# How to manage ssh known hosts **URL:** \ **Category:** Ansible Project\ **Created:** [August 15, 2013, 6:29pm UTC](https://forum.ansible.com/t/how-to-manage-ssh-known-hosts/13316 "2013-08-15T18:29:03Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![David\_Reagan](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@David\_Reagan](https://forum.ansible.com/u/David_Reagan)\ **Post date:** [August 15, 2013, 6:29pm UTC](https://forum.ansible.com/t/how-to-manage-ssh-known-hosts/13316/1 "2013-08-15T18:29:03Z")
When I ssh into a server for the first time, ssh always asks me if the ECDSA key fingerprint is correct. When I say yes, it adds that to my ~/.ssh/known\_hosts file. I’d like to use ansible to create a known\_hosts file that accurately represents all my servers. Then I can set that in /etc/ssh/ssh\_known\_hosts, and safely tell my servers to ignore each users individual known\_hosts file. That will let me run ssh operations between my servers without having to accept an ECDSA fingerprint every time I log into a new server. And, I won’t have to turn off StrictHostKeyChecking. I could delete my current known\_hosts file, then ssh into each server one at a time to build an accurate known\_hosts file. But that’s rather time consuming, and keeping it accurate would be painful. So, how can I do that with ansible? Currently I’m researching how fingerprinting actually works in an effort to figure everything out on my own. Any answers to these questions would be greatly appreciated How does ssh generate the fingerprint? Why is the fingerprint shown to the user logging in of the form xx:xx:cc…:xx, but the line in the known\_hosts file of a form similar to a public key? Why does ssh ask to confirm the fingerprint again when you use a hostname instead of an ip address, after accepting the fingerprint for the ip address? Both fingerprints are the same. host ⮀ ssh 192.168.88.4 The authenticity of host ‘192.168.88.4 (192.168.88.4)’ can’t be established. ECDSA key fingerprint is 68:06:f9:4e:7a:c5:cf:1d:70:a2:6a:6f:12:eb:d4:55. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added ‘192.168.88.4’ (ECDSA) to the list of known hosts. Connection closed by 192.168.88.4 host ⮀ ssh vm.beta.lab The authenticity of host ‘vm.beta.lab (192.168.88.4)’ can’t be established. ECDSA key fingerprint is 68:06:f9:4e:7a:c5:cf:1d:70:a2:6a:6f:12:eb:d4:55. Are you sure you want to continue connecting (yes/no)? ---
**Author:** ![Michael\_Lucas](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@Michael\_Lucas](https://forum.ansible.com/u/Michael_Lucas)\ **Post date:** [August 15, 2013, 6:38pm UTC](https://forum.ansible.com/t/how-to-manage-ssh-known-hosts/13316/2 "2013-08-15T18:38:03Z")
If you trust your machines in their current state, there's ssh-keyscan. No ansible needed. ssh-keygen -lf /etc/ssh/ssh\_host\_X\_key.pub will print the key fingerprint on the local machine. Run an ansible job for that command, write it to a file, pull that file back to you, concatenate. (Although I'm sure there's a more elegant way to do it.) ==ml ---
**Author:** ![David\_Reagan](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@David\_Reagan](https://forum.ansible.com/u/David_Reagan)\ **Post date:** [August 15, 2013, 6:56pm UTC](https://forum.ansible.com/t/how-to-manage-ssh-known-hosts/13316/3 "2013-08-15T18:56:39Z")
When I ran ssh-keyscan on my little vagrant cluster, it returned public keys that don’t look the same as what’s in my known\_hosts file. ssh-keyscan vm.master.lab vm.alpha.lab vm.beta.lab Can I just copy that output into a known\_hosts file and have it work? Guess I just need to test it. 🙂 –David Reagan ---
**Author:** ![Michael\_Lucas](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@Michael\_Lucas](https://forum.ansible.com/u/Michael_Lucas)\ **Post date:** [August 15, 2013, 7:09pm UTC](https://forum.ansible.com/t/how-to-manage-ssh-known-hosts/13316/4 "2013-08-15T19:09:09Z")
It should work. If it doesn't, it's an OpenSSH question... they have their own mailing list. 😉 Mind you, I would find a playbook that logged into a host, computer the key fingerprint locally, and generated a known\_hosts file from the results, very nice. If anyone's looking for a project, this would be a good one... ==ml ---
