I don't think it should ever happen, but I was locked out of my system when using this role.
- include: ~/.local/share/debops/debops-playbooks/playbooks/common.yml
roles:
- role: debops.sshd
but that leaves me unconnectable.
TASK: [debops.ferm | Allow SSH access from Ansible Controller] ****************
ok: [foo.local] => {"changed": false, "gid": 4, "group": "adm", "mode": "0644", "owner": "root", "path": "/etc/ferm/filter-input.d/10_ansible_controller.conf", "size": 236, "state": "file", "uid": 0}
TASK: [debops.ferm | Configure forwarding in ip(6)tables if enabled] **********
ok: [foo.local] => {"changed": false, "gid": 4, "group": "adm", "mode": "0644", "owner": "root", "path": "/etc/ferm/ferm.d/10_forward.conf", "size": 112, "state": "file", "uid": 0}
TASK: [debops.ferm | Remove ip(6)tables rules if requested] *******************
skipping: [foo.local] => (item={'category': 'filter', 'table': 'filter/input', 'type': 'conntrack', 'weight': '20'})
skipping: [foo.local] => (item={'category': 'filter', 'table': 'filter/forward', 'type': 'conntrack', 'weight': '20'})
skipping: [foo.local] => (item={'category': 'filter', 'table': 'filter/output', 'type': 'conntrack', 'weight': '20'})
TASK: [debops.ferm | Configure ip(6)tables rules] *****************************
ok: [foo.local] => (item={'category': 'filter', 'table': 'filter/input', 'type': 'conntrack', 'weight': '20'}) => {"changed": false, "gid": 4, "group": "adm", "item": {"category": "filter", "table": "filter/input", "type": "conntrack", "weight": "20"}, "mode": "0644", "owner": "root", "path": "/etc/ferm/filter/input/20_conntrack_rules.conf", "size": 190, "state": "file", "uid": 0}
ok: [foo.local] => (item={'category': 'filter', 'table': 'filter/forward', 'type': 'conntrack', 'weight': '20'}) => {"changed": false, "gid": 4, "group": "adm", "item": {"category": "filter", "table": "filter/forward", "type": "conntrack", "weight": "20"}, "mode": "0644", "owner": "root", "path": "/etc/ferm/filter/forward/20_conntrack_rules.conf", "size": 190, "state": "file", "uid": 0}
fatal: [foo.local] => ssh connection closed waiting for a privilege escalation password prompt
FATAL: all hosts have already failed -- aborting
I was lucky enough to be able to have physical access so I flushed iptables and stopped ferm. Then things worked again.