使用Capistrano部署到AWS EC2 AMI时身份验证失败错误

Question

I am following this tutorial:

https://www.sitepoint.com/deploy-your-rails-app-to-aws/

The app is fully created and running in development (including the database). Keys have been added to GIT and SSH, although from the tutorial I am very sure which of them goes exactly where.

And this the error I am getting.

$ gem list net

*** LOCAL GEMS ***

net-http-digest_auth (1.4)
net-http-persistent (2.9.4)
net-scp (1.2.1)
net-ssh (3.2.0, 3.1.1)
net-telnet (0.1.1)
contactbook liviu-mac $ cap production deploy --trace
** Invoke production (first_time)
** Execute production
** Invoke load:defaults (first_time)
** Execute load:defaults
** Invoke rvm:hook (first_time)
** Execute rvm:hook
** Invoke rvm:check (first_time)
** Execute rvm:check
cap aborted!
Net::SSH::AuthenticationFailed: Authentication failed for user deploy@52.87.233.215
/Users/liviu-mac/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/net-ssh-3.2.0/lib/net/ssh.rb:249:in `start'
/Users/liviu-mac/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/sshkit-1.11.3/lib/sshkit/backends/connection_pool.rb:59:in `call'
/Users/liviu-mac/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/sshkit-1.11.3/lib/sshkit/backends/connection_pool.rb:59:in `with'
/Users/liviu-mac/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/sshkit-1.11.3/lib/sshkit/backends/netssh.rb:155:in `with_ssh'
/Users/liviu-mac/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/sshkit-1.11.3/lib/sshkit/backends/netssh.rb:108:in `execute_command'
/Users/liviu-mac/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/sshkit-1.11.3/lib/sshkit/backends/abstract.rb:141:in `block in create_command_and_execute'
/Users/liviu-mac/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/sshkit-1.11.3/lib/sshkit/backends/abstract.rb:141:in `tap'
/Users/liviu-mac/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/sshkit-1.11.3/lib/sshkit/backends/abstract.rb:141:in `create_command_and_execute'
/Users/liviu-mac/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/sshkit-1.11.3/lib/sshkit/backends/abstract.rb:60:in `capture'
/Users/liviu-mac/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/capistrano-rvm-0.1.2/lib/capistrano/tasks/rvm.rake:9:in `block (3 levels) in <top (required)>'
/Users/liviu-mac/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/sshkit-1.11.3/lib/sshkit/backends/abstract.rb:29:in `instance_exec'
/Users/liviu-mac/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/sshkit-1.11.3/lib/sshkit/backends/abstract.rb:29:in `run'
/Users/liviu-mac/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/sshkit-1.11.3/lib/sshkit/runners/parallel.rb:12:in `block (2 levels) in execute'
Tasks: TOP => rvm:check

I attempted almost all fixes suggested in the posts I found. Nothing works for me.

Here are more details:

$ gem list net

*** LOCAL GEMS ***

net-http-digest_auth (1.4)
net-http-persistent (2.9.4)
net-scp (1.2.1)
net-ssh (3.2.0, 3.1.1)
net-telnet (0.1.1)

My Capfile is:

# Load DSL and set up stages
require "capistrano/setup"

# Include default deployment tasks
require "capistrano/deploy"

require 'capistrano/rvm'
# require 'capistrano/rbenv'
# require 'capistrano/chruby'
require 'capistrano/bundler'
require 'capistrano/rails/assets'
require 'capistrano/rails/migrations'
require 'capistrano/puma'
# require 'capistrano/passenger'
require 'capistrano/ssh_doctor'

# Load custom tasks from `lib/capistrano/tasks` if you have any defined
Dir.glob("lib/capistrano/tasks/*.rake").each { |r| import r }

My config/deply/production.rb file is (one single uncommented line):

server '52.87.233.215', user: 'deploy', roles: %w{web app db}

And my config/deploy.rb file is:

# config valid only for current version of Capistrano
lock '3.6.1'

set :application, 'contactbook'
set :repo_url, 'git@github.com:levi-l-damian/contactbook.git'

# Default branch is :master
# ask :branch, `git rev-parse --abbrev-ref HEAD`.chomp
set :branch, :master

# Default deploy_to directory is /var/www/my_app_name
# set :deploy_to, '/var/www/my_app_name'
set :deploy_to, '/home/deploy/contactbook'

# Default value for :pty is false
set :pty, true

# Default value for :linked_files is []
# append :linked_files, 'config/database.yml', 'config/secrets.yml'
set :linked_files, %w{config/database.yml config/application.yml}

# Default value for linked_dirs is []
# append :linked_dirs, 'log', 'tmp/pids', 'tmp/cache', 'tmp/sockets', 'public/system'
set :linked_dirs, %w{bin log tmp/pids tmp/cache tmp/sockets vendor/bundle public/system public/uploads}

# Default value for keep_releases is 5
set :keep_releases, 5

set :rvm_type, :user
set :rvm_ruby_version, 'ruby-2.3.1' # Edit this if you are using MRI Ruby

set :puma_rackup, -> { File.join(current_path, 'config.ru') }
set :puma_state, "#{shared_path}/tmp/pids/puma.state"
set :puma_pid, "#{shared_path}/tmp/pids/puma.pid"
set :puma_bind, "unix://#{shared_path}/tmp/sockets/puma.sock"    #accept array for multi-bind
set :puma_conf, "#{shared_path}/puma.rb"
set :puma_access_log, "#{shared_path}/log/puma_error.log"
set :puma_error_log, "#{shared_path}/log/puma_access.log"
set :puma_role, :app
set :puma_env, fetch(:rack_env, fetch(:rails_env, 'production'))
set :puma_threads, [0, 8]
set :puma_workers, 0
set :puma_worker_timeout, nil
set :puma_init_active_record, true
set :puma_preload_app, false

Don't know how to fix this and move forward?

Answer 1

When troubleshooting authentication failed errors in Capistrano, it is useful to drop down to a lower level and test connectivity with ssh first. That way you can figure out if it really is a Capistrano problem, or a more basic SSH connectivity issue.

In this case Capistrano says it cannot connect to 52.87.233.215 as the deploy user. Let's verify that manually like this:

ssh -v deploy@52.87.233.215

The -v flag dumps a bunch of verbose logging so that we can see what authentication methods are being attempted.

If you get permission denied (publickey) , that is an indication that you do not have your public key properly installed on the server. In other words, the server has no way of verifying you are who you claim to be, and denies access.

To install your public key, copy the contents of this file from your local machine :

~/.ssh/id_rsa.pub

And paste those contents into this file on the server :

~deploy/.ssh/authorized_keys

Make sure that ~deploy/.ssh/authorized_keys is owned and accessible by the deploy user:

$ ls -ld ~deploy/.ssh
drwxr-xr-x 2 deploy deploy 4096 Jun 16  2015 /home/deploy/.ssh
$ ls -ld ~deploy/.ssh/authorized_keys
-rw------- 1 deploy deploy 1023 Sep 12 02:13 /home/deploy/.ssh/authorized_keys

Now try the ssh command again:

ssh -v deploy@52.87.233.215

It should work, and if so, Capistrano should now work as well.

Answer 2

The only solution that worked for me was:

ssh -i ~/.ssh/contactbook.pem ec2-user@ec2-54-226-156-103.compute-1.amazonaws.com
su - deploy
chmod 400 /home/deploy/.ssh/authorized_keys
chown deploy:deploy /home/deploy -R

Only after that the commands:

ssh -v deploy@54.226.156.103

and

cap production deploy

succeeded.