# Setting ANSIBLE\_HOST\_KEY\_CHECKING per host

**URL:** <https://forum.ansible.com/t/setting-ansible-host-key-checking-per-host/17641>\
**Category:** Ansible Project\
**Created:** [February 27, 2015, 8:31pm UTC](https://forum.ansible.com/t/setting-ansible-host-key-checking-per-host/17641 "2015-02-27T20:31:26Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![junkmailtrapenator](https://avatars.discourse-cdn.com/v4/letter/j/c77e96/32.png) [@junkmailtrapenator](https://forum.ansible.com/u/junkmailtrapenator)\
**Post date:** [February 27, 2015, 8:31pm UTC](https://forum.ansible.com/t/setting-ansible-host-key-checking-per-host/17641/1 "2015-02-27T20:31:26Z")

</div>

Is it possible to set ANSIBLE\_HOST\_KEY\_CHECKING on a per host or host group basis? This would help prevent my known\_hosts file from becoming cluttered with test boxes but still ensure when I talk to production hosts I can verify their identity.

---

<div class="post-metadata">

**Author:** ![riemers](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/riemers/32/1203_2.png) [@riemers](https://forum.ansible.com/u/riemers)\
**Post date:** [March 1, 2015, 2:14pm UTC](https://forum.ansible.com/t/setting-ansible-host-key-checking-per-host/17641/2 "2015-03-01T14:14:43Z")

</div>

```auto

You can do a ssh-keyscan and generate the production servers and make it into a known_hosts file, this will remove all your tests servers and keep production in there. Something like:
    ssh-keyscan -t rsa -H "<servername>,<servername2>,<servername3>" > ~/.ssh/known_hosts

```

Don’t know if its what you want, but its an option… ;p

---

<div class="post-metadata">

**Author:** ![junkmailtrapenator](https://avatars.discourse-cdn.com/v4/letter/j/c77e96/32.png) [@junkmailtrapenator](https://forum.ansible.com/u/junkmailtrapenator)\
**Post date:** [March 3, 2015, 10:39pm UTC](https://forum.ansible.com/t/setting-ansible-host-key-checking-per-host/17641/3 "2015-03-03T22:39:07Z")

</div>

Good to know, but not quite what I’m looking for.

---

<div class="post-metadata">

**Author:** ![Tom\_Bamford](https://avatars.discourse-cdn.com/v4/letter/t/c2a13f/32.png) [@Tom\_Bamford](https://forum.ansible.com/u/Tom_Bamford)\
**Post date:** [March 5, 2015, 3:34am UTC](https://forum.ansible.com/t/setting-ansible-host-key-checking-per-host/17641/4 "2015-03-05T03:34:26Z")

</div>

You could perhaps achieve this with a crafted ssh\_config. Especially if your hosts are named predictably.

Consider if your production hosts have names in the form `[host5.prod.domain.net](http://host5.prod.domain.net)` and other environments are different such as `[host3.stage.domain.net](http://host3.stage.domain.net)`

A corresponding ssh\_config might be (note that first option match wins):

```auto
Host *.[prod.domain.net](http://prod.domain.net)
StrictHostKeyChecking yes

Host *.[domain.net](http://domain.net)
StrictHostKeyChecking no

```

Hope this helps

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [March 5, 2015, 12:20pm UTC](https://forum.ansible.com/t/setting-ansible-host-key-checking-per-host/17641/5 "2015-03-05T12:20:20Z")

</div>

you can set asnbile\_ssh\_args per group/host

---

<div class="post-metadata">

**Author:** ![junkmailtrapenator](https://avatars.discourse-cdn.com/v4/letter/j/c77e96/32.png) [@junkmailtrapenator](https://forum.ansible.com/u/junkmailtrapenator)\
**Post date:** [March 5, 2015, 3:20pm UTC](https://forum.ansible.com/t/setting-ansible-host-key-checking-per-host/17641/6 "2015-03-05T15:20:38Z")

</div>

Does this override any ssh\_args setting I have in ansible.cfg?

Adding **_ansible\_ssh\_args=‘-o StrictHostKeyChecking=no’_** after the host in the inventory file didn’t seem to do anything.

Also it seem like in general using _ **StrictHostKeyChecking** _ still adds the key to _ **knownhosts** _, it just doesn’t ask first.

---

<div class="post-metadata">

**Author:** ![Michael\_Peters](https://avatars.discourse-cdn.com/v4/letter/m/c2a13f/32.png) [@Michael\_Peters](https://forum.ansible.com/u/Michael_Peters)\
**Post date:** [March 5, 2015, 4:18pm UTC](https://forum.ansible.com/t/setting-ansible-host-key-checking-per-host/17641/7 "2015-03-05T16:18:34Z")

</div>

Can you really set ansible\_ssh\_args per group/host? I remember trying  
it a while ago and it didn't work. And it's not mentioned here:  
[http://docs.ansible.com/intro\_inventory.html#list-of-behavioral-inventory-parameters](http://docs.ansible.com/intro_inventory.html#list-of-behavioral-inventory-parameters)

I'll admit I haven't tried it in a while, but can someone confirm that  
it actually works?

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [March 5, 2015, 5:04pm UTC](https://forum.ansible.com/t/setting-ansible-host-key-checking-per-host/17641/8 "2015-03-05T17:04:13Z")

</div>

nevermind that was a PR that i was using but not accepted