I'm new with ansible and I created small ansible-playbook, that adds github ssh host key to known_hosts in each server:

- hosts: all
  - name: Add github to ssh known-hosts
     name: "TS_github"
     key: "github.com, ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="

But, for some reasons, this playbook fails for every host with error:

fatal: [clusterapp-1]: FAILED! => {"changed": false, "cmd": "/usr/bin/ssh-keygen -F TS_github -f /tmp/tmpgROT5p", "failed": true, "msg": "", "rc": 1, "stderr": "", "stdout": "", "stdout_lines": []}

For some reasons it uses /tmp/tmpgROT5p as a keyfile, which is false for obvious reasons. As stated in ansible doc known_hosts module should use "(homedir)+/.ssh/known_hosts", but it doesn't happened.

I start playbook as follows:

 ansible-playbook -i hosts github_keys.yml

I also tried to start playbook with -vvv key, but I didn't get any useful information.

My ansible.cfg file:

  • "For some reasons it uses /tmp/tmpgROT5p as a keyfile, which is false for obvious reasons." I don't think the reasons are obvious. Ansible likely saves the key to a temporary file during the execution of the task. Is your /tmp writeable? – ceejayoz Apr 27 '16 at 15:30
  • @ceejayoz Yes, it is writeable. But I think that ssh-keygen expect that /tmp/tmpgROT5p already exist, because I run this command manually /usr/bin/ssh-keygen -F TS_github -f /tmp/tmpgROT5p and have the following output: ssh-keygen: /tmp/tmpgROT5p: No such file or directory – toshyak Apr 27 '16 at 15:36
  • Ansible is almost certainly creating that file in /tmp/ before running ssh-keygen. Try creating the file with the contents of the public key and run the command manually - see if it works or errors out. – ceejayoz Apr 27 '16 at 15:37
  • 2
    I think your problem may be the github.com, bit at the beginning of your key. docs.ansible.com/ansible/known_hosts_module.html says key should be just the key. The github.com bit should go in the name argument instead. – ceejayoz Apr 27 '16 at 16:05
  • 1
    @ceejayoz not exact, but you gave me right direction for answer: name should be github.com and key should be github.com, ssh-rsa AAAAB3NzaC1yc2EAA... And then everything works perfect, thanks! – toshyak Apr 28 '16 at 12:50

The name should be the name of the host.

So in your case, the name needs to be github.com and key should be github.com, ssh-rsa AAAAB3NzaC1yc2EAA...

- hosts: all
  - name: Add github to ssh known-hosts
     name: github.com
     key: "github.com, ssh-rsa AAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
| improve this answer | |

As an alternative you can use a .ssh/config file for the specific user to ignore the known_hosts if you are just trying to avoid being prompted and this falls withing your security requirements.

Host * StrictHostKeyChecking no

| improve this answer | |

A possible workaround could be to use blockinfile.

  - name: Add github to ssh known-hosts
      path: ~/.ssh/known_hosts
      block: "github.com, ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
      marker: "# {mark} github"

Sure, using known_hosts is the recommended way to go, but this one is working quite well. Also suitable for managing /etc/hosts

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.