Can't execute examples: SSH doesn't work without password specified

[TobiPeterG]

Describe the bug
Hi,
I setup a test proxmox instance to execute the "example" commands. Unfortunately, it told me that SSH connection was not possible, even though I setup the .tfvars file as shown in the how-to guide. The solution was to add the "password" key in the provider config in main.tf and set it to the root password already specified.
The docs however say: Optional) The password to use for the SSH connection. Defaults to the password used for the Proxmox API connection. Can also be sourced from PROXMOX_VE_SSH_PASSWORD.
So I guess this should have worked from the beginning? My main.tf in example now looks like this:

provider "proxmox" {
  endpoint  = var.virtual_environment_endpoint
  api_token = var.virtual_environment_api_token
  insecure  = true
  ssh {
    agent    = true
    username = var.virtual_environment_ssh_username
    password = var.virtual_environment_root_password
  }
}

provider "proxmox" {
  alias    = "root"
  endpoint = var.virtual_environment_endpoint
  username = "root@pam"
  password = var.virtual_environment_root_password
  insecure = true
}

Can someone confirm this?

PS: It would be nice if the tutorial also mentions that the proxmox node needs to have the hostname "pve", this is only listed in the README itself.

To Reproduce
Steps to reproduce the behavior:

1. Setup proxmox test instance as described
2. Setup tfvars file as described
3. Run "make example"
4. See error

Please also provide a minimal Terraform configuration that reproduces the issue.

# >>> put your example here <<< #

and the output of terraform|tofu apply.

╷
│ Error: failed to open SSH client: unable to authenticate user "root" over SSH to "10.127.214.132:22". Please verify that ssh-agent is correctly loaded with an authorized key via 'ssh-add -L' (NOTE: configurations in ~/.ssh/config are not considered by the provider): failed to dial 10.127.214.132:22: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
│ 
│   with proxmox_virtual_environment_file.user_config,
│   on resource_virtual_environment_file.tf line 5, in resource "proxmox_virtual_environment_file" "user_config":
│    5: resource "proxmox_virtual_environment_file" "user_config" {
│ 
╵
╷
│ Error: failed to open SSH client: unable to authenticate user "root" over SSH to "10.127.214.132:22". Please verify that ssh-agent is correctly loaded with an authorized key via 'ssh-add -L' (NOTE: configurations in ~/.ssh/config are not considered by the provider): failed to dial 10.127.214.132:22: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
│ 
│   with proxmox_virtual_environment_file.vendor_config,
│   on resource_virtual_environment_file.tf line 32, in resource "proxmox_virtual_environment_file" "vendor_config":
│   32: resource "proxmox_virtual_environment_file" "vendor_config" {
│ 
╵
╷
│ Error: failed to open SSH client: unable to authenticate user "root" over SSH to "10.127.214.132:22". Please verify that ssh-agent is correctly loaded with an authorized key via 'ssh-add -L' (NOTE: configurations in ~/.ssh/config are not considered by the provider): failed to dial 10.127.214.132:22: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
│ 
│   with proxmox_virtual_environment_file.meta_config,
│   on resource_virtual_environment_file.tf line 53, in resource "proxmox_virtual_environment_file" "meta_config":
│   53: resource "proxmox_virtual_environment_file" "meta_config" {
│ 
╵
╷
│ Error: error retrieving firewall rules: received an HTTP 500 response - Reason: hostname lookup 'pve' failed - failed to get address info for: pve: Name or service not known
│ 
│   with proxmox_virtual_environment_firewall_rules.node_rules,
│   on resource_virtual_environment_firewall_rules.tf line 84, in resource "proxmox_virtual_environment_firewall_rules" "node_rules":
│   84: resource "proxmox_virtual_environment_firewall_rules" "node_rules" {
│ 
╵
╷
│ Error: failed to update node time: received an HTTP 400 response - Reason: Parameter verification failed. (timezone: No such timezone)
│ 
│   with proxmox_virtual_environment_time.example,
│   on resource_virtual_environment_time.tf line 1, in resource "proxmox_virtual_environment_time" "example":
│    1: resource "proxmox_virtual_environment_time" "example" {
│ 

Expected behavior
SSH authentication works without adding the "password" key

Additional context
Add any other context about the problem here.

• Single or clustered Proxmox: single
• Proxmox version: 9.1.1
• Provider version (ideally it should be the latest version): fix(vm): set power state of VM centrally #2508
• Terraform/OpenTofu version: v1.10.6
• OS (where you run Terraform/OpenTofu from): openSUSE Tumbleweed
• Debug logs (TF_LOG=DEBUG terraform apply):

[TobiPeterG]

Also, the trunks example doesn't seem to work. I already made the network interface VLAN aware, but it reports that the guest agent is not running. Any idea on how I can fix this?

[TobiPeterG]

I wanted to run the acceptence tests now, but the testacc.env doesn't mention a password for SSH at all. Is this not supported? I can't allow SSH access to my proxmox instance without password or SSH key unfortunately :(

[bpg-dev]

The example's main.tf

provider "proxmox" {
  endpoint  = var.virtual_environment_endpoint
  api_token = var.virtual_environment_api_token
  insecure  = true
  ssh {
    agent    = true
    username = var.virtual_environment_ssh_username
  }
}

provider "proxmox" {
  alias    = "root"
  endpoint = var.virtual_environment_endpoint
  username = "root@pam"
  password = var.virtual_environment_root_password
  insecure = true
}

It has 2 provider profiles configured

• a default one:
  • authentication via API Token
  • SSH connection via ssh agent
    • using specific username
• a "root" alias
  • authenticated via username & password

The docs however say: Optional) The password to use for the SSH connection. Defaults to the password used for the Proxmox API connection. Can also be sourced from PROXMOX_VE_SSH_PASSWORD.
So I guess this should have worked from the beginning?

The SSH password default mechanism can't work here because the default provider configuration uses API token auth, not username & password, so there is no password to fall back to.
It looks like your machine does not have ssh-agent running (or it doesn't have the right key loaded) to provide SSH credentials for the connection to the Proxmox host, so the provider falls back to password authentication, which also fails due to the missing password, hence the error "attempted methods [none password], no supported methods remain".
You adding the password to the SSH block essentially fixed this.

I think this is a documentation issue: the README should clarify that the default provider profile relies on ssh-agent having the appropriate keys loaded, and that users without a working ssh-agent need to configure the SSH password or private key explicitly.

[bpg-dev]

Also, the trunks example doesn't seem to work. I already made the network interface VLAN aware, but it reports that the guest agent is not running. Any idea on how I can fix this?

Do you have DHCP v4 available in the subnet the VM is connected to?

[bpg-dev]

I wanted to run the acceptence tests now, but the testacc.env doesn't mention a password for SSH at all. Is this not supported? I can't allow SSH access to my proxmox instance without password or SSH key unfortunately :(

The same idea as above applies to acceptance tests -- the expectation is the ssh-agent is configured and provides SSH credentials.

[bpg-dev]

Here is more details on ssh-agent configuration for the provider: https://registry.terraform.io/providers/bpg/proxmox/latest/docs#ssh-agent