'Unknown host key error' only happens when running a playbook

Archives Ansible Project
1

So I want to reach out to my router. I first try

raub@desktop:~/dev/ansible$ ssh janitor@uranus.example.com
janitor@uranus. example.com's password:

which is expected since I have ssh'd into the router quite many times
from this computer. i.e. by now it knows uranus quite well. Just to be
paranoid, let's try port 830 as this is a Juniper router:

raub@desktop:~/dev/ansible$ ssh -p 830 janitor@uranus.mgmt.kushana.com
janitor@uranus.mgmt.kushana.com's password:

So far so good. Then I run a quick ansible test:

raub@desktop:~/dev/ansible$ ansible-playbook -vvv network.yml --limit uranus
[...]
ok: [uranus] => {
    "changed": false,
    "elapsed": 0,
    "invocation": {
        "module_args": {
            "active_connection_states": [
                "ESTABLISHED",
                "FIN_WAIT1",
                "FIN_WAIT2",
                "SYN_RECV",
                "SYN_SENT",
                "TIME_WAIT"
            ],
            "connect_timeout": 5,
            "delay": 0,
            "exclude_hosts": null,
            "host": "uranus.example.com",
            "msg": null,
            "path": null,
            "port": 830,
            "search_regex": null,
            "sleep": 1,
            "state": "started",
            "timeout": 300
        }
    },
    "match_groupdict": {},
    "match_groups": ,
    "path": null,
    "port": 830,
    "search_regex": null,
    "state": "started"
}

TASK [network : Get facts about "uranus"]

2

I don't know why the Ansible playbook would respond differently to the host key unless it's not running as the same user that you ssh with, so someone else will hopefully answer that but what I can suggest if you're willing to forego host key checking you can run the play with 'export ANSIBLE_HOST_KEY_CHECKING=False', there is also an option for this you can set in the configuration file. Obviously you can also try ssh-keyscan and see if the host keys are different from your known hosts file, but the env var will skip that check altogether (obvious security implications)

3

I don't know why the Ansible playbook would respond differently to the host key unless it's not running as the same user that you ssh with, so someone else will hopefully answer that but what I can suggest if you're willing to forego host key checking you can run the play with 'export ANSIBLE_HOST_KEY_CHECKING=False', there is also an option for this you can set in the configuration file. Obviously you can also try ssh-keyscan and see if the host keys are different from your known hosts file, but the env var will skip that check altogether (obvious security implications)

      What I have been doing for now is running it as

ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -vvv network.yml --limit uranus

which is still not what I want to do but it is slightly better than
just exporting the variable for all to fondle.

4

[...]

Anything special (any user definition) in hosts file and/or playbook?
Maybe, it is related to netconf
(https://docs.ansible.com/ansible/latest/plugins/connection/netconf.html)?

Wawrzek