changing ssh port with ansible playbook - ansible

Question

I want to change port of ssh server on client systems to custom one 2202 (port defined in group_var/all and also in roles/change-sshd-port/vars/main.yml). My requirement is that the playbook can also be run when port is already set to custom 2202 (then playbook should do nothing).
I already used ansible role basing on solution: https://github.com/Forcepoint/fp-pta-ansible-change-sshd-port
The port is changed fine when I run the script for the first time (when completed I can login client node on new port).
When I run the playbook again it fails because is trying to do some tasks via old 22 instead of new port 2202
TASK [change-sshd-port : Confirm host connection works] ********************************************************************************************************************
fatal: [192.168.170.113]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: ssh: connect to host 192.168.170.113 port 22: Connection refused", "unreachable": true}
I can't find why it is trying to use port 22 when ansible_port variable is set to new port in roles/change-sshd-port/vars/main.yml
---
# vars file for /home/me/ansible2/roles/change-sshd-port
ansible_port: 2202
The part of the role task roles/change-sshd-port/tasks/main.yml until failing ping task is:
- name: Set configured port fact
ansible.builtin.set_fact:
configured_port: "{{ ansible_port }}"
- name: Check if we're using the inventory-provided SSH port
ansible.builtin.wait_for:
port: "{{ ansible_port }}"
state: "started"
host: "{{ ansible_host }}"
connect_timeout: "5"
timeout: "10"
delegate_to: "localhost"
ignore_errors: "yes"
register: configured_ssh
- name: SSH port is configured properly
ansible.builtin.debug:
msg: "SSH port is configured properly"
when: configured_ssh is defined and
configured_ssh.state is defined and
configured_ssh.state == "started"
register: ssh_port_set
- name: Check if we're using the default SSH port
ansible.builtin.wait_for:
port: "22"
state: "started"
host: "{{ ansible_host }}"
connect_timeout: "5"
timeout: "10"
delegate_to: "localhost"
ignore_errors: "yes"
register: default_ssh
when: configured_ssh is defined and
configured_ssh.state is undefined
- name: Set inventory ansible_port to default
ansible.builtin.set_fact:
ansible_port: "22"
when: default_ssh is defined and
"state" in default_ssh and
default_ssh.state == "started"
register: ssh_port_set
- name: Fail if SSH port was not auto-detected (unknown)
ansible.builtin.fail:
msg: "The SSH port is neither 22 or {{ ansible_port }}."
when: ssh_port_set is undefined
- name: Confirm host connection works
ansible.builtin.ping:

Answer 1

Your question is missing a bunch of details (there's no way for us to
reproduce the problem from the information you've given in the
question), so I'm going to have to engage in some guesswork. There are
a couple of things that could be happening.
First, if you're mucking about with the ssh port in your playbooks,
you're going to need to disable fact gathering on the play. By
default, ansible runs the setup module on target hosts before
running the tasks in your play, and this is going to use whatever port
you've configured in your inventory. If sshd is running on a different
port than expected, this will fail.
Here's a playbook that ignores whatever your port you have in your
inventory and will successfully connect to a target host whether sshd
is running on port 22 or port 2222 (it will fail with an error if sshd
is not running on either of those ports):
- hosts: target
gather_facts: false
vars:
desired_port: 2222
default_port: 22
tasks:
- name: check if ssh is running on {{ desired_port }}
delegate_to: localhost
wait_for:
port: "{{ desired_port }}"
host: "{{ ansible_host }}"
timeout: 10
ignore_errors: true
register: desired_port_check
- name: check if ssh is running on {{ default_port }}
delegate_to: localhost
wait_for:
port: "{{ default_port }}"
host: "{{ ansible_host }}"
timeout: 10
ignore_errors: true
register: default_port_check
- fail:
msg: "ssh is not running (or is running on an unknown port)"
when: default_port_check is failed and desired_port_check is failed
- when: default_port_check is success
block:
- debug:
msg: "ssh is running on default port"
- name: configure ansible to use port {{ default_port }}
set_fact:
ansible_port: "{{ default_port }}"
- when: desired_port_check is success
block:
- debug:
msg: "ssh is running on desired port"
- name: configure ansible to use port {{ desired_port }}
set_fact:
ansible_port: "{{ desired_port }}"
- name: run a command on the target host
command: uptime
register: uptime
- debug:
msg: "{{ uptime.stdout }}"