I'm trying to setup proxy that connects via AWS Session Manager with ssh command (to be used by ansible). As of right now, I'm able to connect to my vm with AWS CLI command like so

aws ssm start-session --target i-XXXXXXXXX

With that in mind, I tried to setup ProxyCommand in my ssh config, the same that was recommended by AWS

host i-* mi-* ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p' --region eu-west-2"

Now it gets weird, it appears as connection is opened but it just hangs there, not redirecting input to vm, not printing prompt.

$ ssh i-XXXXXXXXXXXX -vvvvvvvvv
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n 7 Dec 2017
debug1: Reading configuration data /home/foo/.ssh/config
debug1: /home/foo/.ssh/config line 1: Applying options for i-*
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Executing proxy command: exec sh -c "aws ssm start-session --target i-XXXXXXXXXXXX --document-name AWS-StartSSHSession --parameters 'portNumber=22' --region eu-west-2"
debug1: permanently_drop_suid: 1000
debug1: identity file /home/foo/.ssh/id_rsa type 0
debug1: key_load_public: No such file or directory
debug1: identity file /home/foo/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/foo/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/foo/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/foo/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/foo/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/foo/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/foo/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: ssh_exchange_identification:
debug1: ssh_exchange_identification: Starting session with SessionId: botocore-session-1563202442-0d72a7be446ee1035
debug1: ssh_exchange_identification: \033[?1034hsh-4.2$
\033[Ksh-4.2$ SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: ssh_exchange_identification: sh: SSH-2.0-OpenSSH_7.6p1: command not found
debug1: ssh_exchange_identification: sh-4.2$

Any ideas? I've tried the same config on linux and windows, updated OpenSSH to 8.x, nothing is working.

1 Answer

SSM plugin and agent version

• Ensure that version 1.1.23.0 or later of the Session Manager plugin is installed. See Manually Install SSM Agent on Amazon EC2 Linux Instances
• Ensure that SSM Agent version 2.3.672.0 or later is installed on the instance. See Manually Install SSM Agent on Amazon EC2 Linux Instances

Related

• Getting SSH tunnels with AWS SSM Running