# How to fix this ssh-keyscan problem in my playbook? **URL:** \ **Category:** Ansible Project\ **Created:** [January 22, 2020, 11:24pm UTC](https://forum.ansible.com/t/how-to-fix-this-ssh-keyscan-problem-in-my-playbook/32033 "2020-01-22T23:24:08Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![RobertF](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@RobertF](https://forum.ansible.com/u/RobertF)\ **Post date:** [January 22, 2020, 11:24pm UTC](https://forum.ansible.com/t/how-to-fix-this-ssh-keyscan-problem-in-my-playbook/32033/1 "2020-01-22T23:24:08Z")
I have an Ansible playbook for provisioning servers. After the server is provisioned, I want to remove the old FQDN and/or hostname alias for that server from my local SSH known\_hosts file, pause until the server is up, and then run the ssh-keyscan command to add the new server’s public SSH key to my known\_hosts file. However, my task for running the keyscan command is resulting in an error that I haven’t been able to figure out. Here are my tasks: (tasks that provision server run first here) - name: remove old server’s public key from known\_hosts known\_hosts: path: “{{ local\_home\_dir }}/{{ me }}/.ssh/known\_hosts” name: “{{ item }}” state: absent loop: - “{{ hostname }}” - “{{ hostname }}.{{ domain\_name }}” become: true become\_user: “{{ me }}” - name: pause until host is up local\_action: command ping -c 1 {{ hostname }}.{{ domain\_name }} register: result until: result.rc == 0 retries: 30 delay: 5 - name: add new server’s public key to local known\_hosts file local\_action: command ssh-keyscan -t ecdsa {{ hostname }}.{{ domain\_name }} \>\> {{ local\_home\_dir }}/{{ me }}/.ssh/known\_hosts become: true become\_user: “{{ me }}” The error can be seen here (I abbreviated the key that was returned with …) TASK [add new server’s public key to local known\_hosts file] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* task path: /Users/smith/playbooks/gc/test.yml:36 Using module file /Users/smith/.virtualenvs/provision/lib/python3.7/site-packages/ansible/modules/commands/command.py Pipelining is enabled. ESTABLISH LOCAL CONNECTION FOR USER: smith EXEC /bin/sh -c ‘/Users/smith/.virtualenvs/provision/bin/python && sleep 0’ changed: [127.0.0.1 → localhost] =\> { “changed”: true, “cmd”: [ “ssh-keyscan”, “-t”, “ecdsa”, “[example.com](http://example.com)”, “\>\>”, “/Users/smith/.ssh/known\_hosts” ], “delta”: “0:00:00.241807”, “end”: “2020-01-22 14:50:09.699630”, “invocation”: { “module\_args”: { “\_raw\_params”: “ssh-keyscan -t ecdsa [example.com](http://example.com) \>\> /Users/smith/.ssh/known\_hosts”, “\_uses\_shell”: false, “argv”: null, “chdir”: null, “creates”: null, “executable”: null, “removes”: null, “stdin”: null, “stdin\_add\_newline”: true, “strip\_empty\_ends”: true, “warn”: true } }, “rc”: 0, “start”: “2020-01-22 14:50:09.457823”, “stderr”: “getaddrinfo \>\>: nodename nor servname provided, or not known\r\ngetaddrinfo /Users/smith/.ssh/known\_hosts: nodename nor servname provided, or not known\r\n# [example.com:22](http://example.com:22) SSH-2.0-OpenSSH\_7.9p1 Debian-10+deb10u1”, “stderr\_lines”: [ “getaddrinfo \>\>: nodename nor servname provided, or not known”, “getaddrinfo /Users/smith/.ssh/known\_hosts: nodename nor servname provided, or not known”, “# [example.com:22](http://example.com:22) SSH-2.0-OpenSSH\_7.9p1 Debian-10+deb10u1” ], “stdout”: “[example.com](http://example.com) ecdsa-sha2-nistp256 AAAAE2VjZHNhL…”, “stdout\_lines”: [ “[example.com](http://example.com) ecdsa-sha2-nistp256 AAAAE2VjZHNhL…” ] } META: ran handlers META: ran handlers PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 127.0.0.1 : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 I know that the playbook’s pause task is working because I can see the server come up. I can also run the keyscan command that the playbook is running from the command line with no problems. It’s just the Ansible playbook that gets the “nodename nor servname provided, or not known error”. What’s more puzzling is that the stdout lines above show that the public key has been fetched from the server. Thanks! ---
**Author:** ![racke](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/racke/32/4767_2.png) [@racke](https://forum.ansible.com/u/racke)\ **Post date:** [January 23, 2020, 6:31am UTC](https://forum.ansible.com/t/how-to-fix-this-ssh-keyscan-problem-in-my-playbook/32033/2 "2020-01-23T06:31:24Z")
> I have an Ansible playbook for provisioning servers. After the server is provisioned, I want to remove the old FQDN > and/or hostname alias for that server from my local SSH known\_hosts file, pause until the server is up, and then run the > ssh-keyscan command to add the new server's public SSH key to my known\_hosts file. However, my task for running the > keyscan command is resulting in an error that I haven't been able to figure out. Hello, you can not use redirections with the command module. The shell module can do that. Another alternative would be to fetch the SSH key file from the server instead of running ssh-keyscan. Regards         Racke ---
**Author:** ![RobertF](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@RobertF](https://forum.ansible.com/u/RobertF)\ **Post date:** [January 23, 2020, 7:32pm UTC](https://forum.ansible.com/t/how-to-fix-this-ssh-keyscan-problem-in-my-playbook/32033/3 "2020-01-23T19:32:40Z")
Racke, thank you very much. Changing ‘command’ to ‘shell’ fixed the problem. One follow-up… I thought ssh-keyscan _was_ fetching the SSH key file from the server. Was I mistaken? What technique were you thinking of? Thanks again!