# hostkey enhancements to the git module **URL:** \ **Category:** Ansible Project\ **Created:** [January 11, 2014, 4:34pm UTC](https://forum.ansible.com/t/hostkey-enhancements-to-the-git-module/14322 "2014-01-11T16:34:12Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\ **Post date:** [January 11, 2014, 4:34pm UTC](https://forum.ansible.com/t/hostkey-enhancements-to-the-git-module/14322/1 "2014-01-11T16:34:12Z")
I created a new feature in the git module to help with hostkey management and prevent task hangs with unknown keys: [https://github.com/ansible/ansible/commit/8665b0638a1d3a70f985126b0f007a26c81273cb](https://github.com/ansible/ansible/commit/8665b0638a1d3a70f985126b0f007a26c81273cb) [https://github.com/ansible/ansible/commit/eeee1e1c5aa9dd4f84175966e0f9e467fd7fc600](https://github.com/ansible/ansible/commit/eeee1e1c5aa9dd4f84175966e0f9e467fd7fc600) The module should fail early on if the hostkey is unknown instead of hanging indefinitely. If the user adds "accept\_hostkey=yes" to the git parameters, the key will be automatically added to the known\_hosts file. Hopefully this makes the git module easier for our new users. ---
**Author:** ![Peter\_Gehres](https://avatars.discourse-cdn.com/v4/letter/p/f17d59/32.png) [@Peter\_Gehres](https://forum.ansible.com/u/Peter_Gehres)\ **Post date:** [January 11, 2014, 9:11pm UTC](https://forum.ansible.com/t/hostkey-enhancements-to-the-git-module/14322/2 "2014-01-11T21:11:39Z")
> Hopefully this makes the git module easier for our new users. It also makes it easier for us non-new users. Thanks! ---
**Author:** ![mike4](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@mike4](https://forum.ansible.com/u/mike4)\ **Post date:** [March 25, 2014, 5:44pm UTC](https://forum.ansible.com/t/hostkey-enhancements-to-the-git-module/14322/3 "2014-03-25T17:44:14Z")
Is anyone else having issues with this feature. If the host key is on the machine my Ansible git checkout works perfectly. If the host key isn’t on the box and even with accept\_hostkey=yes the checkout fails. I’m on Ansible 1.5.2 Error is also ambiguous as it says set accept\_hostkey to True!! TASK: [webservers | checkout the site] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* failed: [app01] =\> {“failed”: true, “item”: “”} msg: [intro.repositoryhosting.com](http://intro.repositoryhosting.com) has an unknown hostkey. Set accept\_hostkey to True or manually add the hostkey prior to running the git module FATAL: all hosts have already failed – aborting ---
**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\ **Post date:** [March 25, 2014, 9:17pm UTC](https://forum.ansible.com/t/hostkey-enhancements-to-the-git-module/14322/4 "2014-03-25T21:17:37Z")
Can we see the yaml syntax and the -vvvv output for the failed task? ---
**Author:** ![mike4](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@mike4](https://forum.ansible.com/u/mike4)\ **Post date:** [March 25, 2014, 10:14pm UTC](https://forum.ansible.com/t/hostkey-enhancements-to-the-git-module/14322/5 "2014-03-25T22:14:23Z")
TASK: [webservers | checkout the site] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ESTABLISH CONNECTION FOR USER: root REMOTE\_MODULE git repo=ssh:\*\*\*\*\*\*\*\*@intro.repositoryhosting.com/intro/onsite.git dest=/var/www/onsite accept\_hostkey=true EXEC [‘ssh’, ‘-C’, ‘-tt’, ‘-vvv’, ‘-o’, ‘ControlMaster=auto’, ‘-o’, ‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/root/.ansible/cp/ansible-ssh-%h-%p-%r’, ‘-o’, ‘Port=22’, ‘-o’, ‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’, ‘ConnectTimeout=10’, ‘app01’, “/bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1395785319.12-187266324329683 && echo $HOME/.ansible/tmp/ansible-tmp-1395785319.12-187266324329683’”] PUT /tmp/tmptO5e80 TO /root/.ansible/tmp/ansible-tmp-1395785319.12-187266324329683/git EXEC [‘ssh’, ‘-C’, ‘-tt’, ‘-vvv’, ‘-o’, ‘ControlMaster=auto’, ‘-o’, ‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/root/.ansible/cp/ansible-ssh-%h-%p-%r’, ‘-o’, ‘Port=22’, ‘-o’, ‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’, ‘ConnectTimeout=10’, ‘app01’, “/bin/sh -c ‘/usr/bin/python /root/.ansible/tmp/ansible-tmp-1395785319.12-187266324329683/git; rm -rf /root/.ansible/tmp/ansible-tmp-1395785319.12-187266324329683/ \>/dev/null 2\>&1’”] failed: [app01] =\> {“failed”: true, “item”: “”} msg: failed to add [intro.repositoryhosting.com](http://intro.repositoryhosting.com) hostkey: getaddrinfo \>\>: Name or service not known FATAL: all hosts have already failed – aborting PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* to retry, use: --limit @/root/webservers.retry app01 : ok=7 changed=0 unreachable=0 failed=1 yaml code is: - name: checkout the site git: repo=ssh://git@intro.repositoryhosting.com/intro/onsite.git dest={{ nginx\_webroot }}/{{ app\_name }} accept\_hostkey=true Just checked again… if I clone this repo on the host and accept the key then run the playbook it’s fine. remove the known\_hosts and it bails out. In the ansible.cfg the HostKeyChecking=False is commented out which I assume means it’s on and the git accept\_hostkey setting will be parsed. ---
**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\ **Post date:** [March 25, 2014, 10:22pm UTC](https://forum.ansible.com/t/hostkey-enhancements-to-the-git-module/14322/6 "2014-03-25T22:22:33Z")
Can the host resolve the fqdn? - shell: nslookup [intro.repositoryhosting.com](http://intro.repositoryhosting.com) - shell: host [intro.repositoryhosting.com](http://intro.repositoryhosting.com) - shell: sshkeyscan [intro.repositoryhost.com](http://intro.repositoryhost.com) ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 25, 2014, 10:26pm UTC](https://forum.ansible.com/t/hostkey-enhancements-to-the-git-module/14322/7 "2014-03-25T22:26:00Z")
“I’m on Ansible 1.5.2” Please definitely test on 1.5.3 if you can. 1.5.2 was released to fix one specific problem in the 1.5.1 line, but 1.5.3 fixes quite a bit more. Nobody – pretty much nobody – should be running 1.5.2. it will yield unhappy things. (Also, if you have issues on 1.5.3, I’d be interested in results on devel). ---
**Author:** ![mike4](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@mike4](https://forum.ansible.com/u/mike4)\ **Post date:** [March 25, 2014, 10:37pm UTC](https://forum.ansible.com/t/hostkey-enhancements-to-the-git-module/14322/8 "2014-03-25T22:37:50Z")
root@app01:~# nslookup [intro.repositoryhosting.com](http://intro.repositoryhosting.com) Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: [intro.repositoryhosting.com](http://intro.repositoryhosting.com) canonical name = [na-va-app-1.repositoryhosting.com](http://na-va-app-1.repositoryhosting.com). Name: [na-va-app-1.repositoryhosting.com](http://na-va-app-1.repositoryhosting.com) Address: 