**Author:** ![jpmens1](https://avatars.discourse-cdn.com/v4/letter/j/e9c0ed/32.png) [@jpmens1](https://forum.ansible.com/u/jpmens1)\ **Post date:** [August 16, 2013, 6:02am UTC](https://forum.ansible.com/t/how-to-manage-ssh-known-hosts/13316/5 "2013-08-16T06:02:49Z")
> Mind you, I would find a playbook that logged into a host, computer > the key fingerprint locally, and generated a known\_hosts file from the > results, very nice. If anyone's looking for a project, this would be a > good one... You might be interested in [1]. A bit off-topic, because it's about SSHFP in DNS and collecting those fingerprints (and avoiding the whole known\_hosts mess :-), but it may get you started on the right track 😉         -JP [1]: [http://jpmens.net/2012/11/03/an-action-plugin-for-ansible-to-handle-ssh-host-keys/](http://jpmens.net/2012/11/03/an-action-plugin-for-ansible-to-handle-ssh-host-keys/) ---
**Author:** ![David\_Reagan](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@David\_Reagan](https://forum.ansible.com/u/David_Reagan)\ **Post date:** [August 16, 2013, 2:57pm UTC](https://forum.ansible.com/t/how-to-manage-ssh-known-hosts/13316/6 "2013-08-16T14:57:54Z")
@Jan-Piet Mens That looks like a potential way to get the fingerprint via Ansible. I’ll have to look into it a bit more than the brief skim I just did. Thanks! Currently, I made a text file that lists all my nodes and their aliases. Then I used ssh-keyscan to find all the fingerprints. I’m probably going to add updating those files to my workflow when I add or delete a node. Kinda a hassle for it to be mandatory, but unless the article Jan-Piet linked to points out a better, automated way, I think it’ll just have to do. Thanks everyone for your help! ---
**Author:** ![phil777x](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@phil777x](https://forum.ansible.com/u/phil777x)\ **Post date:** [August 18, 2013, 2:19pm UTC](https://forum.ansible.com/t/how-to-manage-ssh-known-hosts/13316/7 "2013-08-18T14:19:15Z")
Another pretty way of doing it is using SSH certificates. This is a not very well known feature of OpenSSH that enables you to sign all your ssh host keys signed. Once done, you only need one key to authenticate all your present and future servers without the need to maintain any kind of database: [http://justanothergeek.chdir.org/2011/07/howto-authenticate-ssh-server-through/](http://justanothergeek.chdir.org/2011/07/howto-authenticate-ssh-server-through/) ---
**Author:** ![Paul\_Lam](https://avatars.discourse-cdn.com/v4/letter/p/4da419/32.png) [@Paul\_Lam](https://forum.ansible.com/u/Paul_Lam)\ **Post date:** [October 1, 2013, 1:42pm UTC](https://forum.ansible.com/t/how-to-manage-ssh-known-hosts/13316/8 "2013-10-01T13:42:35Z")
Is there some config in the playbook that I can add to skip the key fingerprint check entirely so that it doesn’t add to my known\_hosts file? I’m using ansible with vagrant and don’t want the transient vm keys added to my known\_hosts. I tried `export ANSIBLE_HOST_KEY_CHECKING=False` but it is still asking me on first connect. ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [October 1, 2013, 2:09pm UTC](https://forum.ansible.com/t/how-to-manage-ssh-known-hosts/13316/9 "2013-10-01T14:09:12Z")
I don’t know why it would be asking you but it might be a function of where you decided to do the export (i.e. before running vagrant, etc). Works fine for me without vagrant anyway. ---
**Author:** ![Paul\_Lam](https://avatars.discourse-cdn.com/v4/letter/p/4da419/32.png) [@Paul\_Lam](https://forum.ansible.com/u/Paul_Lam)\ **Post date:** [October 1, 2013, 2:13pm UTC](https://forum.ansible.com/t/how-to-manage-ssh-known-hosts/13316/10 "2013-10-01T14:13:27Z")
I was setting ansible.inventory\_path in Vagrantfile. I removed that and set playbook to use hosts = [hostname of vm box] then it is not asking me anymore. thanks for the quick reply