Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to add github.com to the known_hosts file from the command line as I am creating a puppet manifest to provision a remote server.

I have tried:

"ssh-keyscan -H github.com > /home/ubuntu/.ssh/known_hosts"

But when the server tries to access github:

Failed to add the RSA host key for IP address '207.97.227.239' to the list 
of known hosts (/home/ubuntu/.ssh/known_hosts).

I've also tried:

"ssh-keyscan -H github.com,207.97.227.239 > /home/ubuntu/.ssh/known_hosts"`

But accessing github throws:

Host key verification failed.

I'm sure this is of no additional use but if I ssh my server and then ssh github and follow the steps I get the following message Permanently added 'github.com,207.97.227.239' (RSA) to the list of known hosts and then it will work perfectly.

Thanks

share|improve this question
1  
The 'failed to add' message indicates there could be a permissions issue on /home/ubuntu/.ssh/known_hosts. Is it writable by your user? –  Aaron Copley Jul 19 '12 at 17:29
    
You would most likely want >> to append instead of > to overwrite. –  Dennis Williamson Jul 20 '12 at 15:12
add comment

1 Answer

up vote 8 down vote accepted

We handle this problem by putting the known_hosts file on the puppet server and serving the file directly out of puppet:

file{
  "/home/appuser/.ssh/known_hosts":
  owner => "appuser",
  group => "appuser",
  mode => 755,
  source => "puppet:///modules/ssh/known_hosts",
  require => File["/home/appuser"];
}

This copies the correctly formatted known_hosts file from the puppet repo, sets the user accordingly, and ensures it has correct permissions. Works well for us.

share|improve this answer
1  
Out of curiosity, why are you not using the sshkey resource to publish key(s) directly to the system wide known_hosts file? –  Zoredache Jul 19 '12 at 18:38
    
@Zoredache Because I'd never heard of that facility before. –  sysadmin1138 Jul 19 '12 at 18:43
1  
Ah, I like the sshkey better then replacing the entire file since it allows me to add/remove individual keys and still permitting local changes, which is somewhat needed in my environment. –  Zoredache Jul 19 '12 at 18:50
1  
Thanks that work a treat! @Zoredache sshkey looks great but it would be nice if it would let you specify directory/file name! –  user71736 Jul 20 '12 at 7:28
    
sshkey does let you specify the directory/file name. Just use target => "fullpath/to/filename" –  Jistanidiot Jan 14 '13 at 18:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.