Cannot handle SSH host authenticity prompts for multiple hosts #25068
Assignees
Labels
affects_2.4
This issue/PR affects Ansible v2.4
bug
This issue/PR relates to a bug.
c:plugins/connection/ssh
needs_verified
This issue needs to be verified/reproduced by maintainer
P3
Priority 3 - Approved, No Time Limitation
support:core
This issue/PR relates to code supported by the Ansible Engineering Team.
Comments
ansibot
added
affects_2.4
bcoca
removed
the
needs_triage
|
sounds like known_host locking is broken |
ansibot
added
the
support:core
|
Is there any solution available for this? |
|
@timwhitlock @philipobrien If you have it, could you provide the ansible output with -vvvv verbosity when hitting this issue? This is using the 'ssh' connection plugin? (ie, not paramiko...) |
alikins
added
the
needs_info
|
@alikins I don't think I'm using a plugin, just standard ssh access, but I could be wrong. My Vagrant file is basically just and my ansible hosts as defined in Then I just typing 'yes' just gets me a new prompt of which never responds
but finally fails when I just hit return without typing 'yes' |
|
@philipgough Does it help to turn off strict host key checking as a workaround? |
|
Just add this:
to /etc/ansible/hosts "[servers_group:vars]" |
|
@timwhitlock This issue is waiting for your response. Please respond or the issue will be closed. |
|
The |
ansibot
removed
the
needs_info
|
Getting the same trying to ssh to 2 docker workers this morning. |
|
Same for me, I will try to add |
|
Hello, I just stumbled upon this issue. I think that Of course you will need to pass (Side note: IIRC I read somewhere in ansible docs that if at least one host does not have SSH key in |
|
|
|
Where to add that --forks 1 in ansible |
For a one time execution, you can add the parameter during the playbook execution ( |
|
Curious as to what the status of this is. Obviously open but still hyper annoying to keep one prompts output from clobbering the second prompts output and only getting the "last" host in the list. Also, it is clearly reachable, a more clear error message on the rejection would be helpful.
so does CRTL-C and do again and the playbook will run (add one, then the other) which I do more often cause I forget |
s-hertel
added
needs_verified
|
Encountered this issue today. The workaround I used was to run it with only one host, accept the key, cancel the run, then repeat for each host. Once all the keys are added I can run with all hosts at once. |
|
If you're blindly accept keys, the following might work for you. It's from a test setup with a bastion host (https://github.com/konstruktoid/publications/blob/master/bastion/README.md#automatically-accepting-ssh-host-keys) so you'll have to modify it of course. - hosts: bastion
serial: 1
any_errors_fatal: true
tasks:
- name: ssh keyscan bastion hosts from localhost
delegate_to: localhost
lineinfile:
dest: ~/.ssh/known_hosts
create: 'yes'
state: present
mode: '0600'
line: "{{ lookup('pipe', 'ssh-keyscan -H' + ' ' + hostvars[item]['ansible_host']) }}"
with_items:
- "{{ groups['bastion'] }}"
- name: ssh keyscan internal hosts from localhost
delegate_to: localhost
lineinfile:
dest: ~/.ssh/known_hosts
create: 'yes'
state: present
mode: '0600'
line: "{{ lookup('pipe', 'ssh-keyscan -H' + ' ' + hostvars[item]['ansible_host']) }}"
ignore_errors: true
with_items:
- "{{ groups['internal']|reverse|list }} "
- name: ssh keyscan internal hosts from bastion01
delegate_to: bastion01
lineinfile:
dest: ~/.ssh/known_hosts
create: 'yes'
state: present
mode: '0600'
line: "{{ lookup('pipe', 'ssh-keyscan -H' + ' ' + hostvars[item]['ansible_host']) }}"
ignore_errors: true
with_items:
- "{{ groups['internal']|reverse|list }} " |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
ISSUE TYPE
COMPONENT NAME
SSH connection
ANSIBLE VERSION
Same for
stable-2.3CONFIGURATION
defaults
OS / ENVIRONMENT
Host: Mac OS 10.11.6
Managing VM: CentOS 7 / Vagrant
SUMMARY
When running against multiple (new) hosts that have no entry in
.ssh/known_hoststhe "authenticity" prompts are all output at once to the command line. Entering "yes" to continue connecting does not work and simply receives the prompt again "Please type 'yes' or 'no':"The problem does not exist when running against a single host. The entry "yes" is accepted.
STEPS TO REPRODUCE
Run any ansible command that connects via SSH against two or more hosts where the hosts are not present in the
.ssh/known_hostsfile.EXPECTED RESULTS
Expected OS prompts to be queued, accepting user input of "yes", before proceeding to the next prompt.
ACTUAL RESULTS
Example using two hosts:
The text was updated successfully, but these errors were encountered: