32

I'm running an Ansible playbook with a subtle hack to work on an arbitrary port forwarded port (so I can use one machine with no direct access to lots of machines).

I've got a pre-task to change the ansible_port variable, so then when I start running my real tasks and roles, I get prompted to accept the hostkeys for localhost on some random port.

Because I am naive and don't care about security, I would like ssh to auto-accept and redirect to /dev/null (or another file for logging).

Is this possible?

1
  • You can do it through ssh options you pass to the ansible config. – Jiri Klouda Mar 30 '17 at 15:23
36

This is typically done by setting the following value in ansible.cfg:

[defaults]
host_key_checking = False

If you don't want to modify ansible.cfg you can set an environment variable like so:

export ANSIBLE_HOST_KEY_CHECKING=False

Source: http://docs.ansible.com/ansible/intro_getting_started.html#host-key-checking

2
  • I am using MacOS and setting host_key_checking=False but I still got "WARNING: POSSIBLE DNS SPOOFING DETECTED!". I fixed this after I realized that I connected to a target host of the same name earlier and then rebuilt it so there was an old key in ./ssh/known_hosts. – Chad Juliano Aug 2 '19 at 1:19
  • 1
    Note tht this does not answer the question, even though it might appear to. This will stop prompts to accept new host keys, but it will save each host key for future connections in known_hosts. What the question wants is " ssh to auto-accept and redirect to /dev/null". The other answer provides the correct solution. – JBentley Nov 24 '20 at 14:53
26

In your ansible.cfg file you need to add the following line:

ssh_args = -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no

You could also add those options in your ~/.ssh/config on every machine from which you run it something like this:

Host *
   StrictHostKeyChecking no
   UserKnownHostsFile=/dev/null
7
  • 1
    This should work. Also, look at the ansible.cfg file for more settings :) – Dawny33 Mar 30 '17 at 16:32
  • 1
    Is there an appropriate way to set that inside the playbook? I've tried ansible_ssh_common_args and ansible_ssh_extra_args and it doesn't override what I've got in the ansible.cfg. I've got an ansible.cfg that I use for everything else and would rather just override those parameters for this type of playbook than copy it just to make that change. – Peter Turner Mar 30 '17 at 18:03
  • 3
    I can't speak to those variables, Peter, but you could put a modified ansible.cfg in the directory with this playbook, and it will take precedence. – Woodland Hunter Mar 30 '17 at 21:37
  • 1
    UserKnownHostsFile=/dev/null completly break ssh security – mmv-ru Feb 3 '18 at 19:19
  • 1
    @mmv-ru That depends on the context . Not everyone uses ssh for the standard "connect to remote machine" scenario. E.g. it's common to use constantly-recycled Vagrant boxes for testing. If you use StrictHostKeyChecking = no without UserKnownHostsFile=/dev/null you will pollute known_hosts with useless keys. This creates an attack surface: anyone who gets their hand on one of your Vagrant boxes has a public key which your SSH client will accept from remote hosts. If instead the key is discarded every time, then your soon-to-be-recycled Vagrant box leaves no lasting trace on your system. – JBentley Nov 24 '20 at 15:02
2

There are boolean variables for this that can be set where they're needed (such as in playbooks) so as not to do this globally, which reduces overall security.

    var: ansible_host_key_checking
    var: ansible_ssh_host_key_checking
    var: ansible_paramiko_host_key_checking

So doing ansible_ssh_host_key_checking: False in a playbook should work.

However, I don't believe they'll work until Ansible 2.12. See Disabling host key checking via variable doesn't seem to work. #49254 for details.

For now, I'd recommend doing this:

ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook ...

...and not setting this in the global Ansible configuration. It's a good idea to be explicit when disabling security features so that you're aware of what you're doing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.