4

I've followed the recommendations I could find to prevent this from happening. I am using Vagrant, but once the boxes are spun, I'd like to do things with the ansible command sometimes.

$ grep host_key /etc/ansible/ansible.cfg                                                                                                               
host_key_checking = False

$ grep kafka01 ./inventory
kafka01 ansible_host=127.0.0.1 ansible_port=2231 ansible_user='vagrant' ansible_ssh_private_key_file='/home/me/project/project/.vagrant/machines/kafka01/virtualbox/private_key' ansible_ssh_common_args='-o StrictHostKeyChecking=no'

$ export ANSIBLE_HOST_KEY_CHECKING=False
$ ansible kafka01 -m ping -i ./inventory                                                                                                               

 [WARNING]: Unhandled error in Python interpreter discovery for host kafka01: Failed to connect to the host via ssh: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  @    WARNING:
REMOTE HOST IDENTIFICATION HAS CHANGED!     @  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!  Someone could be eavesdropping on
you right now (man-in-the-middle attack)!  It is also possible that a host key has just been changed.  The fingerprint for the ECDSA key sent by the remote host is
SHA256:jn5ClU5g566Gsvobf8Xc45DJnIiAllN+RJkg35Nf9KE.  Please contact your system administrator.  Add correct host key in /home/me/.ssh/known_hosts to get rid of this message.  Offending ECDSA key
in /home/me/.ssh/known_hosts:19    remove with:    ssh-keygen -f "/home/me/.ssh/known_hosts" -R "[127.0.0.1]:2231"  ECDSA host key for [127.0.0.1]:2231 has changed and you have requested strict
checking.  Host key verification failed.

kafka01 | UNREACHABLE! => {
.....

What's going on here?

Edit: No, I don't want to keep deleting the key. I destroy/build these over and over again. I want to find the correct, long-term solution.

6
  • 2
    It is also possible that a host key has just been changed. try to remove the client entry in /home/me/.ssh/known_hosts
    – Siva
    Apr 9 '20 at 4:43
  • ... by the command proposed in the message ssh-keygen -f "/home/me/.ssh/known_hosts" -R "[127.0.0.1]:2231 Apr 9 '20 at 8:22
  • @msp9011 That's the obvious answer, right? Problem is after I destroy then rebuild the keys have changed again. I don't want to keep deleting them.
    – HorseHair
    Apr 9 '20 at 15:10
  • @msp9011 only /etc/ansible/
    – HorseHair
    Apr 10 '20 at 20:33
  • can u plz share version of ansible
    – Siva
    Apr 11 '20 at 3:50
4

You can add this in inventory:

ansible_ssh_common_args="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"

It's ignoring check host and setting /dev/null as Known host file.

1
  • Please explain what this will do and remove the spaces at the beginning of the code block
    – 030
    May 6 '20 at 5:56
2

An alternative sintax to Dilson Rainov's answer, more ansible 2.x style (I think).

In your inventory define the host as:

vagrant-local:
      ansible_host: 192.168.33.10
      ansible_user: vagrant
      ansible_ssh_private_key_file: .vagrant/machines/default/virtualbox/private_key
      UserKnownHostsFile: /dev/null
      StrictHostKeyChecking: no
      ansible_python_interpreter: /usr/bin/python3
  • UserKnownHostsFile causes the check of the host fingerprint on an always empty file (replacing the check inside ~/.ssh/known_hosts)
  • StrictHostKeyChecking allows ssh to connect without the user confirming the detected fingerprint from the vagrant host

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.