SSH Unknown Error in Ansible: Causes and Fixes

The Error

fatal: [web1]: UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: ssh: connect to host 192.168.1.10 port 22: Unknown error",
    "unreachable": true
}

This means Ansible's SSH connection to the remote host failed. The "unknown error" typically indicates a network-level problem before SSH authentication even begins.

Common Causes and Fixes

1. Host is Unreachable (Network)

The most common cause — the host is down or not accessible:

# Test basic connectivity
ping 192.168.1.10

# Test SSH port specifically
nc -zv 192.168.1.10 22
# or
telnet 192.168.1.10 22

Fix: Verify the host is running and network routing is correct.

2. Firewall Blocking Port 22

# On the remote host, check firewall
sudo iptables -L -n | grep 22
sudo ufw status
sudo firewall-cmd --list-all

# Open SSH port if blocked
sudo ufw allow 22/tcp
# or
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

3. SSH Service Not Running

# Check SSH service on remote host
sudo systemctl status sshd

# Start if stopped
sudo systemctl start sshd
sudo systemctl enable sshd

4. DNS Resolution Failure

If using hostnames instead of IPs:

# Test DNS resolution
nslookup web1.example.com
dig web1.example.com

# Workaround: use IP in inventory
[webservers]
web1 ansible_host=192.168.1.10

5. Wrong SSH Port

# If SSH runs on a non-standard port
[webservers]
web1 ansible_host=192.168.1.10 ansible_port=2222

6. SSH Host Key Changed

WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

# Remove old host key
ssh-keygen -R 192.168.1.10

# Or disable host key checking (not recommended for production)
# In ansible.cfg:
[defaults]
host_key_checking = False

7. SSH Key Permission Issues

# Fix key permissions
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub
chmod 600 ~/.ssh/config

8. Too Many SSH Connections (MaxSessions)

When managing many hosts, SSH connection limits can cause failures:

# ansible.cfg
[ssh_connection]
ssh_args = -o ControlMaster=auto -o ControlPersist=60s
pipelining = True

# Limit concurrent connections
- name: Deploy to many hosts
  hosts: all
  serial: 10  # Process 10 at a time

Debugging SSH Issues

Increase Verbosity

# Maximum SSH debug output
ansible web1 -m ping -vvvv

Test SSH Directly

# Test the exact SSH command Ansible would use
ssh -vvv -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ubuntu@192.168.1.10

Check Ansible SSH Arguments

# See what SSH command Ansible runs
ANSIBLE_SSH_ARGS="-vvv" ansible web1 -m ping

Ansible SSH Configuration

Optimize your ansible.cfg for reliable connections:

[defaults]
timeout = 30
forks = 20

[ssh_connection]
ssh_args = -o ControlMaster=auto -o ControlPersist=600s -o ServerAliveInterval=60
pipelining = True
retries = 3

Quick Diagnostic Checklist

✅ Can you ping the host? (ping 192.168.1.10)
✅ Is port 22 open? (nc -zv 192.168.1.10 22)
✅ Is SSH running? (systemctl status sshd)
✅ Can you SSH manually? (ssh user@host)
✅ Are permissions correct? (ls -la ~/.ssh/)
✅ Is the firewall allowing SSH? (ufw status)
✅ Is DNS resolving? (nslookup hostname)
✅ Is the correct user configured? (ansible_user)

Find more troubleshooting guides in our errors section and 800+ tutorials.