Fabric asks for password even though I can SSH using credential

Question

I'm having an odd problem while deploying a Django site using Fabric. I've configured two servers to use key files for login. I can SSH into both without a password. I can run fab on one correctly,

$ fab live pull
[mysite.com] Executing task 'pull'
[mysite.com] run: test -d proj
[mysite.com] run: test -d proj/.git
[mysite.com] run: git pull origin master
...

while the other server asks for a password:

$ fab staging pull
[dev.mysite.com] Executing task 'pull'
[dev.mysite.com] run: test -d proj
[dev.mysite.com] Login password: 

The fabfile is set up pretty explicitly

def staging():
    env.hosts = ['dev.mysite.com']
    env.user = 'bamboo'
    env.key_filename = '~/.ssh/id_dsa_bamboo'

And running ssh directly from the command line works

$ ssh [email protected] -i ~/.ssh/id_dsa_bamboo
Last login: Wed Apr 11 06:24:28 2012 from xxx.xxx.xx.xx
[bamboo@dev ~]$ 

I also tried setting env.use_ssh_config = True and running with ~/.ssh/config set to

Host dev.mysite.com                                                                           
    User bamboo                                                                              
    IdentityFile ~/.ssh/id_dsa_bamboo                                                        
    ForwardAgent yes

Any ideas what could be going on? Thanks for the help.

Indigested

Very similar here. I've could run all my tasks successfully yesterday and even today but suddenly fabric starts asking me for password. – Leflore

Can anyone list possible cause for this please – Dependent

Answer 1

You can add:

ssh.util.log_to_file("paramiko.log", 10)

To the top of your fabfile, after the imports, to get more detailed information about the authorization process.

Aalesund

Great, thanks for this. Pointed to me that paramiko doesn't support keys of type ssh-ed25519. Second gotcha is that you'll also need to ensure the remote server presents a rsa key as well as providing one as an identity file – Cruse

Answer 2

For me, I had to reset SSH agent identities with:

ssh-add -D

Then add my key back with:

ssh-add -K keyname

Careful, this will delete all identities from SSH agent.

Swafford

ssh-add was sufficient for me. – Allveta

Answer 3

I had to update fabric (probably after osx update):

sudo pip install --upgrade fabric

Overdraft

Answer 4

In my case, I was unable to see anything helpful in the log files. I was able to connect, however, after first connecting to the server using ssh and enabling ssh-agent forwarding:

ssh -A <user>@<host>

Then I ran fab and was connected without being asked for a password as expected.

Ketene