Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to clone a repo in a non-interactive way. When cloning, git asks to confirm host's fingerprint:

The authenticity of host 'bitbucket.org (207.223.240.182)' can't be established.
RSA key fingerprint is 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40.
Are you sure you want to continue connecting (yes/no)? no

How do I force "yes" every time this questions pops up? I tried using yes yes | git clone ..., but it doesn't work.

EDIT: Here's a solution: Can I automatically add a new host to known_hosts? (adds entires to known_hosts with ssh-keyscan).

share|improve this question
    
Doesn't bitbucket have access to git via http or https ? Would be strange to not add it, considering the amount of nazi firewalls blocking everything but HTTP. –  BatchyX Feb 3 '13 at 9:51
    
Interesting to see that even after two years this question does not have a proper answer. There are few other cases where git will prompt, for example if you try to clone over http and the server is asking for basic_auth. How to do this in non-interactice mode? –  sorin Oct 23 at 12:06

5 Answers 5

While I certainly understand that you want to automate such a process, doing so would be ill-advised. The reason why SSH and related networking subcomponents balk when using a secure protocol is to WARN a human that a system's public key is unknown. This is intentional - the user needs to explicitly inform the system the host is expected. You wouldn't want to auto accept every public key presented to you or part of the security in SSH or TLS/SSL could be compromised. One example is via a man-in-the-middle attack such as when a proxy software presents it's own key in the place of a host you expect.

Proceed with caution.

If you have no fear about the source of the code across the wire, you should explicitly and exclusively use the git:// protocol when cloning - it's authenticationless and in clear text.

share|improve this answer
    
I can definitively see use cases where we need to enforce non-interactive uses of git clone... and that doesn't mean we require to accept any check (the fingerprint one in particular). In my case, I would be perfectly glad to fail automatically on such thing. –  vaab Apr 11 at 11:04

I believe a better option here is to back up and empty your ~/.ssh/known_hosts file, manually perform the SSH connection, verifying the IP address and fingerprint, mv ~/.ssh/known_hosts ~/bitbucket_hosts, then use the contents of ~/bitbucket_hosts in your script to automatically append the known fingerprints to the known_hosts file (don't forget to restore the original ~/.ssh/known_hosts).

This step only needs to be performed once (on any machine, I believe), and once you have the fingerprints, you can incorporate it in to your automation script.

share|improve this answer

As Jeff Hall said, doing so is dangerous as it allows undetected man-in-the-middle attacks. However, you could use the StrictHostKeyChecking no option in ssh to disable checking the host keys. However, I'd be very careful with that option if I were you.

share|improve this answer

One nice option is to temporarily answer yes for the RSA fingerprint check on a specific clone:

yes "yes" | git clone http://bitbucket.org...
share|improve this answer
    
did not work for me with github git@ address –  kroe Oct 31 at 4:51
1  
@kroe error message? write access on the repo? –  hobs Oct 31 at 23:49
    
my bad, i did not post the error code. –  kroe Nov 2 at 4:12

On my end i fixed the issue with:

ssh-keyscan github.com >> ~/.ssh/known_hosts

I don't think that is the best solution, but it was a solution for me.

Just change the domain name.

share|improve this answer
    
@Falcon Momot, why did you edit my answer? Just to take a smile out and fix the "j" case? haha Are you a bot? –  kroe Nov 19 at 14:15
1  
It came up in a review queue. Just minor edits for style. –  Falcon Momot Nov 19 at 22:06
    
cool i did not even knew review queues exists... –  kroe Nov 20 at 0:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.