Ansible provisioning ERROR! Using a SSH password instead of a key is not possible

Question

I would like to provision with my three nodes from the last one by using Ansible.

My host machine is Windows 10.

My Vagrantfile looks like:

Vagrant.configure("2") do |config|

  (1..3).each do |index|
    config.vm.define "node#{index}" do |node|

      node.vm.box = "ubuntu"
      node.vm.box = "../boxes/ubuntu_base.box"

      node.vm.network :private_network, ip: "192.168.10.#{10 + index}"

      if index == 3
        node.vm.provision :setup, type: :ansible_local do |ansible|
          ansible.playbook = "playbook.yml"
          ansible.provisioning_path = "/vagrant/ansible"
          ansible.inventory_path = "/vagrant/ansible/hosts"
          ansible.limit = :all
          ansible.install_mode = :pip
          ansible.version = "2.0"
        end
      end

    end
  end

end

My playbook looks like:

---

# my little playbook

- name: My little playbook
  hosts: webservers
  gather_facts: false
  roles:
    - create_user

My hosts file looks like:

[webservers]
192.168.10.11
192.168.10.12

[dbservers]
192.168.10.11
192.168.10.13

[all:vars]
ansible_connection=ssh
ansible_ssh_user=vagrant
ansible_ssh_pass=vagrant

After executing vagrant up --provision I got the following error:

Bringing machine 'node1' up with 'virtualbox' provider...
Bringing machine 'node2' up with 'virtualbox' provider...
Bringing machine 'node3' up with 'virtualbox' provider...
==> node3: Running provisioner: setup (ansible_local)...
    node3: Running ansible-playbook...

PLAY [My little playbook] ******************************************************

TASK [create_user : Create group] **********************************************
fatal: [192.168.10.11]: FAILED! => {"failed": true, "msg": "ERROR! Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this.  Please add this host's fingerprint to your known_hosts file to manage this host."}
fatal: [192.168.10.12]: FAILED! => {"failed": true, "msg": "ERROR! Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this.  Please add this host's fingerprint to your known_hosts file to manage this host."}

PLAY RECAP *********************************************************************
192.168.10.11              : ok=0    changed=0    unreachable=0    failed=1
192.168.10.12              : ok=0    changed=0    unreachable=0    failed=1

Ansible failed to complete successfully. Any error output should be
visible above. Please fix these errors and try again.

I extended my Vagrantfile with ansible.limit = :all and added [all:vars] to the hostfile, but still cannot get through the error.

Has anyone encountered the same issue?

score 96 · Accepted Answer · edited May 23 '17 at 11:46

96

Create a file ansible/ansible.cfg in your project directory (i.e. ansible.cfg in the provisioning_path on the target) with the following contents:

[defaults]
host_key_checking = false

^{provided that your Vagrant box has sshpass already installed - it's unclear, because the error message in your question suggests it was installed (otherwise it would be "ERROR! to use the 'ssh' connection type with passwords, you must install the sshpass program"), but in your answer you add it explicitly (sudo apt-get install sshpass), like it was not}

edited May 23 '17 at 11:46

Community

1
1

answered Feb 26 '17 at 00:34

techraf

64,883
27
193
198

10

It might be confusing for some guys, so please put your ansible.cfg in the same folder as your inventry then run it. – vahidzolf May 07 '20 at 01:19
3

`ansible.cfg` file location is `/etc/ansible/ansible.cfg` – Arun Feb 27 '21 at 04:42

score 55 · Answer 2 · answered Aug 06 '18 at 07:12

55

I'm using Ansible version 2.6.2 and solution with host_key_checking = false doesn't work.

