Ansible - How to ssh into an instance without the 'authenticity of host' prompt?

Question

I am using ansible to create several ec2 instances, copy files into those newly created servers and run commands on those servers. The issue is that after creating the servers I still have to enter yes in the following ssh prompt:

TASK [Adding /etc/rc.local2 to consul servers] *********************************
changed: [localhost -> 172.31.52.147] => (item={u'ip': u'172.31.52.147', u'number': 0})
The authenticity of host '172.31.57.20 (172.31.57.20)' can't be established.
ECDSA key fingerprint is 5e:c3:2e:52:10:29:1c:44:6f:d3:ac:10:78:10:01:89.
Are you sure you want to continue connecting (yes/no)? yes
changed: [localhost -> 172.31.57.20] => (item={u'ip': u'172.31.57.20', u'number': 1})
The authenticity of host '172.31.57.19 (172.31.57.19)' can't be established.
ECDSA key fingerprint is 4e:71:15:fe:c9:ec:3f:54:65:e8:a1:66:74:92:f4:ff.
Are you sure you want to continue connecting (yes/no)? yes

How can I have ansible ignore this prompt and just answer yes automatically? For reference here is my playbook:

---
- hosts: localhost
  connection: local
  gather_facts: false
  sudo: yes

  vars_files:
    - ami-keys.yml
    - ami-image.yml    

  tasks:

    - name: create 3 consul servers
      ec2:
         aws_access_key: '{{ aws_access_key }}'
         aws_secret_key: '{{ aws_secret_key }}'
         key_name: terra
         group: default
         instance_type: t2.micro
         image: '{{ ami }}'
         region: '{{ region }}'
         wait: true
         exact_count: 3
         count_tag:
            Name: consul-server
         instance_tags:
            Name: consul-server
      register: ec2


    - name: Wait for SSH to come up
      wait_for: host={{ item }} port=22 delay=1 timeout=480 state=started
      with_items:
        - "{{ ec2['tagged_instances'][0]['private_ip'] }}"
        - "{{ ec2['tagged_instances'][1]['private_ip'] }}"
        - "{{ ec2['tagged_instances'][2]['private_ip'] }}"

    # shows the json data for the instances created
    - name: consul server ec2 instance json data
      debug:
       msg: "{{ ec2['tagged_instances'] }}"

    # bootstrapping
    - name: Adding /etc/rc.local2 to consul servers
      template:
       src: template/{{ item.number }}.sh
       dest: /etc/rc.local2
      delegate_to: "{{ item.ip }}"
      with_items:
        - ip: "{{ ec2['tagged_instances'][0]['private_ip'] }}"
          number: 0
        - ip: "{{ ec2['tagged_instances'][1]['private_ip'] }}"
          number: 1
        - ip: "{{ ec2['tagged_instances'][2]['private_ip'] }}" 
          number: 2
      ignore_errors: true

    - name: give /etc/rc.local2 permissions to run and starting swarm
      shell: "{{ item[1] }}"
      delegate_to: "{{ item[0] }}"
      with_nested:
       - [ "{{ ec2['tagged_instances'][0]['private_ip'] }}", 
           "{{ ec2['tagged_instances'][1]['private_ip'] }}", 
           "{{ ec2['tagged_instances'][2]['private_ip'] }}" ]
       - [ "sudo chmod +x /etc/rc.local2",
           "sleep 10",
           "consul reload",
           "docker run --name swarm-manager -d -p 4000:4000 --restart=unless-stopped \
           swarm manage -H :4000 \
           --replication --advertise \
           $(hostname -i):4000 \
           consul://$(hostname -i):8500" ]
      ignore_errors: true

Note: I have already tried running:

ansible-playbook -e 'host_key_checking=False' consul-server.yml

and it does not remove the prompt.

Going into /etc/ansible/ansible.cfg and uncommenting the line host_key_checking=False does remove the prompt however I want to avoid doing this and either enter something into my playbook or the command line when I run my playbook instead.

There's a comment on this page: stackoverflow.com/questions/23074412/… that says the -e "host_key_checking=False" technique did not work and it got 9 up votes, so seems a few people hit this problem. Can you not just set it it ansible.cfg? — Rob H
Editing the /etc/ansible/ansible.cfg file and uncommenting the host_key_checking=False line did allow my playbook to run without the prompt. However I am looking to avoid this step and just be able to disable key checking either inside of my playbook or when I run the playbook on the command line. Is there an easy way to do this? — Alex Cohen

Xiong Chiamiov Xiong Chiamiov · Accepted Answer · 2016-08-19T20:59:57

The common recommendation is to set host_key_checking=False in the Ansible configuration. This is a bad idea, because it assumes your network connection will never be compromised.

A much better idea that only assumes the network isn't MitMed when you first create the servers is to use ssh-keyscan to add the servers' fingerprints to the known hosts file:

- name: accept new ssh fingerprints                                         
    shell: ssh-keyscan -H {{ item.public_ip }} >> ~/.ssh/known_hosts          
    with_items: '{{ ec2.instances }}'

Ansible - How to ssh into an instance without the 'authenticity of host' prompt?

1 Answers