hashicorp / hashicorp/packer-plugin-amazon
Packer does not properly authenticate via SSH over SSM on Windows
- Dominant language
- Go
- Stars
- 91
- Forks
- 141
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 3
Description
_This issue was originally opened by @create-atl-delete in https://github.com/hashicorp/packer/issues/11199 and has been migrated to this repository. The original issue description is below._
---
#### Overview of the Issue
I'm attempting to use Packer to build Server 2019 AMIs using the SSH communicator running over Session Manager (SSM). Packer consistently errors out like so:
`original error: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain`
If I keep the Packer instance up after this error, I can connect to it via SSH over SSM from Powershell using `ssh -i Administrator@` and providing the password, which I can decrypt using that same certificate in the EC2 console.
This proves that:
1. SSH is enabled and working on the instance per the user_data_file
2. The network configuration (VCP/subnet) are valid
3. The IAM instance profile for SSM is valid
4. The publickey Packer is generating and the ssh_user specified in my build are valid.
From my perspective, Packer has everything it needs to properly authenticate and is failing to so. On the Packer instance, I see the following in the event logs:
- sshd: Did not receive identification string from 127.0.0.1 port 49786
- sshd: Connection closed by authenticating user Administrator 127.0.0.1 port 49851 [preauth]
#### Reproduction Steps
Try the below build or any build using an Amazon Sever 2019 AMI and SSH over SSM. In my testing, the same issue occurs regardless of VPC/subnet and the particular AMI version.
### Packer version
1.74
### Simplified Packer Buildfile
```
>>>Omitted code to filter for and save latest Amazon Server 2019 AMI as data.amazon-ami.server2019
source "amazon-ebs" "stage1" {
source_ami = data.amazon-ami.server2019.id
region = "us-east-1"
instance_type = "t3.large"
ami_name = "packer_stage1"
force_deregister = true
vpc_id = "omitted"
subnet_id = "omitted"
iam_instance_profile = "instance-role"
user_data_file = "./ssh_config.ps1"
communicator = "ssh"
ssh_interface = "session_manager"
ssh_username = "Administrator"
ssh_timeout = "10m"
}
build {
sources = ["source.amazon-ebs.stage1"]
provisioner "powershell" {
inline = [Write-host "Testing"]
}
}
```
### Operating system and Environment details
I'm running Packer from a Windows 10 host with:
- AWSCLI version 2.1.39
- Session-manager-plugin version 1.2.234.0
- OpenSSH version 8.1.1
### Log Fragments and crash.log files
2021/08/11 15:05:24 ui: ==> amazon-ebs.stage1: Waiting for SSH to become available...
2021/08/11 15:05:25 ui: amazon-ebs.stage1: Starting session with SessionId: omitted@domain.com-0c14bf492290fc4e6
2021/08/11 15:05:25 ui: amazon-ebs.stage1: Port 8746 opened for sessionId omitted@domain.com-0c14bf492290fc4e6.
2021/08/11 15:05:25 ui: amazon-ebs.stage1: Waiting for connections...
2021/08/11 15:05:25 ui: amazon-ebs.stage1: Connection accepted for session [omitted@domain.com-0c14bf492290fc4e6]
2021/08/11 15:05:25 packer-plugin-amazon_v1.0.0_x5.0_windows_amd64.exe plugin: 2021/08/11 15:05:25 [INFO] Attempting SSH connection to localhost:8746...
2021/08/11 15:05:25 packer-plugin-amazon_v1.0.0_x5.0_windows_amd64.exe plugin: 2021/08/11 15:05:25 [DEBUG] reconnecting to TCP connection for SSH
2021/08/11 15:05:25 packer-plugin-amazon_v1.0.0_x5.0_windows_amd64.exe plugin: 2021/08/11 15:05:25 [DEBUG] handshaking with SSH
2021/08/11 15:05:25 packer-plugin-amazon_v1.0.0_x5.0_windows_amd64.exe plugin: 2021/08/11 15:05:25 [DEBUG] SSH handshake err: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
2021/08/11 15:05:25 packer-plugin-amazon_v1.0.0_x5.0_windows_amd64.exe plugin: 2021/08/11 15:05:25 [DEBUG] Detected authentication error. Increasing handshake attempts.
...
above few lines repeat several times
...
2021/08/11 15:06:32 ui error: ==> amazon-ebs.stage1: Error waiting for SSH: Packer experienced an authentication error when trying to connect via SSH. This can happen if your username/password are wrong. You may want to double-check your credentials as part of your debugging process. original error: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
Contributor guide
Assessment
This issue has not been assessed yet.