# Ansible and strict SSH key checking

**URL:** <https://forum.ansible.com/t/ansible-and-strict-ssh-key-checking/13062>\
**Category:** Ansible Project\
**Created:** [July 3, 2013, 9:02pm UTC](https://forum.ansible.com/t/ansible-and-strict-ssh-key-checking/13062 "2013-07-03T21:02:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [July 3, 2013, 9:02pm UTC](https://forum.ansible.com/t/ansible-and-strict-ssh-key-checking/13062/1 "2013-07-03T21:02:10Z")

</div>

Various folks did not like the fact that we disabled strict SSH host key checking to more easily enable reprovisioning related use cases. Their concerns are valid, and we should have a way to control this behavior.

In the latest 1.3, Strict checking is now on by default for both paramiko and SSH connection types.

Should you wish to disable this, you can, by either

export ANSIBLE\_HOST\_KEY\_CHECKING=False

or in the config file

[defaults]  
host\_key\_checking=False

I plan to cherry-pick this commit to 1.2 and cut a 1.2.1 containing only this change providing this works for everyone.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [July 4, 2013, 6:50pm UTC](https://forum.ansible.com/t/ansible-and-strict-ssh-key-checking/13062/2 "2013-07-04T18:50:01Z")

</div>

I have just pushed some additional code so that paramiko in checking mode will ask whether or not to add the host key to known hosts.

This behavior now corresponds with what you get with OpenSSH, and the message is very similar.

If folks would like to help test (as I’ve also asked IRC) that would be nice, and I hope to cut a 1.2.1 release with just this change tonight.

Feedback welcome.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [July 4, 2013, 7:30pm UTC](https://forum.ansible.com/t/ansible-and-strict-ssh-key-checking/13062/3 "2013-07-04T19:30:06Z")

</div>

Just pushed a few more updates related to file closure warnings on Ubuntu.

Please help test, especially the paramiko mode with checking enabled.

Thanks!

---

<div class="post-metadata">

**Author:** ![Govinda\_Fichtner](https://avatars.discourse-cdn.com/v4/letter/g/3e96dc/32.png) [@Govinda\_Fichtner](https://forum.ansible.com/u/Govinda_Fichtner)\
**Post date:** [January 11, 2015, 8:32pm UTC](https://forum.ansible.com/t/ansible-and-strict-ssh-key-checking/13062/4 "2015-01-11T20:32:52Z")

</div>

It would really nice if it would be possible to control this on the group\_var or host\_var level, too. So instance for dev environments with vagrant one could just disable host key checking but for production environments it would still work…