# how to add ssh host-keys for lots of new cloud hosts? **URL:** \ **Category:** Ansible Project\ **Created:** [November 22, 2018, 11:22am UTC](https://forum.ansible.com/t/how-to-add-ssh-host-keys-for-lots-of-new-cloud-hosts/29096 "2018-11-22T11:22:42Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Mark\_Zhitomirski](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@Mark\_Zhitomirski](https://forum.ansible.com/u/Mark_Zhitomirski)\ **Post date:** [November 22, 2018, 11:22am UTC](https://forum.ansible.com/t/how-to-add-ssh-host-keys-for-lots-of-new-cloud-hosts/29096/1 "2018-11-22T11:22:42Z")
Traditional approach is to leave it to a human operator and warn him of a new host key. This way is a no-go for automation and testing, a workaround is to disable host-key checks with ansible\_ssh\_extra\_args: ‘-o StrictHostKeyChecking=no’ like here: [https://github.com/mz0/ansible-digitalocean/blob/186eb84df/launch.yml#L53](https://github.com/mz0/ansible-digitalocean/blob/186eb84df/launch.yml#L53) It seems to me that a better way would be to auto-add host-key if this is a wholly new host (and maybe check for key uniqueness). My understanding is that this is a job for a certain Ansible plugin, cause host-key handling is not dependent on specific cloud/provisioning module (digital\_ocean\_droplet in my case) So far I couldn’t find any plugin of this sort and kindly ask for pointers. Regards, MZ ---
**Author:** ![cassell](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@cassell](https://forum.ansible.com/u/cassell)\ **Post date:** [November 24, 2018, 5:30am UTC](https://forum.ansible.com/t/how-to-add-ssh-host-keys-for-lots-of-new-cloud-hosts/29096/2 "2018-11-24T05:30:40Z")
Set ansible\_ssh\_extra\_args="-o StrictHostKeyChecking=no" V/r, James Cassell ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [November 24, 2018, 9:24am UTC](https://forum.ansible.com/t/how-to-add-ssh-host-keys-for-lots-of-new-cloud-hosts/29096/3 "2018-11-24T09:24:53Z")
> Traditional approach is to leave it to a human operator and warn him of a > new host key. > This way is a no-go for automation and testing, a workaround is to disable > host-key checks with ansible\_ssh\_extra\_args: '-o StrictHostKeyChecking=no' > like here: > [https://github.com/mz0/ansible-digitalocean/blob/186eb84df/launch.yml#L53](https://github.com/mz0/ansible-digitalocean/blob/186eb84df/launch.yml#L53) > > It seems to me that a better way would be to auto-add host-key if this is a > wholly new host (and maybe check for key uniqueness). Auto add host for only new host is StrictHostKeyChecking=accept-new > My understanding is that this is a job for a certain Ansible plugin, cause > host-key handling is not dependent on specific cloud/provisioning module > (digital\_ocean\_droplet in my case) > So far I couldn't find any plugin of this sort and kindly ask for pointers. Ansible i relying on ssh and doesn't handle this for the Ansible controller since it have no way of knowing if the host key is valid or not. To do this in a secure manner you need to inject a know or a sign ssh host key in the instance at creation time. ---
**Author:** ![Mark\_Zhitomirski](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@Mark\_Zhitomirski](https://forum.ansible.com/u/Mark_Zhitomirski)\ **Post date:** [November 25, 2018, 12:44pm UTC](https://forum.ansible.com/t/how-to-add-ssh-host-keys-for-lots-of-new-cloud-hosts/29096/4 "2018-11-25T12:44:57Z")
> > Traditional approach is to leave it to a human operator and warn him of a > > new host key. > > This way is a no-go for automation and testing, a workaround is to disable > > host-key checks with ansible\_ssh\_extra\_args: ‘-o StrictHostKeyChecking=no’ > > like here: > > [https://github.com/mz0/ansible-digitalocean/blob/186eb84df/launch.yml#L53](https://github.com/mz0/ansible-digitalocean/blob/186eb84df/launch.yml#L53) > > > > It seems to me that a better way would be to auto-add host-key if this is a > > wholly new host (and maybe check for key uniqueness). > > Auto add host for only new host is > StrictHostKeyChecking=accept-new That’s interesting, I’ll check that. > > My understanding is that this is a job for a certain Ansible plugin, cause > > host-key handling is not dependent on specific cloud/provisioning module > > (digital\_ocean\_droplet in my case) > > So far I couldn’t find any plugin of this sort and kindly ask for pointers. > > Ansible i relying on ssh and doesn’t handle this for the Ansible controller since it have no way of knowing if the host key is valid or not. > > To do this in a secure manner you need to inject a know or a sign ssh host key in the instance at creation time. I do not pursuit 100% control of host-key, there’s little point to do so for a public cloud host instance. Basic sanity check is OK for me and for majority of cloud users I suppose. Hope I’ll find a way to it using your pointer. Thanks Kai! ---
**Author:** ![Mark\_Zhitomirski](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@Mark\_Zhitomirski](https://forum.ansible.com/u/Mark_Zhitomirski)\ **Post date:** [November 26, 2018, 10:35am UTC](https://forum.ansible.com/t/how-to-add-ssh-host-keys-for-lots-of-new-cloud-hosts/29096/5 "2018-11-26T10:35:06Z")
> > Traditional approach is to leave it to a human operator and warn him of a > > new host key. > > This way is a no-go for automation and testing, a workaround is to disable > > host-key checks with ansible\_ssh\_extra\_args: ‘-o StrictHostKeyChecking=no’ > > like here: > > [https://github.com/mz0/ansible-digitalocean/blob/186eb84df/launch.yml#L53](https://github.com/mz0/ansible-digitalocean/blob/186eb84df/launch.yml#L53) > > > > It seems to me that a better way would be to auto-add host-key if this is a > > wholly new host (and maybe check for key uniqueness). > > Auto add host for only new host is > StrictHostKeyChecking=accept-new this looks like an option for those having OpenSSH \>= 7.6 (released 2017-10-03) [https://www.openssh.com/txt/release-7.6](https://www.openssh.com/txt/release-7.6) Ubuntu 18.04 and up have it, Ubuntu 16.04, Centos and many others are not so lucky (