Problem: Current Develop Docker Build breaking SSH Hostkey Checking about semaphore

[Fabl0s]

Hi @Fabl0s

If a new host is not in ‘known_hosts’ your control node may prompt for confirmation of the key, which results in an interactive experience if using Ansible, from say, cron.

It is why this scenario doesn't work. I tried disable interactive but it breaks authentication by login/password.

"Why Semaphore hangs" - most frequently asked question.

I think I never had any interactive parts when using ssh flag "accept-new" - Ansible would just fail that single node in a run when we replaced a node. Maybe that can be an option?

However, could Key-Checking still be some sort of opt-in for those who want it and dont use Password Logins anyway?

[fiftin]

Hi @Fabl0s
Did you try to add environment variable ANSIBLE_HOST_KEY_CHECKING=True?

[Fabl0s]

Hi @Fabl0s Did you try to add environment variable ANSIBLE_HOST_KEY_CHECKING=True?

Not via Variable, I added it to my ansible.cfg as a workarround for now and it does work that way.
I can also check via EnvVar but I'd expect the same result.
But I would much preferr to auto-accept new keys and deny changed keys as a default over no checking at all.
At least as an opt-in if you absolutely want to keep it off by default.

My point about this beeing not Ideal still stands regarding Security:

Ansible enables host key checking by default. Checking host keys guards against server spoofing and man-in-the-middle attacks, but it does require some maintenance.

https://docs.ansible.com/ansible/latest/inventory_guide/connection_details.html#managing-host-key-checking

A more secure default should be kept if its already there in ansible imo.
It also can cause issues with enterprises security compliance aswell.

[fiftin]

Hi @Fabl0s

If a new host is not in ‘known_hosts’ your control node may prompt for confirmation of the key, which results in an interactive experience if using Ansible, from say, cron.

It is why this scenario doesn't work. I tried disable interactive but it breaks authentication by login/password.

"Why Semaphore hangs" - most frequently asked question.