Host local
  HostName 127.0.0.1
  User vagrant
  Port 3173
  UserKnownHostsFile /dev/null
  StrictHostKeyChecking no
  PasswordAuthentication no
  IdentityFile /Users/mcheck/clients/elem.com/.vagrant/machines/local/virtualbox/private_key
  IdentitiesOnly yes
  LogLevel FATAL
  ForwardAgent yes

v1.0.15 vagrant ssh-config:

Host local
  HostName 127.0.0.1
  User vagrant
  Port 6386
  UserKnownHostsFile /dev/null
  StrictHostKeyChecking no
  PasswordAuthentication no
  IdentityFile /Users/mcheck/.vagrant.d/insecure_private_key
  IdentitiesOnly yes
  LogLevel FATAL
  ForwardAgent yes

[mcheck]

Is is possible that vagrant no longer ships with the insecure_public_key in the vagrant authorized_keys file? I do not se it in there, but I'm not sure if it is supposed to be.

[mcheck]

Here is the trace I get from ansible 1.9.1 running vagrant provision:

mcheck@MRTEENY:bam.com (2.2.1@evolve)(master) $ vagrant provision local
==> local: Running provisioner: hostmanager...
==> local: Running provisioner: ansible...
PYTHONUNBUFFERED=1 ANSIBLE_FORCE_COLOR=true ANSIBLE_HOST_KEY_CHECKING=false ANSIBLE_SSH_ARGS='-o UserKnownHostsFile=/dev/null -o ForwardAgent=yes -o ControlMaster=auto -o ControlPersist=60s' ansible-playbook --private-key=/Users/mcheck/.vagrant.d/insecure_private_key --user=vagrant --connection=ssh --limit='local' --inventory-file=lib/ansible/hosts --extra-vars={"stage":"local"} lib/ansible/provision.yml
Traceback (most recent call last):
  File "/opt/local/bin/ansible-playbook", line 324, in <module>
    sys.exit(main(sys.argv[1:]))
  File "/opt/local/bin/ansible-playbook", line 157, in main
    inventory = ansible.inventory.Inventory(options.inventory, vault_password=vault_pass)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/ansible/inventory/__init__.py", line 149, in __init__
    host.vars = utils.combine_vars(host.vars, self.get_host_variables(host.name, vault_password=self._vault_password))
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/ansible/inventory/__init__.py", line 448, in get_host_variables
    self._vars_per_host[hostname] = self._get_host_variables(hostname, vault_password=vault_password)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/ansible/inventory/__init__.py", line 460, in _get_host_variables
    vars_results = [ plugin.run(host, vault_password=vault_password) for plugin in self._vars_plugins if hasattr(plugin, 'run')]
TypeError: run() got an unexpected keyword argument 'vault_password'
Ansible failed to complete successfully. Any error output should be
visible above. Please fix these errors and try again.

[mcheck]

And, I noticed that the ansible install moved from inside the vagrant in about 1.0.12 to the host in 1.0.15 (or so) which may be why I can no longer provision this vm. Are there specific dependencies that my host ansible might need that are not provided? Running 1.9.1 from macports.

I understand this is likely an ansible issue and I will cross post in ansible/ansible, but the vault_password issue does not happen when installing from inside the vagrant, and I need to get a handle on how evolution/wordpress is using group_vars and passwords to see if this is causing an issue.

[EvanK]

Can you add the following line after ansible.extra_vars in your Vagrantfile:

ansible.verbose = "vvvv"

That should turn on a lot of debugging info

[EvanK]

@mcheck I've ripped out ssh customizations from the Vagrantfile that I think will fix the issue:

• Vagrant 1.6 or lower should invoke ansible with the insecure public key at ~/.vagrant.d/insecure_private_key
• Vagrant 1.7 or higher should invoke it with the dynamically generated key at ./.vagrant/machines/local/virtualbox/private_key

Can you test this by applying these changes to your vagrantfile and destroying/recreating your local?

[mcheck]

Posting this in the event someone stumbles across the error.

I've found that all the vault_pass and vault_password issues were a result of ansible being poorly installed on my machines. I'm sorry to have caused confusion, but happy it is solved.

I had installed python2.7 and ansible with MacPorts. It turns out that somewhere in a previous python install (2.x long since gone from system), I had installed ansible version 1.3.3 or so.

Even though the current ansible install 1.9.1 would install correctly, and work with most uses, I would get provisioning errors referring to vault_password when used in evolution. Turns out that the 1.3.3 version left a bunch of detritus around that was never properly deleted or versioned out with later install.

Simple solution:

• uninstall ansible and dependents

sudo port uninstall --follow-dependents ansible

• delete all references to the previous install

cd /opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages
rm -fr ansible ansible-*

• reinstall ansible

sudo port install ansible

Voila!

[EvanK]

That's good to know, as I was totally confused about the vault stuff!

[mcheck]

Yes, thanks for helping. I only tracked it down when looking for the vault_password issue and found several people on the ansible dev team that had issues waaaay back when upgrading from one version to another after vault_pass was introduced.

Along this thread, I have tested the changes merged to remove ssh customization it works perfectly. Password-less syncing works great. I'm getting an rsync error updating timestamps when trying to update the remote files cap staging evolve:up:files, I'll open a ticket.