ssh - ansible ssh提示known_hosts问题

Question

我正在运行 Ansible playbook，它在一台机器上运行良好。

在新机器上第一次尝试时，出现以下错误。

17:04:34 PLAY [appservers] ************************************************************* 
17:04:34 
17:04:34 GATHERING FACTS *************************************************************** 
17:04:34 fatal: [server02.cit.product-ref.dev] => {'msg': "FAILED: (22, 'Invalid argument')", 'failed': True}
17:04:34 fatal: [server01.cit.product-ref.dev] => {'msg': "FAILED: (22, 'Invalid argument')", 'failed': True}
17:04:34 
17:04:34 TASK: [common | remove old ansible-tmp-*] ************************************* 
17:04:34 FATAL: no hosts matched or all hosts have already failed -- aborting
17:04:34 
17:04:34 
17:04:34 PLAY RECAP ******************************************************************** 
17:04:34            to retry, use: --limit @/var/lib/jenkins/site.retry
17:04:34 
17:04:34 server01.cit.product-ref.dev      : ok=0    changed=0    unreachable=1    failed=0   
17:04:34 server02.cit.product-ref.dev      : ok=0    changed=0    unreachable=1    failed=0   
17:04:34 
17:04:34 Build step 'Execute shell' marked build as failure
17:04:34 Finished: FAILURE

如果我首先转到源计算机(从运行 ansible playbook 的位置)并手动 ssh 到目标计算机(作为给定用户)并为known_hosts 文件条目输入“yes”，则可以解决此错误.

现在，如果我第二次运行相同的 ansible playbook，它就可以正常工作而不会出现错误。

因此，如何在首次为给定用户(~/.ssh 文件夹、文件known_hosts)输入 sshknown_hosts 时抑制 SSH 给出的提示？

我发现如果我在 ~/.ssh/config 文件中使用以下配置条目，我就可以做到这一点。

~/.ssh/config

# For vapp virtual machines
Host *
  StrictHostKeyChecking no
  UserKnownHostsFile=/dev/null
  User kobaloki
  LogLevel ERROR

即如果我将上述代码放在远程计算机的用户的 ~/.ssh/config 文件中并第一次尝试 Ansible playbook，则不会提示我输入“yes”并且 playbook 将成功运行(不需要用户手动创建从源计算机到目标/远程计算机的known_hosts 文件条目)。

我的问题:1. 如果我采用 ~/.ssh/config 方式，我应该注意哪些安全问题2.如何在命令行将设置(配置文件中的内容)作为参数/选项传递给ansible，以便它首次在新机器上运行(不提示/取决于源机器上的known_hosts文件条目对于目标机器？

Answer 1

ansible 文档有 a section on this 。引用:

Ansible has host key checking enabled by default.

If a host is reinstalled and has a different key in ‘known_hosts’,this will result in an error message until corrected. If a host is notinitially in ‘known_hosts’ this will result in prompting forconfirmation of the key, which results in an interactive experience ifusing Ansible, from say, cron. You might not want this.

If you understand the implications and wish to disable this behavior,you can do so by editing /etc/ansible/ansible.cfg or ~/.ansible.cfg:

[defaults]
host_key_checking = False

Alternatively this can be set by the ANSIBLE_HOST_KEY_CHECKINGenvironment variable:

$ export ANSIBLE_HOST_KEY_CHECKING=False

Also note that host key checking in paramiko mode is reasonably slow, therefore switching to ‘ssh’ is also recommended when using this feature.