不打通ssh，是否可以ansible，答案是肯定的。
知识点：不打通ssh方式，利用ansible的方式

前提准备

ansible很多时候以ssh打通作为前提，但是并不一定要ssh通才可以，因为ssh不通，则需要用户名/密码。至于为什跟ssh关心这么紧密，我们使用ssh通道没有创建的两台机器进行确认

机器名/IP	用途
platform	ansible所安装的机器
192.168.163.129	ansible所要连接的目的机器

事前在platform机器上的ansible的hosts文件中添加如下信息

[root@platform ~]# grep 192.168 /etc/ansible/hosts |grep -v '#'
192.168.163.129
[root@platform ~]#

两台机器之间没有打通ssh，需要输入用户名和密码

[root@platform ~]# ssh 192.168.163.129 hostname
root@192.168.163.129's password: 
liumiaocn
[root@platform ~]# 

确认ansible的连接方式

可以看到如果不做ssh设定，使用最简单的ping命令时会得到UNREACHABLE的结果，而信息的提示就是“Failed to connect to the host via ssh“，不能使用ssh方式连接到该机

[root@platform ~]# ansible 192.168.163.129 -m ping
192.168.163.129 | UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n", "unreachable": true
}
[root@platform ~]# 

我们使用-vvv选项来确认以下这种情况下失败的过程

[root@platform ~]# ansible 192.168.163.129 -m ping -vvv
ansible 2.6.3config file = /etc/ansible/ansible.cfgconfigured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']ansible python module location = /usr/lib/python2.7/site-packages/ansibleexecutable location = /usr/bin/ansiblepython version = 2.7.5 (default, Aug  4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]
Using /etc/ansible/ansible.cfg as config file
Parsed /etc/ansible/hosts inventory source with ini plugin
META: ran handlers
<192.168.163.129> ESTABLISH SSH CONNECTION FOR USER: None
<192.168.163.129> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/15d39cfe75 192.168.163.129 '/bin/sh -c '"'"'echo ~ && sleep 0'"'"''
<192.168.163.129> (255, '', 'Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n')
192.168.163.129 | UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n", "unreachable": true
}
[root@platform ~]#

设定用户名/密码

可以看到缺省的情况下SSH: EXEC ssh -C -o会被调用，根据ssh的设定选项，可以不必打通ssh通道，但是实际在执行的时候需要输入用户名和密码，而这两个信息，可以通过如下选项进行设定

设定项	说明
ansible_ssh_user	用户名
ansible_ssh_pass	密码

有不止一种方式可以进行设定，这里来看一下最简单的一种方式

[root@platform ~]# grep 192.168.163 /etc/ansible/hosts
192.168.163.129 ansible_ssh_user=root ansible_ssh_pass=liumiao
[root@platform ~]#

结果确认

使用这种方式，虽然ssh通道没有建立，但是ansible命令也可以执行

[root@platform ~]# ansible 192.168.163.129 -m ping
192.168.163.129 | SUCCESS => {"changed": false, "ping": "pong"
}
[root@platform ~]#

ansible的实现方式

可以看到ansible在执行的时候实际还是使用了ssh，生成临时执行文件，sftp到对象机器，然后执行，执行之后删除。

[root@platform ~]# ansible 192.168.163.129 -m ping -vvv
ansible 2.6.3config file = /etc/ansible/ansible.cfgconfigured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']ansible python module location = /usr/lib/python2.7/site-packages/ansibleexecutable location = /usr/bin/ansiblepython version = 2.7.5 (default, Aug  4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]
Using /etc/ansible/ansible.cfg as config file
Parsed /etc/ansible/hosts inventory source with ini plugin
META: ran handlers
<192.168.163.129> ESTABLISH SSH CONNECTION FOR USER: root
<192.168.163.129> SSH: EXEC sshpass -d12 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o User=root -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/9e41121aec 192.168.163.129 '/bin/sh -c '"'"'echo ~root && sleep 0'"'"''
<192.168.163.129> (0, '/root\n', '')
<192.168.163.129> ESTABLISH SSH CONNECTION FOR USER: root
<192.168.163.129> SSH: EXEC sshpass -d12 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o User=root -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/9e41121aec 192.168.163.129 '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo /root/.ansible/tmp/ansible-tmp-1535588259.29-145057259619160 `" && echo ansible-tmp-1535588259.29-145057259619160="` echo /root/.ansible/tmp/ansible-tmp-1535588259.29-145057259619160 `" ) && sleep 0'"'"''
<192.168.163.129> (0, 'ansible-tmp-1535588259.29-145057259619160=/root/.ansible/tmp/ansible-tmp-1535588259.29-145057259619160\n', '')
Using module file /usr/lib/python2.7/site-packages/ansible/modules/system/ping.py
<192.168.163.129> PUT /root/.ansible/tmp/ansible-local-320slpIij/tmpfOmqrb TO /root/.ansible/tmp/ansible-tmp-1535588259.29-145057259619160/ping.py
<192.168.163.129> SSH: EXEC sshpass -d12 sftp -o BatchMode=no -b - -C -o ControlMaster=auto -o ControlPersist=60s -o User=root -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/9e41121aec '[192.168.163.129]'
<192.168.163.129> (0, 'sftp> put /root/.ansible/tmp/ansible-local-320slpIij/tmpfOmqrb /root/.ansible/tmp/ansible-tmp-1535588259.29-145057259619160/ping.py\n', '')
<192.168.163.129> ESTABLISH SSH CONNECTION FOR USER: root
<192.168.163.129> SSH: EXEC sshpass -d12 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o User=root -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/9e41121aec 192.168.163.129 '/bin/sh -c '"'"'chmod u+x /root/.ansible/tmp/ansible-tmp-1535588259.29-145057259619160/ /root/.ansible/tmp/ansible-tmp-1535588259.29-145057259619160/ping.py && sleep 0'"'"''
<192.168.163.129> (0, '', '')
<192.168.163.129> ESTABLISH SSH CONNECTION FOR USER: root
<192.168.163.129> SSH: EXEC sshpass -d12 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o User=root -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/9e41121aec -tt 192.168.163.129 '/bin/sh -c '"'"'/usr/bin/python /root/.ansible/tmp/ansible-tmp-1535588259.29-145057259619160/ping.py && sleep 0'"'"''
<192.168.163.129> (0, '\r\n{"invocation": {"module_args": {"data": "pong"}}, "ping": "pong"}\r\n', 'Shared connection to 192.168.163.129 closed.\r\n')
<192.168.163.129> ESTABLISH SSH CONNECTION FOR USER: root
<192.168.163.129> SSH: EXEC sshpass -d12 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o User=root -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/9e41121aec 192.168.163.129 '/bin/sh -c '"'"'rm -f -r /root/.ansible/tmp/ansible-tmp-1535588259.29-145057259619160/ > /dev/null 2>&1 && sleep 0'"'"''
<192.168.163.129> (0, '', '')
192.168.163.129 | SUCCESS => {"changed": false, "invocation": {"module_args": {"data": "pong"}}, "ping": "pong"
}
META: ran handlers
META: ran handlers
[root@platform ~]# 

日志解析

我们曾经对ansible最简单的ping命令进行解析，详细可参看https://blog.csdn.net/liumiaocn/article/details/52070617，跟上面的信息相比，最重要的是ssh通道是否打通的前提，仔细比较以下你就会发现，没有打通的时候，ansible实际使用了sshpass , 而sshpass则正是免去交互式输入用户名密码的ssh命令。