5

I've followed the recommendations I could find to prevent this from happening. I am using Vagrant, but once the boxes are spun, I'd like to do things with the ansible command sometimes.

$ grep host_key /etc/ansible/ansible.cfg                                                                                                               
host_key_checking = False

$ grep kafka01 ./inventory
kafka01 ansible_host=127.0.0.1 ansible_port=2231 ansible_user='vagrant' ansible_ssh_private_key_file='/home/me/project/project/.vagrant/machines/kafka01/virtualbox/private_key' ansible_ssh_common_args='-o StrictHostKeyChecking=no'

$ export ANSIBLE_HOST_KEY_CHECKING=False
$ ansible kafka01 -m ping -i ./inventory                                                                                                               

 [WARNING]: Unhandled error in Python interpreter discovery for host kafka01: Failed to connect to the host via ssh: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  @    WARNING:
REMOTE HOST IDENTIFICATION HAS CHANGED!     @  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!  Someone could be eavesdropping on
you right now (man-in-the-middle attack)!  It is also possible that a host key has just been changed.  The fingerprint for the ECDSA key sent by the remote host is
SHA256:jn5ClU5g566Gsvobf8Xc45DJnIiAllN+RJkg35Nf9KE.  Please contact your system administrator.  Add correct host key in /home/me/.ssh/known_hosts to get rid of this message.  Offending ECDSA key
in /home/me/.ssh/known_hosts:19    remove with:    ssh-keygen -f "/home/me/.ssh/known_hosts" -R "[127.0.0.1]:2231"  ECDSA host key for [127.0.0.1]:2231 has changed and you have requested strict
checking.  Host key verification failed.

kafka01 | UNREACHABLE! => {
.....

What's going on here?

Edit: No, I don't want to keep deleting the key. I destroy/build these over and over again. I want to find the correct, long-term solution.

6
  • 2
    It is also possible that a host key has just been changed. try to remove the client entry in /home/me/.ssh/known_hosts
    – Siva
    Apr 9, 2020 at 4:43
  • ... by the command proposed in the message ssh-keygen -f "/home/me/.ssh/known_hosts" -R "[127.0.0.1]:2231 Apr 9, 2020 at 8:22
  • @msp9011 That's the obvious answer, right? Problem is after I destroy then rebuild the keys have changed again. I don't want to keep deleting them. Apr 9, 2020 at 15:10
  • @msp9011 only /etc/ansible/ Apr 10, 2020 at 20:33
  • can u plz share version of ansible
    – Siva
    Apr 11, 2020 at 3:50

2 Answers 2

5

You can add this in inventory:

ansible_ssh_common_args="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"

It's ignoring check host and setting /dev/null as Known host file.

1
  • Please explain what this will do and remove the spaces at the beginning of the code block
    – 030
    May 6, 2020 at 5:56
4

An alternative sintax to Dilson Rainov's answer, more ansible 2.x style (I think).

In your inventory define the host as:

vagrant-local:
      ansible_host: 192.168.33.10
      ansible_user: vagrant
      ansible_ssh_private_key_file: .vagrant/machines/default/virtualbox/private_key
      UserKnownHostsFile: /dev/null
      StrictHostKeyChecking: no
      ansible_python_interpreter: /usr/bin/python3
  • UserKnownHostsFile causes the check of the host fingerprint on an always empty file (replacing the check inside ~/.ssh/known_hosts)
  • StrictHostKeyChecking allows ssh to connect without the user confirming the detected fingerprint from the vagrant host

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.