153

I would like to use ansible-playbook command instead of 'vagrant provision'. However setting host_key_checking=false in the hosts file does not seem to work.

# hosts file
vagrant ansible_ssh_private_key_file=~/.vagrant.d/insecure_private_key 
ansible_ssh_user=vagrant ansible_ssh_port=2222 ansible_ssh_host=127.0.0.1 
host_key_checking=false

Is there a configuration variable outside of Vagrantfile that can override this value?

6 Answers 6

253

Due to the fact that I answered this in 2014, I have updated my answer to account for more recent versions of ansible.

Yes, you can do it at the host/inventory level (Which became possible on newer ansible versions) or global level:

inventory:

Add the following.

ansible_ssh_common_args='-o StrictHostKeyChecking=no'

host:

Add the following.

ansible_ssh_extra_args='-o StrictHostKeyChecking=no'

hosts/inventory options will work with connection type ssh and not paramiko. Some people may strongly argue that inventory and hosts is more secure because the scope is more limited.

global:

Ansible User Guide - Host Key Checking

  • You can do it either in the /etc/ansible/ansible.cfg or ~/.ansible.cfg file:

    [defaults]
    host_key_checking = False
    
  • Or you can setup and env variable (this might not work on newer ansible versions):

    export ANSIBLE_HOST_KEY_CHECKING=False
    
9
  • 33
    I'm using ansible 1.7.2 and my experience has been that the environment variable ANSIBLE_HOST_KEY_CHECKING works but -e 'host_key_checking=False' does not work. Nov 22, 2014 at 17:43
  • 7
    Your first statement "Yes, but not at the hosts/inventory level" is false. You can use ansible_ssh_common_args='-o StrictHostKeyChecking=no' or ansible_ssh_extra_args='-o StrictHostKeyChecking=no' Sep 10, 2016 at 10:36
  • 2
    Only the last option worked for me (export ANSIBLE_HOST_KEY_CHECKING=False) before running my playbook.
    – ted-k42
    May 31, 2017 at 6:56
  • 1
    "Yes, but not at the hosts/inventory level." -- Is shown to be false, proven by my answer. I'd even say this is not really an answer to the question on how to set it on inventory level.
    – gertvdijk
    Aug 2, 2017 at 10:06
  • @gertvdijk I answered this in 2014. Ansible has gone through a bunch of revisions. That's not the case anymore ?
    – Rico
    Aug 2, 2017 at 16:11
81

Yes, you can set this on the inventory/host level.

With an already accepted answer present, I think this is a better answer to the question on how to handle this on the inventory level. I consider this more secure by isolating this insecure setting to the hosts required for this (e.g. test systems, local development machines).

What you can do at the inventory level is add

ansible_ssh_common_args='-o StrictHostKeyChecking=no'

or

ansible_ssh_extra_args='-o StrictHostKeyChecking=no'

to your host definition (see Ansible Behavioral Inventory Parameters).

This will work provided you use the ssh connection type, not paramiko or something else).

For example, a Vagrant host definition would look like…

vagrant ansible_port=2222 ansible_host=127.0.0.1 ansible_ssh_common_args='-o StrictHostKeyChecking=no'

or

vagrant ansible_port=2222 ansible_host=127.0.0.1 ansible_ssh_extra_args='-o StrictHostKeyChecking=no'

Running Ansible will then be successful without changing any environment variable.

$ ansible vagrant -i <path/to/hosts/file> -m ping
vagrant | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}

In case you want to do this for a group of hosts, here's a suggestion to make it a supplemental group var for an existing group like this:

[mytestsystems]
test[01:99].example.tld

[insecuressh:children]
mytestsystems

[insecuressh:vars]
ansible_ssh_common_args='-o StrictHostKeyChecking=no'
3
  • 4
    This is a much better answer.
    – marcv81
    Apr 6, 2016 at 4:10
  • This suggestion worked for me, and I agree that this is something that should be set at a project level (rather than the global level) because of security concerns. May 5, 2017 at 15:26
  • 1
    I included ansible_ssh_common_args: '-o StrictHostKeyChecking=no' in the group_vars file yml file.
    – g .
    Sep 18, 2017 at 9:53
5

I could not use:

ansible_ssh_common_args='-o StrictHostKeyChecking=no'

in inventory file. It seems ansible does not consider this option in my case (ansible 2.0.1.0 from pip in ubuntu 14.04)

I decided to use:

server ansible_host=192.168.1.1 ansible_ssh_common_args= '-o UserKnownHostsFile=/dev/null'

It helped me.

Also you could set this variable in group instead for each host:

[servers_group:vars]
ansible_ssh_common_args='-o UserKnownHostsFile=/dev/null'
2
  • Setting the UserKnownHostsFile / GlobalKnownHostsFile option to /dev/null also works indeed. It's strange that setting StrictHostKeyChecking does not work for you. Most likely is some option in your SSH configuration the cause.
    – gertvdijk
    Jun 21, 2016 at 8:16
  • 1
    +1 for -o UserKnownHostsFile=/dev/null. Without it also just didn't work for me, irrespective of the the location and way I specified ansible_ssh_common_args outlined in the other answers.
    – Till Kuhn
    Feb 11, 2020 at 14:20
0

In /etc/ansible/ansible.cfg uncomment the line:

host_key_check = False

and in /etc/ansible/hosts uncomment the line

client_ansible ansible_ssh_host=10.1.1.1 ansible_ssh_user=root ansible_ssh_pass=12345678

That's all

0

Adding following to ansible config worked while using ansible ad-hoc commands:

[ssh_connection]
# ssh arguments to use
ssh_args = -o StrictHostKeyChecking=no

Ansible Version

ansible 2.1.6.0
config file = /etc/ansible/ansible.cfg
0

You set these configs either in the /etc/ansible/ansible.cfg or ~/.ansible.cfg or ansible.cfg(in your current directory) file

[ssh_connection]
ssh_args = -C -o ControlMaster=auto -o ControlPersist=60s -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no

tested with ansible 2.9.6 in ubuntu 20.04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.