hashicorp / hashicorp/packer-plugin-amazon

Packer does not properly authenticate via SSH over SSM on Windows

Open
#123 5 comments 1 reaction 0 assignees View on GitHub
docs ssm
Dominant language
Go
Stars
91
Forks
141
Avg merge
2d 18h
Merged PRs (30d)
3

Description

_This issue was originally opened by @create-atl-delete in https://github.com/hashicorp/packer/issues/11199 and has been migrated to this repository. The original issue description is below._

---
#### Overview of the Issue

I'm attempting to use Packer to build Server 2019 AMIs using the SSH communicator running over Session Manager (SSM). Packer consistently errors out like so:

`original error: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain`

If I keep the Packer instance up after this error, I can connect to it via SSH over SSM from Powershell using `ssh -i Administrator@` and providing the password, which I can decrypt using that same certificate in the EC2 console.

This proves that:
1. SSH is enabled and working on the instance per the user_data_file
2. The network configuration (VCP/subnet) are valid
3. The IAM instance profile for SSM is valid
4. The publickey Packer is generating and the ssh_user specified in my build are valid.

From my perspective, Packer has everything it needs to properly authenticate and is failing to so. On the Packer instance, I see the following in the event logs:
- sshd: Did not receive identification string from 127.0.0.1 port 49786
- sshd: Connection closed by authenticating user Administrator 127.0.0.1 port 49851 [preauth]

#### Reproduction Steps

Try the below build or any build using an Amazon Sever 2019 AMI and SSH over SSM. In my testing, the same issue occurs regardless of VPC/subnet and the particular AMI version.

### Packer version

1.74

### Simplified Packer Buildfile

```
>>>Omitted code to filter for and save latest Amazon Server 2019 AMI as data.amazon-ami.server2019

source "amazon-ebs" "stage1" {
source_ami = data.amazon-ami.server2019.id
region = "us-east-1"
instance_type = "t3.large"
ami_name = "packer_stage1"
force_deregister = true
vpc_id = "omitted"
subnet_id = "omitted"
iam_instance_profile = "instance-role"
user_data_file = "./ssh_config.ps1"
communicator = "ssh"
ssh_interface = "session_manager"
ssh_username = "Administrator"
ssh_timeout = "10m"
}

build {
sources = ["source.amazon-ebs.stage1"]
provisioner "powershell" {
inline = [Write-host "Testing"]
}
}
```

### Operating system and Environment details

I'm running Packer from a Windows 10 host with:
- AWSCLI version 2.1.39
- Session-manager-plugin version 1.2.234.0
- OpenSSH version 8.1.1

### Log Fragments and crash.log files

2021/08/11 15:05:24 ui: ==> amazon-ebs.stage1: Waiting for SSH to become available...
2021/08/11 15:05:25 ui: amazon-ebs.stage1: Starting session with SessionId: omitted@domain.com-0c14bf492290fc4e6
2021/08/11 15:05:25 ui: amazon-ebs.stage1: Port 8746 opened for sessionId omitted@domain.com-0c14bf492290fc4e6.
2021/08/11 15:05:25 ui: amazon-ebs.stage1: Waiting for connections...
2021/08/11 15:05:25 ui: amazon-ebs.stage1: Connection accepted for session [omitted@domain.com-0c14bf492290fc4e6]
2021/08/11 15:05:25 packer-plugin-amazon_v1.0.0_x5.0_windows_amd64.exe plugin: 2021/08/11 15:05:25 [INFO] Attempting SSH connection to localhost:8746...
2021/08/11 15:05:25 packer-plugin-amazon_v1.0.0_x5.0_windows_amd64.exe plugin: 2021/08/11 15:05:25 [DEBUG] reconnecting to TCP connection for SSH
2021/08/11 15:05:25 packer-plugin-amazon_v1.0.0_x5.0_windows_amd64.exe plugin: 2021/08/11 15:05:25 [DEBUG] handshaking with SSH
2021/08/11 15:05:25 packer-plugin-amazon_v1.0.0_x5.0_windows_amd64.exe plugin: 2021/08/11 15:05:25 [DEBUG] SSH handshake err: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
2021/08/11 15:05:25 packer-plugin-amazon_v1.0.0_x5.0_windows_amd64.exe plugin: 2021/08/11 15:05:25 [DEBUG] Detected authentication error. Increasing handshake attempts.
...
above few lines repeat several times
...
2021/08/11 15:06:32 ui error: ==> amazon-ebs.stage1: Error waiting for SSH: Packer experienced an authentication error when trying to connect via SSH. This can happen if your username/password are wrong. You may want to double-check your credentials as part of your debugging process. original error: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.