# problems with the 'git' module

**URL:** <https://forum.ansible.com/t/problems-with-the-git-module/17109>\
**Category:** Ansible Project\
**Created:** [December 19, 2014, 3:51pm UTC](https://forum.ansible.com/t/problems-with-the-git-module/17109 "2014-12-19T15:51:58Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Toni\_Mueller](https://avatars.discourse-cdn.com/v4/letter/t/54ee81/32.png) [@Toni\_Mueller](https://forum.ansible.com/u/Toni_Mueller)\
**Post date:** [December 19, 2014, 3:51pm UTC](https://forum.ansible.com/t/problems-with-the-git-module/17109/1 "2014-12-19T15:51:58Z")

</div>

Hi,

I am trying to deploy software from git to a machine which I am managing  
with Ansible. I am using SSH agent forwarding for authentication.

If I log in as the user and connect to the repository host, everything  
works just like it should. I can make use of the key I am using from the  
management host. Installing that same key in /etc/ssh/ssh\_known\_hosts or  
~user/.ssh/known\_hosts for the user who is supposed to actually execute  
git, results in this error message:

msg: repo.example.com has an unknown hostkey. Set accept\_hostkey to True or manually add the hostkey prior to running the git module

Installing the key as described in the manual by using ssh-keyscan makes  
it work, but is ineffective as a security measure. If I need to check  
the host key to begin with, I cannot rely on DNS, which I use in the git  
URL, to get it. Getting it from the machine that I am going to check  
from does not make me feel secure as it would only guard against DNS or  
routing tampering during the probably short time window between getting  
the key by scanning it, then checking it during the git operation. The  
case for setting 'accept\_hostkey=yes' is even less compelling if you are  
managing hosts across the Internet, as I do.

It would be great if this functionality would be a bit more versatile  
and robust.

Thank you,  
--Toni++