174.129.252.219 root@app01:~# host [intro.repositoryhosting.com](http://intro.repositoryhosting.com) [intro.repositoryhosting.com](http://intro.repositoryhosting.com) is an alias for [na-va-app-1.repositoryhosting.com](http://na-va-app-1.repositoryhosting.com). [na-va-app-1.repositoryhosting.com](http://na-va-app-1.repositoryhosting.com) has address 174.129.252.219 root@app01:~# ssh-keyscan [intro.repositoryhosting.com](http://intro.repositoryhosting.com) # [intro.repositoryhosting.com](http://intro.repositoryhosting.com) SSH-2.0-OpenSSH\_5.1p1 Debian-5 [intro.repositoryhosting.com](http://intro.repositoryhosting.com) ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAtC70z+dO6++V+qMRE37WUMiGkuNVPdYG8mB/EsJ010YCbc/VeotkPTqinE+gX1EGvdBmZn3DYSK5Cqt4Mh/waBQHfiCK4Lm8BJyQ6vJQf+l8u1bL59pGuAk6XEpoa9nE1eWpXSr7UpENcV/iDi/8Xc5qYrTJgmlK8z8H0XWigwkIEP2DtgysU2swwsa7rcyNnrNzdKstezf7Gd7qEqb8yKnIirkxcV2Q9Kt2ERvl1h+j0miZlWPPiLSBPJi38VZdWPSp3qOBCqqDy4GuUNahXl7H3IvIa0CV0AFPzcoes+1VHmoZmaC1wzV7jmrxRFS7c80BDbwSQ625v9Wb75IWTQ== Looks fine. Here’s the vvvv if I hop onto the box and clone the repo and accept the key manually. Then re-run the playbook. TASK: [webservers | checkout the site] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ESTABLISH CONNECTION FOR USER: root REMOTE\_MODULE git repo=ssh:\*\*\*\*\*\*\*\*@[intro.repositoryhosting.com/intro/onsite.git](http://intro.repositoryhosting.com/intro/onsite.git) dest=/var/www/onsite accept\_hostkey=true EXEC [‘ssh’, ‘-C’, ‘-tt’, ‘-vvv’, ‘-o’, ‘ControlMaster=auto’, ‘-o’, ‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/root/.ansible/cp/ansible-ssh-%h-%p-%r’, ‘-o’, ‘Port=22’, ‘-o’, ‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’, ‘ConnectTimeout=10’, ‘app01’, “/bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1395786695.84-167115969213287 && echo $HOME/.ansible/tmp/ansible-tmp-1395786695.84-167115969213287’”] PUT /tmp/tmpyHkG3V TO /root/.ansible/tmp/ansible-tmp-1395786695.84-167115969213287/git EXEC [‘ssh’, ‘-C’, ‘-tt’, ‘-vvv’, ‘-o’, ‘ControlMaster=auto’, ‘-o’, ‘ControlPersist=60s’, ‘-o’, ‘ControlPath=/root/.ansible/cp/ansible-ssh-%h-%p-%r’, ‘-o’, ‘Port=22’, ‘-o’, ‘KbdInteractiveAuthentication=no’, ‘-o’, ‘PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey’, ‘-o’, ‘PasswordAuthentication=no’, ‘-o’, ‘ConnectTimeout=10’, ‘app01’, “/bin/sh -c ‘/usr/bin/python /root/.ansible/tmp/ansible-tmp-1395786695.84-167115969213287/git; rm -rf /root/.ansible/tmp/ansible-tmp-1395786695.84-167115969213287/ \>/dev/null 2\>&1’”] ok: [app01] =\> {“after”: “41ce80a70ab048c46c306bf4a34f66fd61ebb979”, “before”: “41ce80a70ab048c46c306bf4a34f66fd61ebb979”, “changed”: false, “item”: “”} Can the host resolve the fqdn? - shell: nslookup [intro.repositoryhosting.com](http://intro.repositoryhosting.com/) - shell: host [intro.repositoryhosting.com](http://intro.repositoryhosting.com/) - shell: sshkeyscan [intro.repositoryhost.com](http://intro.repositoryhost.com/) ---
**Author:** ![mike4](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@mike4](https://forum.ansible.com/u/mike4)\ **Post date:** [March 25, 2014, 10:51pm UTC](https://forum.ansible.com/t/hostkey-enhancements-to-the-git-module/14322/9 "2014-03-25T22:51:36Z")
OK this is no issue on 1.5.3. I was previously installed through apt-get and 1.5.2 seems to be the latest there. 1.5.3 via pip is all good.