6

I am trying to add a known host to the known_hosts file using ansible

vagrant@jedi:/vagrant$ ansible web -m known_hosts -a "name=web state=present"

paramiko: The authenticity of host 'web' can't be established.
The ssh-rsa key fingerprint is afb8cf4885468badb1a7b8afc16ac211.
Are you sure you want to continue connecting (yes/no)?

I keep getting prompted as above.

I thought this module took care of this? Otherwise I should do a keyscan of web and add that to the known_hosts file.

What am I doing wrong or misunderstanding?

2 Answers 2

8

@udondan explained very well. Just another note:

This is the default behaivior of Ansible. It will always check the host key. If Ansible never connected to that host this prompt will appear. That is the reason you aren't able to call known_hosts module without accepting the key first.

If this is not desirable you can set host_key_checking=False on ansible.cfg.

MORE SECURE APPROACH

The best approach is set this variable: export ANSIBLE_HOST_KEY_CHECKING=False while you're deploying new servers, then remove it. unset ANSIBLE_HOST_KEY_CHECKING

Host key checking it's an important security feature.

Learn more about host_key_checking.

3
  • Thanks. I have read the documentation, but it's weird there is functionality to update known_hosts and that requires a prompt. I can achieve the same thing with out the prompt if I just use cmd ssh-keyscan myserver >> location/to/known_hosts. Note I am setting up a management node that interacts with all of my hosts. Really struggling with automating the setup of the management node. Jan 11, 2016 at 13:19
  • I know haha. I have the same requirement here. I've managed to work setting this variable thought shell module. Jan 11, 2016 at 13:22
  • 1
    The best I have found is ansible localhost -m known_hosts -a "path=/home/vagrant/.ssh/known_hosts name=web key=\"{{ lookup('pipe', 'ssh-keyscan web') }}\" state=present" . . . chown vagrant /home/vagrant/.ssh/known_hosts chgrp vagrant /home/vagrant/.ssh/known_hosts Jan 11, 2016 at 13:33
4

The module takes care of it. But there are two problems:

  1. Since you're running the task on the target host Ansible will first try to connect to the host before it is able run your task

  2. Also, since the task runs on the target host, you will add the fingerprint to the know_hosts file on that machine, not locally.

You would need to run the task on the local machine, not on the target machine(s).

ansible localhost -m known_hosts -a "name=web state=present"

Otherwise I should do a keyscan of web and add that to the known_hosts file.

I think you need to do that anyway, since the known_hosts module expects you to pass the key. It does not auto-detect the fingerprint.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.