Ansible fails with "Permission denied (keyboard-interactive)" - ssh

Question

I have two different machines I can connect to in SSH, using a corporate VPN and proxy.
For that, my ~/.ssh/config has two hosts defined like this:
Host foobar
User alice
HostName XXX.XXX.XXX.XXX
ProxyCommand nc -x proxy-socks.foobar.com:4242 %h %p
The ProxyCommand is identical for both hosts, only the HostName and User are different. Each host has my public key, I can connect to each one simply by typing ssh foobar, no password is asked.
Now, I tried to use ansible to act on these machines. I have an inventory.cfg like that listing the name of both machines as defined in my ~/.ssh/config:
[vpn]
foobar
barfoo
I tried this simple command:
ansible -i inventory.cfg vpn -m ping
This worked for one of the machines, but not the other. Here is the redacted output:
foobar | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/libexec/platform-python"
},
"changed": false,
"ping": "pong"
}
barfoo | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: Welcome on barfoo [...] Permission denied (keyboard-interactive).",
"unreachable": true
}
Since I got the "welcome" message from the host in the output, it means that I did reach the host (so the proxy configuration should be ok).
But I cannot understand the error "Permission denied (keyboard-interactive).". I can connect to this machine by SSH without password (in fact, the admins even disabled password authentication, I had to send them my public key by e-mail).
I tried to explicitely specify my SSH key by adding --private-key $HOME/.ssh/id_rsa, but the error message was exactly the same.
By curiosity, I tried with Python's package fabric, but this worked fine for both machines:
import fabric
fabric.Connection('barfoo').run('hostname')
So it seems there is something weird going on between ansible and this machine configuration. Any clue?
EDIT
Using the advice from #GeralexGR, I added -vvvv in my ansible command to have more output.
In the output, I could see that ansible is making this call to SSH :
ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o 'ControlPath="/home/alice/.ansible/cp/dbd7338475"' barfoo '/bin/sh -c '"'"'echo ~ && sleep 0'"'"''
By trial and error, I could reduce this command to this one :
ssh -vvv -o PreferredAuthentications=publickey barfoo 'hostname'
This command fails on one machine but not the other. However, if I remove the PreferredAuthentications option, it works fine with both machines.
When it fails, it outputs something like that:
debug1: Next authentication method: publickey
debug1: Offering public key: [...]
[...]
debug1: Server accepts key: [...]
[...]
Authenticated with partial success.
debug1: Authentications that can continue: keyboard-interactive
debug3: start over, passed a different list keyboard-interactive
debug3: preferred publickey
debug1: No more authentication methods to try.
If I remove this option and do a simple ssh -vvvv, I get this in the output:
debug1: Next authentication method: publickey
debug1: Offering public key: [...]
[...]
debug1: Server accepts key: [...]
[...]
Authenticated with partial success.
debug1: Authentications that can continue: keyboard-interactive
[...]
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
[...]
debug1: Authentication succeeded (keyboard-interactive).
So, my guess is that keyboard-interactive is required for this machine. And indeed, if I put both publickey and keyboard-interactive in the option, this works:
ssh -vvv -o preferredauthentications=publickey,keyboard-interactive barfoo 'hostname'
So, back to ansible, I tried this:
ansible -vvvv --ssh-extra-args='-o preferredauthentications=publickey,keyboard-interactive' -i inventory.cfg -m ping vpn
But it still failed, I guess that this authentication mecanism is not possible with ansible? I am not sure why/how keyboard-interactive is needed here, since I am never prompted for a password. I will ask the admins of the machine.

Answer 1

The solution was kindly given by #Zeitounator in comments.
I added these two lines in my inventory.cfg file (with a dummy password):
[vpn:vars]
ansible_ssh_pass=foo
Now the initial ansible command works well.
Alternatively, using the --ask-pass option on the command line works as well:
ansible --ask-pass -i inventory.cfg -m ping vpn
For the context I asked a bit more information to the admins of the machine. This machine does not ask me for a password or anything, however, it asks to some external users (not me) to accept some terms and conditions. This is why the keyboard-interactive mechanism is needed.

Answer 2

Duo requires keyboard-interactive authentication, but ansible turned it off by -o KbdInteractiveAuthentication=no as seen from the ansible -vvv output as shown in the original post. I added ssh_args -o KbdInteractiveAuthentication=yes in ansible.cfg:
ssh_args = -o PreferredAuthentications=publickey,keyboard-interactive -o ControlMaster=auto -o ControlPersist=300s -o KbdInteractiveAuthentication=yes
and now it works fine.