How to Ignore Ansible SSH Host Key Checking?
SSH Host Key
% ssh devops@demo.example.com The authenticity of host 'demo.example.com (192.168.0.190)' can't be established. RSA key fingerprint is SHA256:42JErOjO9fKNNBapEEyhpfTNn+rt8SPNob00uRlmqRs. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])?
A host key is a cryptographic key used for authenticating computers in the SSH protocol. Host keys are normally generated automatically when OpenSSH is first installed or when the computer is first booted. In a production environment is considered a security mechanism to verify our machine has not been altered. However, in a developer laboratory often, we need to destroy our machines often and recreate them. This behavior stops the Ansible execution and requires some manual developer work. We can apply this behavior also in a CI/CD pipeline or cloud computing provider.
Links
Playbook
How to Ignore Ansible SSH Host Key Checking in our Ansible laboratory. I'm going to show how to create a ansible.cfg file to ignore the SSH Host Key Checking at the beginning of the Ansible Playbooks execution.
- ansible.cfg
[defaults]
host_key_checking = False
- ping.yml
---
- name: ping module Playbook
hosts: all
tasks:
- name: test connection
ansible.builtin.ping:
- inventory
demo.example.com
execution
$ ansible-playbook -i inventory ping.yml
PLAY [ping module Playbook] *****************************************************************
TASK [Gathering Facts] ******************************************************************
ok: [demo.example.com]
TASK [test connection] ******************************************************************
ok: [demo.example.com]
PLAY RECAP ******************************************************************************
demo.example.com : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
idempotency
$ ansible-playbook -i inventory ping.yml
PLAY [ping module Playbook] *****************************************************************
TASK [Gathering Facts] ******************************************************************
ok: [demo.example.com]
TASK [test connection] ******************************************************************
ok: [demo.example.com]
PLAY RECAP ******************************************************************************
demo.example.com : ok=2 changed=0 unreachable=0 failed=0
before execution
$ ansible-playbook -i inventory ping.yml
PLAY [ping module Playbook] *****************************************************************
TASK [Gathering Facts] ******************************************************************
The authenticity of host 'demo.example.com (192.168.0.190)' can't be established.
RSA key fingerprint is SHA256:42JErOjO9fKNNBapEEyhpfTNn+rt8SPNob00uRlmqRs.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])?
after execution
$ ansible-playbook -i inventory ping.yml
PLAY [ping module Playbook] *****************************************************************
TASK [Gathering Facts] ******************************************************************
ok: [demo.example.com]
TASK [test connection] ******************************************************************
ok: [demo.example.com]
PLAY RECAP ******************************************************************************
demo.example.com : ok=2 changed=0 unreachable=0 failed=0
Conclusion
Now you know how to ignore SSH Host Key checking with Ansible. You know how to use it based on your use case.