2

I'm new with ansible and I created small ansible-playbook, that adds github ssh host key to known_hosts in each server:

---
- hosts: all
  tasks:
  - name: Add github to ssh known-hosts
    known_hosts:
     name: "TS_github"
     key: "github.com,192.30.252.129 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="

But, for some reasons, this playbook fails for every host with error:

fatal: [clusterapp-1]: FAILED! => {"changed": false, "cmd": "/usr/bin/ssh-keygen -F TS_github -f /tmp/tmpgROT5p", "failed": true, "msg": "", "rc": 1, "stderr": "", "stdout": "", "stdout_lines": []}

For some reasons it uses /tmp/tmpgROT5p as a keyfile, which is false for obvious reasons. As stated in ansible doc known_hosts module should use "(homedir)+/.ssh/known_hosts", but it doesn't happened.

I start playbook as follows:

 ansible-playbook -i hosts github_keys.yml

I also tried to start playbook with -vvv key, but I didn't get any useful information.

My ansible.cfg file:

[defaults]
transport=ssh
host_key_checking=false
7
  • "For some reasons it uses /tmp/tmpgROT5p as a keyfile, which is false for obvious reasons." I don't think the reasons are obvious. Ansible likely saves the key to a temporary file during the execution of the task. Is your /tmp writeable?
    – ceejayoz
    Apr 27, 2016 at 15:30
  • @ceejayoz Yes, it is writeable. But I think that ssh-keygen expect that /tmp/tmpgROT5p already exist, because I run this command manually /usr/bin/ssh-keygen -F TS_github -f /tmp/tmpgROT5p and have the following output: ssh-keygen: /tmp/tmpgROT5p: No such file or directory
    – toshyak
    Apr 27, 2016 at 15:36
  • Ansible is almost certainly creating that file in /tmp/ before running ssh-keygen. Try creating the file with the contents of the public key and run the command manually - see if it works or errors out.
    – ceejayoz
    Apr 27, 2016 at 15:37
  • 2
    I think your problem may be the github.com,192.30.252.129 bit at the beginning of your key. docs.ansible.com/ansible/known_hosts_module.html says key should be just the key. The github.com bit should go in the name argument instead.
    – ceejayoz
    Apr 27, 2016 at 16:05
  • 1
    @ceejayoz not exact, but you gave me right direction for answer: name should be github.com and key should be github.com,192.30.252.129 ssh-rsa AAAAB3NzaC1yc2EAA... And then everything works perfect, thanks!
    – toshyak
    Apr 28, 2016 at 12:50

3 Answers 3

4

The name should be the name of the host.

So in your case, the name needs to be github.com and key should be github.com,192.30.252.129 ssh-rsa AAAAB3NzaC1yc2EAA...

---
- hosts: all
  tasks:
  - name: Add github to ssh known-hosts
    known_hosts:
     name: github.com
     key: "github.com,192.30.252.129 ssh-rsa AAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
1

As an alternative you can use a .ssh/config file for the specific user to ignore the known_hosts if you are just trying to avoid being prompted and this falls withing your security requirements.

Host * StrictHostKeyChecking no

0

A possible workaround could be to use blockinfile.

  - name: Add github to ssh known-hosts
    blockinfile:
      path: ~/.ssh/known_hosts
      block: "github.com,192.30.252.129 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
      marker: "# {mark} github"

Sure, using known_hosts is the recommended way to go, but this one is working quite well. Also suitable for managing /etc/hosts

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .