I am trying to configure remote host A to be able to SSH into other remote host B. Here is my code:
# On coordinator, we create an SSH key pair
- name: Create SSH key pair on coordinator
when: dagu_mode == "coordinator"
block:
- name: Stat private key file
ansible.builtin.stat:
path: "{{ dagu_user_home }}/.ssh/id_dagu"
register: stat_private_key_file
- name: Stat public key file
ansible.builtin.stat:
path: "{{ dagu_user_home }}/.ssh/id_dagu.pub"
register: stat_public_key_file
- name: Create SSH key pair if they don't exist
when: not (stat_public_key_file.stat.exists and stat_private_key_file.stat.exists)
block:
- name: Remove stale SSH key pair
ansible.builtin.file:
path: "{{ dagu_user_home }}/.ssh/{{ item }}"
state: absent
loop:
- id_dagu
- id_dagu.pub
- name: Create SSH key pair
ansible.builtin.command:
cmd: "ssh-keygen -t ed25519 -f {{ dagu_user_home }}/.ssh/id_dagu -N \"\" -C \"dagu\""
creates: "{{ dagu_user_home }}/.ssh/id_dagu"
- name: Set SSH public key permissions
ansible.builtin.file:
path: "{{ dagu_user_home }}/.ssh/id_dagu.pub"
mode: u=rw,g=r,o=r
- name: Set SSH private key permissions
ansible.builtin.file:
path: "{{ dagu_user_home }}/.ssh/id_dagu"
mode: u=rw,g=,o=
# On worker we authorize the coordinator
- name: Authorize dagu coordinator for SSH access
when: dagu_mode == "ssh"
block:
- name: Get coordinator public key
delegate_to: "host137"
ansible.builtin.slurp:
src: "{{ dagu_coordinator_user_home }}/.ssh/id_dagu.pub"
register: coordinator_public_key
- name: Add authorized key
become: true
ansible.posix.authorized_key:
user: "{{ dagu_user }}"
state: present
key: "{{ coordinator_public_key.content | b64decode }}"
- name: Add to known hosts on coordinator # PROBLEM IS HERE
delegate_to: "host137"
become: true
ansible.builtin.known_hosts:
name: "192.168.0.149"
key: "192.168.0.149 {{ coordinator_public_key.content | b64decode }}"
path: "{{ dagu_coordinator_user_home }}/.ssh/known_hosts"
state: present
The above is a work in progress, but is able to run without error. However after it’s finished, I get this error when I try to test the SSH access:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ED25519 key sent by the remote host is
SHA256:wbf...oHf/oYD9...OW0.
Please contact your system administrator.
Add correct host key in /var/lib/dagu/.ssh/known_hosts to get rid of this message.
Offending ED25519 key in /var/lib/dagu/.ssh/known_hosts:1
remove with:
ssh-keygen -f "/var/lib/dagu/.ssh/known_hosts" -R "192.168.0.149"
Host key for 192.168.0.149 has changed and you have requested strict checking.
Host key verification failed.
I think the error is coming from me trying to add the remote host to known_hosts, however I’m not sure what I am doing wrong. What is the correct way to authorize SSH access between hosts via Ansible?
My goal is to configure host A to be the coordinator for an automation service, and host B to be an SSH executor. Host B will contain the programs that will be invoked (via SSH) by the coordinator. This requires SSH access, and ideally the automation service has its own SSH key that can be authorized to other hosts.
I am working under the assumption that it is necessary to add the hostname to known_hosts ahead of time to avoid a prompt to accept a user fingerprint.
I am aware that I can turn off strict host key checking, but I would like to keep that on if possible and just add the host to known_hosts correctly.