I am creating a bash script to provision a new server that I can deploy a web application to. One thing I always have to do is as GitHub as a known host using ssh [email protected]
. How can I automate this process in a bash script, and do it in an idempotent way?
3 Answers
The simple way to go would be to do something like this.
ssh-keyscan remote_server >>~/.ssh/known_hosts
If this box is brand new you might also need to create the ~/.ssh
directory before you run ssh-keyscan.
Keep in mind that ssh-keyscan can take an arbitrary number of hostnames. It will get all the keys it can.
-
1PS - For provisioning you should be using something like puppet instead of a bash script. For puppet this could be easily handled with the sshkey resource. Also see this question for a method to manage the known_hosts en-masse serverfault.com/a/416782/984 Dec 14, 2013 at 0:40
-
2That sure sounded good to me, but after spending a few hours apiece on puppet and competitors, I scurried back to bash scripts and sanity. If those tools are intuitive, I apparently have no intuition. YMMV.– Ron BurkApr 8, 2016 at 19:32
-
Use bash. I constantly run into issues across different versions of things like puppet or ansible. We always go back to bash... 3 companies running now like this and bash is always reliable for us. Sep 21, 2016 at 23:05
Are you trying to automate accepting the new key? If so, you could use -oStrictHostKeyChecking=no.
Doing so is a very bad idea as you're now completely wide open to man-in-the-middle attacks.
A better option would be just to manage a known_hosts file and reuse that file when you provision new servers. Stick it on github and write a simple script to download that file before sshing into github.
The strict host key checking is a good thing.
-
Can you elaborate on the "manage known_hosts file"? I think that's what I want to do, but when I viewed the file, it's contents looked like some sort of hash/key and didn't look like something that was intended to be managed manually.– AndrewDec 5, 2013 at 2:03
-
2Provision a new server, manually ssh into github like you would. Accept the host key when prompted. Log out. Copy ~/.ssh/known_hosts from that newly provisioned server somewhere else (github, web server, doesn't matter as long as you can get it). Next time you provision a server, copy that file back before sshing to github. You don't need to edit the file.– user143703Dec 5, 2013 at 2:32
-
This is better than my answer (safer). A further improvement on yoonix's answer though is to parse 'ssh-keyscan github.com' and store the returned key into ~/.ssh/known_hosts that way it isn't static in a file somewhere for you to need to update.– SirexDec 5, 2013 at 2:45
-
That would work too, but I wouldn't consider it better. You're potentially setting yourself up for a man-in-the-middle attack if you're grabbing a new host-key every time.– user143703Dec 5, 2013 at 3:05
-
1To clarify my last comment (too late to edit): Grabbing a new host-key each time you provision a host is functionally no different than setting StrictHostKeyChecking=no. With either of them you're blindly trusting whatever key gets sent each time you provision. If you think a MITM attack to be unlikely, read these two articles. Github would be a HUGE target.– user143703Dec 5, 2013 at 3:16
I'm not sure i understand the question, but i think you want to ignore the known_host prompt or avoid it entirely, in which case:
ssh -o StrictHostKeyChecking=no
or other suggestions at: http://www.joedog.org/2012/07/ssh-disable-known_hosts-prompt/