我试图运行这个简单的configuration脚本，但是在运行vagrant up和vagrant provision命令时遇到了错误。
我读到，我需要创build一个/etc/ansible/hosts文件，我已经完成，填充它：
[vagrant] 192.168.222.111
我的SSHconfiguration（删除了一些细节）：
Host default HostName 127.0.0.1 User vagrant Port 2222 UserKnownHostsFile /dev/null StrictHostKeyChecking no PasswordAuthentication no IdentityFile /Users/ashleyconnor/.vagrant.d/insecure_private_key IdentitiesOnly yes LogLevel FATAL Host server HostName XXX.XXX.XXX.XXX User ash PreferredAuthentications publickey IdentityFile ~/.ssh/ash_ovh Host deployer HostName XXX.XXX.XXX.XXX User deployer PreferredAuthentications publickey IdentityFile ~/.ssh/deployer_ovh Host bitbucket.org PreferredAuthentications publickey IdentityFile ~/.ssh/bitbucket Host github.com PreferredAuthentications publickey IdentityFile ~/.ssh/github Host staging HostName 192.168.56.10 User deployer PreferredAuthentications publickey IdentityFile ~/.ssh/id_rsa
我收到的SSH输出似乎通过我所有的密钥stream失：
<192.168.222.111> ESTABLISH CONNECTION FOR USER: vagrant <192.168.222.111> REMOTE_MODULE setup <192.168.222.111> EXEC ['ssh', '-C', '-tt', '-vvv', '-o', 'ControlMaster=auto', '-o', 'ControlPersist=60s', '-o', 'ControlPath=/Users/ashleyconnor/.ansible/cp/ansible-ssh-%h-%p-%r', '-o', 'IdentityFile=/Users/ashleyconnor/.vagrant.d/insecure_private_key', '-o', 'KbdInteractiveAuthentication=no', '-o', 'PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey', '-o', 'PasswordAuthentication=no', '-o', 'User=vagrant', '-o', 'ConnectTimeout=10', '192.168.222.111', "/bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1394317116.44-226619545527061 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1394317116.44-226619545527061 && echo $HOME/.ansible/tmp/ansible-tmp-1394317116.44-226619545527061'"] fatal: [192.168.222.111] => SSH encountered an unknown error. The output was: OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011 debug1: Reading configuration data /Users/ashleyconnor/.ssh/config debug1: Reading configuration data /etc/ssh_config debug1: /etc/ssh_config line 20: Applying options for * debug1: /etc/ssh_config line 53: Applying options for * debug1: auto-mux: Trying existing master debug1: Control socket "/Users/ashleyconnor/.ansible/cp/ansible-ssh-192.168.222.111-22-vagrant" does not exist debug2: ssh_connect: needpriv 0 debug1: Connecting to 192.168.222.111 [192.168.222.111] port 22. debug2: fd 3 setting O_NONBLOCK debug1: fd 3 clearing O_NONBLOCK debug1: Connection established. debug3: timeout: 10000 ms remain after connect debug3: Incorrect RSA1 identifier debug3: Could not load "/Users/ashleyconnor/.vagrant.d/insecure_private_key" as a RSA1 public key debug1: identity file /Users/ashleyconnor/.vagrant.d/insecure_private_key type -1 debug1: identity file /Users/ashleyconnor/.vagrant.d/insecure_private_key-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.2 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9p1 Debian-5ubuntu1 debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1 pat OpenSSH_5* debug2: fd 3 setting O_NONBLOCK debug3: load_hostkeys: loading entries for host "192.168.222.111" from file "/Users/ashleyconnor/.ssh/known_hosts" debug3: load_hostkeys: found key type RSA in file /Users/ashleyconnor/.ssh/known_hosts:20 debug3: load_hostkeys: loaded 1 keys debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],[email protected],ssh-rsa debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: [email protected],[email protected],ssh-rsa,[email protected],[email protected],ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: [email protected],zlib,none debug2: kex_parse_kexinit: [email protected],zlib,none debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256 debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,[email protected] debug2: kex_parse_kexinit: none,[email protected] debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: mac_setup: found hmac-md5 debug1: kex: server->client aes128-ctr hmac-md5 [email protected] debug2: mac_setup: found hmac-md5 debug1: kex: client->server aes128-ctr hmac-md5 [email protected] debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug2: dh_gen_key: priv key bits set: 119/256 debug2: bits set: 527/1024 debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Server host key: RSA 50:db:75:ba:11:2f:43:c9:ab:14:40:6d:7f:a1:ee:e3 debug3: load_hostkeys: loading entries for host "192.168.222.111" from file "/Users/ashleyconnor/.ssh/known_hosts" debug3: load_hostkeys: found key type RSA in file /Users/ashleyconnor/.ssh/known_hosts:20 debug3: load_hostkeys: loaded 1 keys debug1: Host '192.168.222.111' is known and matches the RSA host key. debug1: Found key in /Users/ashleyconnor/.ssh/known_hosts:20 debug2: bits set: 511/1024 debug1: ssh_rsa_verify: signature correct debug2: kex_derive_keys debug2: set_newkeys: mode 1 debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug2: