Clear Known Hosts Within AnsibleForms - Strict Host Key Checking

[dabenp]

A small contribution to help those with Host Key Checking Issues.

ISSUE

My settings for host key checking seemed to get ignored no matter where they were applied.

Files edited locally:

/srv/apps/ansibleforms-docker/data/ansible/ansible.cfg
/etc/ssh/ssh_config
/root/.ansible.cfg

Files edited within AnsibleForms docker container:

/etc/ssh/ssh_config
/root/.ansible.cfg
/app/dist/ansible.cfg

I even tried to export the environment variable within the container with:

export ANSIBLE_HOST_KEY_CHECKING=False

Edits to all of the above files failed to work and a rebuilt cloud server kept failing to run a form / playbook run because of host_key_checking errors.

Instead, of experimenting further I created a form / playbook that runs locally and clears known hosts within the container.

WORKAROUND - AS ONE COMMAND

Run the following:
docker exec $(docker ps -q -f name=af_app) /bin/sh -c 'truncate -s 0 /root/.ssh/known_hosts'

WORKAROUND - AS BASH FILE

Change directory to /root/ directory:
cd /root/

Create the bash file:
touch clear_known_hosts_ansibleforms.sh

Edit the bash file:
nano clear_known_hosts_ansibleforms.sh

Add the following contents:

#!/bin/bash
DOCKER_DIR=$(which docker)
CONTAINER_ID=$( $DOCKER_DIR ps | grep "ansibleguy/ansibleforms:latest" | awk '{print $1}' )
$DOCKER_DIR exec $CONTAINER_ID /bin/sh -c 'truncate -s 0 /root/.ssh/known_hosts'
echo "Clearing AnsibleForms known hosts complete!"

Add executable permissions:
chmod +x /root/clear_known_hosts_ansibleforms.sh

Now you can clear known hosts by running the file with:
sh /root/clear_known_hosts_ansibleforms.sh

YOU CAN LEAVE IT HERE IF YOU DON'T WANT IT ADDED INSIDE OF ANSIBLE FORMS GUI!

WORKAROUND - INSIDE ANSIBLE FORMS GUI

To add it as a playbook inside of AnsibleForms create a playbook file:
touch /srv/apps/ansibleforms-docker/data/playbooks/clear_known_hosts_ansibleforms.yaml

Edit it with:
nano /srv/apps/ansibleforms-docker/data/playbooks/clear_known_hosts_ansibleforms.yaml

Add the following:

---
- name: CLEAR KNOWN HOSTS
  hosts: localhost
  become: yes
  tasks:
  - name: CLEAR HOST KEY COMMAND FOR ANSIBLE FORMS
    ansible.builtin.shell: truncate -s 0 /root/.ssh/known_hosts
    args:
      executable: /bin/sh
    ignore_errors: yes

Now create the form with:
touch /srv/apps/ansibleforms-docker/data/forms/clear_known_hosts_ansibleforms.yaml

Edit the form with:
nano /srv/apps/ansibleforms-docker/data/forms/clear_known_hosts_ansibleforms.yaml

Now add the following:

name: Clear Host Keys Cache
showHelp: true
help: |
  This form starts the `clear_known_hosts_ansibleforms.yaml` playbook

  It will clear known hosts from within the AnsibleForms docker container
roles:
  - admin
description: Known hosts from within the AnsibleForms docker container will be
  cleared to bypass Host Key Checking error message.
icon: trash
categories:
  - Default
tileClass: has-background-info-light
playbook: clear_known_hosts_ansibleforms.yaml
type: ansible
fields: []
source: clear_known_hosts_ansibleforms.yaml

Hope this helps others having issues with host key checking.

If anyone can indicate how to make host_key_checking=false work that would be very useful.

[ansibleguy76]

thank you for the feedback.
In my docker compose I mapped this

      # Map custom sshkey to local node .ssh location
      - ./data/ssh:$HOME_DIR/.ssh

It make my ssh folder persistent and I can set the rights from outside the container. Doesn't that work on your end ?

[dabenp]

thank you for the feedback. In my docker compose I mapped this

      # Map custom sshkey to local node .ssh location
      - ./data/ssh:$HOME_DIR/.ssh

It make my ssh folder persistent and I can set the rights from outside the container. Doesn't that work on your end ?

Thanks for the reply ansibleguy76.

So to test I ran a playbook against a freshly built host to ensure its host keys were present inside of /root/.ssh/known_hosts inside of the af_app container.

I then rebuilt the host with the same OS and same IP address.

Interestingly the config that you mention appears to be already present within the "docker-compose.yml" file and is not commented out which leads me to believe it's present by default, see below:

[root@af ansibleforms-docker]# grep "/data/ssh" docker-compose.yml
      - ./data/ssh:$HOME_DIR/.ssh
[root@af ansibleforms-docker]# 

Before doing a "docker compose down" and a "docker compose up" against AF's "docker-compose.yml" I checked to see if the .ssh directories match in terms of filesize etc.

On local node:

[root@af ansibleforms-docker]# ls -lah /srv/apps/ansibleforms-docker/data/ssh
total 32K    
drw-rw-r--    2 root     root        4.0K Aug 18 01:21 .
drwx------    1 root     root        4.0K Aug 20 16:28 ..
-rw-rw-r--    1 root     root          71 Aug 15 13:27 .gitignore
-rw-------    1 root     root        1.6K Aug 15 15:00 id_rsa
-rw-r--r--    1 root     root         401 Aug 15 15:00 id_rsa.pub
-rw-------    1 root     root          94 Aug 20 22:45 known_hosts
-rw-r--r--    1 root     root          94 Aug 18 00:55 known_hosts.old
[root@af ansibleforms-docker]# 

Within af_app:

/ # ls -lah /root/.ssh/
total 32K    
drw-rw-r--    2 root     root        4.0K Aug 18 01:21 .
drwx------    1 root     root        4.0K Aug 20 16:28 ..
-rw-rw-r--    1 root     root          71 Aug 15 13:27 .gitignore
-rw-------    1 root     root        1.6K Aug 15 15:00 id_rsa
-rw-r--r--    1 root     root         401 Aug 15 15:00 id_rsa.pub
-rw-------    1 root     root          94 Aug 20 22:45 known_hosts
-rw-r--r--    1 root     root          94 Aug 18 00:55 known_hosts.old

To fully disable host key checking I created the following file:
touch /srv/apps/ansibleforms-docker/data/ssh/config

Opened it and added the following:

Host *
    StrictHostKeyChecking no
    UserKnownHostsFile=/dev/null

Then I did a compose down and up.

After running the playbook again host key checks are skipped successfully. Which is what I required.

I also learnt that host-keys are stored inside of settings, where they can be viewed and deleted. I did not know about this previously.

Thank you so much for pointing me in the correct direction.

[ansibleguy76]

so bottomline, it is fixed? because there are a lot of instructions and hard to follow which ones are needed.

[dabenp]

@ansibleguy76 yes all fixed! Thanks for your help.

[ansibleguy76]

actually. i dont store them in settings. the known hosts in settings are directly read from the known_hosts file over a rest api. same for removing them. so you can use the rest api as well to remove them.