Can't ssh to vagrant VMs using the insecure private key (vagrant 1.7.2)

Question

I have a cluster of 3 VMs. Here is the Vagrantfile:

 # -*- mode: ruby -*-
# vi: set ft=ruby :


hosts = {
  "host0" => "192.168.33.10",
  "host1" => "192.168.33.11",
  "host2" => "192.168.33.12"
}

Vagrant.configure("2") do |config|
  config.vm.box = "precise64"
  config.vm.box_url = "http://files.vagrantup.com/precise64.box"
  config.ssh.private_key_path = File.expand_path('~/.vagrant.d/insecure_private_key')

  hosts.each do |name, ip|
    config.vm.define name do |machine|
      machine.vm.hostname = "%s.example.org" % name
      machine.vm.network :private_network, ip: ip
      machine.vm.provider "virtualbox" do |v|
          v.name = name
      #    #v.customize ["modifyvm", :id, "--memory", 200]
      end
    end
  end
end

This used to work until I upgraded recently:

ssh -i ~/.vagrant.d/insecure_private_key [email protected]

Instead, vagrant asks for a password.

It seems that recent versions of vagrant (I'm on 1.7.2) create a secure private key for each machine. I discovered it by running

vagrant ssh-config

The output shows different keys for each host. I verified the keys are different by diffing them.

I tried to force the insecure key by setting in Vagrantfile the config.ssh.private_key_path, but it doesn't work.

The reason I want to use the insecure key for all machines is that I want to provision them from the outside using ansible. I don't want to use the Ansible provisioner, but treat the VMs as remote servers. So, the Vagrantfile is just used to specify the machines in the cluster and then provisioning will be done externally.

The documentation still says that by default machines will use the insecure private key.

How can I make my VMs use the insecure private key?

Answer 1

Vagrant changed the behaviour between 1.6 and 1.7 versions and now will insert auto generated insecure key instead of the default one.

You can cancel this behaviour by setting config.ssh.insert_key = false in your Vagrantfile.

Vagrant shouldn't replace insecure key if you specify private_key_path like you did, however the internal logic checks if the private_key_path points to the default insecure_private_key, and if it does, Vagrant will replace it.

More info can be found here.