set_newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug2: key: /Users/ashleyconnor/.ssh/id_rsa (0x7fc212600540), debug2: key: /Users/ashleyconnor/.ssh/bitbucket (0x7fc212600730), debug2: key: /Users/ashleyconnor/.ssh/deployer (0x7fc212600a00), debug2: key: /Users/ashleyconnor/.ssh/github (0x7fc212600c80), debug2: key: /Users/ashleyconnor/.ssh/ash_ovh (0x7fc212601010), debug2: key: /Users/ashleyconnor/.ssh/deployer_ovh (0x7fc2126011e0), debug2: key: /Users/ashleyconnor/.vagrant.d/insecure_private_key (0x0), explicit debug1: Authentications that can continue: publickey,password debug3: start over, passed a different list publickey,password debug3: preferred gssapi-with-mic,gssapi-keyex,hostbased,publickey debug3: authmethod_lookup publickey debug3: remaining preferred: ,gssapi-keyex,hostbased,publickey debug3: authmethod_is_enabled publickey debug1: Next authentication method: publickey debug1: Offering RSA public key: /Users/ashleyconnor/.ssh/id_rsa debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply debug1: Authentications that can continue: publickey,password debug1: Offering RSA public key: /Users/ashleyconnor/.ssh/bitbucket debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply debug1: Authentications that can continue: publickey,password debug1: Offering RSA public key: /Users/ashleyconnor/.ssh/deployer debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply debug1: Authentications that can continue: publickey,password debug1: Offering RSA public key: /Users/ashleyconnor/.ssh/github debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply debug1: Authentications that can continue: publickey,password debug1: Offering RSA public key: /Users/ashleyconnor/.ssh/ash_ovh debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply debug1: Authentications that can continue: publickey,password debug1: Offering RSA public key: /Users/ashleyconnor/.ssh/deployer_ovh debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply Received disconnect from 192.168.222.111: 2: Too many authentication failures for vagrant
vagrant ssh命令正常工作。
根据ssh-config(5) ，除了任何身份文件，ssh将总是尝试代理已知的所有密钥：
IdentitiesOnly Specifies that ssh(1) should only use the authentication identity files configured in the ssh_config files, even if ssh-agent(1) offers more identities. The argument to this keyword must be “yes” or “no”. This option is intended for situations where ssh-agent offers many different identities. The default is “no”. IdentityFile Specifies a file from which the user's DSA, ECDSA or DSA authentication identity is read. The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/id_rsa for protocol version 2. Additionally, any identities represented by the authentication agent will be used for authentication. ssh(1) will try to load certificate information from the filename obtained by appending -cert.pub to the path of a specified IdentityFile.
为了防止这种情况，除了明确提供的私钥之外，还必须指定IdentitiesOnly=yes 。
例如，运行下面的ssh命令：
$ ssh -i /home/henk/.vagrant.d/insecure_private_key \ [email protected] echo ok
生产：
Received disconnect from 192.168.222.111: 2: Too many authentication failures for vagrant
但是，运行相同的ssh命令，另外指定IdentitiesOnly=yes ：
$ ssh -o IdentitiesOnly=yes \ -i /home/henk/.vagrant.d/insecure_private_key [email protected] echo ok
生产：
ok
所以我在我的ssh-agent有5个密钥，尽pipe使用vagrant ssh密钥的明确选项仍然坚持循环通过代理中的密钥，然后在到达正确的密钥之前方便地到达max_try。
检查你是否有这个问题：运行ssh-add -l – 如果这个列表大于5，你需要删除密钥或禁用代理。
修复：运行ssh-add -d ~/.ssh/X ，其中X是要删除的密钥。
在我尝试了所有的build议之后，我没有成功，我意识到我的问题是新的身份validation方法（GSSAPI），它总是不成功。
我通过编辑~/.ssh/config文件解决了这个问题：
Host * GSSAPIAuthentication no
希望这也有助于某人。
你的ssh-agent拥有比ssh服务器允许进行authentication尝试（“MaxAuthTries”，默认值：6）更多的密钥。
请注意，某些ssh代理（特别是GNOME密钥环）会自动加载在〜/ .ssh中find的所有密钥，而且这些密钥不能用“ssh-add – [dD]”加载。
以下是一些解决scheme：
unset SSH_AUTH_SOCK或者使用“IdentitiesOnly = yes”作为@ henk-langeveldbuild议的 使用快速修复命令连接服务器：
ssh -o IdentitiesOnly=yes -i ~/.ssh/private_key_or_pem_file_name server_user_name@ip_OR_hostname echo ok
推荐的方法如下所述：
但是如果你有capistrano receipes或其他连接你的ssh服务器的软件，那么你必须按照下面提到的正确的方法来修复：
在〜/ .ssh / config文件中提到服务器configuration中的“IdentitiesOnly yes”选项
Host server_domain_OR_ip server_name_your_choice User server_user_name Hostname server_domain_OR_ip RSAAuthentication yes Compression yes IdentityFile ~/.ssh/private_key_OR_pem_file IdentitiesOnly yes Port 22
private_key_OR_pem_file：如果pem文件提及扩展名“.pem”
关键信息是
Received disconnect from 192.168.222.111: 2: Too many authentication failures for vagrant
您将vagrant ssh-config输出作为默认主机复制到.ssh/config但由于它具有冲突的参数（主机名，端口），因此会跳过此选项。 没有匹配的条目，ssh将只是尝试所有可以find的键。
用-i选项再次testingssh尝试
$ ssh -i $HOME/.vagrant.d/insecure_private_key [email protected] echo ok
我相信这是你如何在Ansible清单中指定的：
[vagrant] 192.168.222.111 ansible_ssh_private_key_file=/.../.vagrant.d/insecure_private_key
缩写可读性的path
原始答案：
将vagrant ssh-config的输出与.ssh/config的vagrant条目进行比较。 确保私钥path完全匹配。
还要validation密钥文件不能被任何其他帐户访问。 我们都知道这个关键是什么，但是SSH不知道这个东西是否是公共知识，并且试图保护我们免于使用可能被危害的密钥。