I'm running an Ansible playbook with a subtle hack to work on an arbitrary port forwarded port (so I can use one machine with no direct access to lots of machines).

I've got a pre-task to change the ansible_port variable, so then when I start running my real tasks and roles, I get prompted to accept the hostkeys for localhost on some random port.

Because I am naive and don't care about security, I would like ssh to auto-accept and redirect to /dev/null (or another file for logging).

Is this possible?

  • You can do it through ssh options you pass to the ansible config. – Jiri Klouda Mar 30 '17 at 15:23

This is typically done by setting the following value in ansible.cfg:

host_key_checking = False

If you don't want to modify ansible.cfg you can set an environment variable like so:


Source: http://docs.ansible.com/ansible/intro_getting_started.html#host-key-checking

  • I am using MacOS and setting host_key_checking=False but I still got "WARNING: POSSIBLE DNS SPOOFING DETECTED!". I fixed this after I realized that I connected to a target host of the same name earlier and then rebuilt it so there was an old key in ./ssh/known_hosts. – Chad Juliano Aug 2 '19 at 1:19
  • Note tht this does not answer the question, even though it might appear to. This will stop prompts to accept new host keys, but it will save each host key for future connections in known_hosts. What the question wants is " ssh to auto-accept and redirect to /dev/null". The other answer provides the correct solution. – JBentley Nov 24 '20 at 14:53

In your ansible.cfg file you need to add the following line:

ssh_args = -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no

You could also add those options in your ~/.ssh/config on every machine from which you run it something like this:

Host *
   StrictHostKeyChecking no
  • 1
    This should work. Also, look at the ansible.cfg file for more settings :) – Dawny33 Mar 30 '17 at 16:32
  • +1 for Dawny's addition, because those using Paramiko will need to use ansible.cfg – Woodland Hunter Mar 30 '17 at 17:19
  • 1
    Is there an appropriate way to set that inside the playbook? I've tried ansible_ssh_common_args and ansible_ssh_extra_args and it doesn't override what I've got in the ansible.cfg. I've got an ansible.cfg that I use for everything else and would rather just override those parameters for this type of playbook than copy it just to make that change. – Peter Turner Mar 30 '17 at 18:03
  • 3
    I can't speak to those variables, Peter, but you could put a modified ansible.cfg in the directory with this playbook, and it will take precedence. – Woodland Hunter Mar 30 '17 at 21:37
  • 1
    UserKnownHostsFile=/dev/null completly break ssh security – mmv-ru Feb 3 '18 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.