Dear Maintainer,

ansible is a configuration management tool for running lots of servers.  The standard way it works is connecting to all the servers via ssh.  If ssh is firejailed, then it fails to connect:

$ ansible-playbook -v -i managedserver.com, provision.yml
Using /home/hans/code/fdroid/fdroid-bootstrap-buildserver/ansible.cfg as config file

PLAY [all] ***********************************************************************************************************

TASK [Gathering Facts] ***********************************************************************************************


fatal: [managedserver.com]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: Host key fingerprint is SHA256:ruzofPZnPu/YqpeQ4PwtCYi+ygiEOkUAAkXUpgdmgDQ\n+---[ECDSA 256]---+\n|@E+.             |\n|o.= o            |\n| o.+             |\n|... . .          |\n|...o + .S.       |\n|o.. . +.o        |\n|+.     o.+ .     |\n|+... oo.+ Bo     |\n|oo.o+++.oB+=+    |\n+----[SHA256]-----+", "unreachable": true}

PLAY RECAP ***********************************************************************************************************
managedserver.com                : ok=0    changed=0    unreachable=1    failed=0



Looking at firejail --list, it is possible to see the full command line:

1142:hans::/usr/bin/firejail /usr/bin/ssh -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=root -o ConnectTimeout=10 -o ControlPath=/home/hans/.ansible/cp/95eb452bcd managedserver.com /bin/sh -c 'echo ~root && sleep 0'

I tried adding this to /etc/firejail/ssh.local, but it didn't change anything:

noblacklist ${HOME}/.ansible/cp


A UNIX socket is opened up in taht directory.  Perhaps there is some restriction on UNIX domain sockets that I'm missing?

That won't have any effect, as I couldn't find a corresponding blacklist
line in /etc/firejail/ (except you added it in one of your local profiles).

Unix sockets should be allowed for ssh ("protocol unix").

Running the above command works when I try it with a server where I can login.
Your error message looks interesting:

It sounds a bit like the confirmation prompt that comes when connecting
to a server the first time. Did you connect to the server already before?
Or do you have a ssh configuration that always prints the remote
fingerprint and ansible does not expect that output?
It looks like it can actually reach the server (or it would not print
the fingerprint).

Regards,
  Reiner

While trying to again reproduce this issue I'm now also having problems
with ansible when ssh is firejailed.
It's not the issue from the original post, which I think was related
to known_hosts, but the problem is now that ansible starts ssh
with ControlMaster/ControlPath which keeps an ssh process running in the
jail (in the background).
Because of this ansible "hangs" at the first step because the "firejail
ssh" process does not terminate.

There are some related upstream issues about this:
https://github.com/netblue30/firejail/issues/1518
https://github.com/netblue30/firejail/issues/3491
https://github.com/netblue30/firejail/issues/4440

Might be fixed/worked-around by https://github.com/netblue30/firejail/pull/4635
in the next release.