Adding environment variable export ANSIBLE_HOST_KEY_CHECKING=False skipping fingerprint check.

answered Aug 06 '18 at 07:12

Branko

831
1
8
19

This is strange as `host_key_checking` is still referenced in [the latest (2.9) doc](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#host-key-checking) – xenlo Feb 28 '20 at 11:15
Ok, there is an open issue about this: https://github.com/ansible/ansible/issues/49254 – xenlo Feb 28 '20 at 11:19
work like a champ. – M. Hamza Rajput Aug 26 '23 at 14:52

score 27 · Answer 3 · answered Nov 15 '18 at 02:14

27

This error can also be solved by simply export ANSIBLE_HOST_KEY_CHECKING variable.

export ANSIBLE_HOST_KEY_CHECKING=False

source: https://github.com/ansible/ansible/issues/9442

answered Nov 15 '18 at 02:14

Erman

1,543
17
26

but where to write it – Shamsul Arefin Sep 09 '22 at 17:20

score 7 · Answer 4 · answered Feb 09 '21 at 18:23

7

run the below command, it resolved my issue

export ANSIBLE_HOST_KEY_CHECKING=False && ansible-playbook -i

answered Feb 09 '21 at 18:23

harsha k

81
1
2

score 6 · Answer 5 · edited May 23 '17 at 12:32

6

This SO post gave the answer.

I just extended the known_hosts file on the machine that is responsible for the provisioning like this:

Snippet from my modified Vagrantfile:

...
if index == 3
    node.vm.provision :pre, type: :shell, path: "install.sh"

    node.vm.provision :setup, type: :ansible_local do |ansible|
...

My install.sh looks like:

# add web/database hosts to known_hosts (IP is defined in Vagrantfile)
ssh-keyscan -H 192.168.10.11 >> /home/vagrant/.ssh/known_hosts
ssh-keyscan -H 192.168.10.12 >> /home/vagrant/.ssh/known_hosts
ssh-keyscan -H 192.168.10.13 >> /home/vagrant/.ssh/known_hosts
chown vagrant:vagrant /home/vagrant/.ssh/known_hosts

# reload ssh in order to load the known hosts
/etc/init.d/ssh reload

edited May 23 '17 at 12:32

Community

1
1

answered Feb 25 '17 at 23:24

Mark

5,994
5
42
55

1

shellscripting workaround. Ansible ensures a better way though! – Mark Feb 27 '17 at 15:03
1

To be clear this is all a problem from Vagrant's side via https://github.com/hashicorp/vagrant/issues/5005, and while inconvenient, security-wise this is actually the correct approach, and the others are actually the workaround. For local development purposes totally go with the simpler disable checking, I don't mean to come across fussy or pedantic, just feel it might be good to clarify for users who are newer to things to be aware of the security implications. I'm just fearing calling it the better way might mislead some. :) – Jasmine Hegman Aug 07 '19 at 23:04
1

I am not sure it is worth a new answer at this date, but I just noticed at the official docs for Ansible and Vagrant on Ansible's side https://docs.ansible.com/ansible/latest/scenario_guides/guide_vagrant.html#vagrant-setup they recommend the vagrant config line `config.ssh.insert_key = false`. Probably easier than ENV vars or .cfg manipulation. – Jasmine Hegman Aug 08 '19 at 06:43
1

@JasmineHegman, Thank you for the update! I agree on that Vagrant config is much convenient and much safer than ENV var or the .cfg. – Mark Oct 23 '19 at 16:09

score 6 · Answer 6 · answered Nov 22 '20 at 16:58

I had a similar challenge when working with Ansible 2.9.6 on Ubuntu 20.04.

When I run the command:

ansible all -m ping -i inventory.txt

I get the error:

target | FAILED! => { "msg": "Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this. Please add this host's fingerprint to your known_hosts file to manage this host." }

Here's how I fixed it:

When you install ansible, it creates a file called ansible.cfg, this can be found in the /etc/ansible directory. Simply open the file:

sudo nano /etc/ansible/ansible.cfg

Uncomment this line to disable SSH key host checking

host_key_checking = False

Now save the file and you should be fine now.

Note: You could also try to add the host's fingerprint to your known_hosts file by SSHing into the server from your machine, this prompts you to save the host's fingerprint to your known_hosts file:

promisepreston@ubuntu:~$ ssh myusername@192.168.43.240

The authenticity of host '192.168.43.240 (192.168.43.240)' can't be established.
ECDSA key fingerprint is SHA256:9Zib8lwSOHjA9khFkeEPk9MjOE67YN7qPC4mm/nuZNU.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.43.240' (ECDSA) to the list of known hosts.

myusername@192.168.43.240's password: 
Welcome to Ubuntu 20.04.1 LTS (GNU/Linux 5.4.0-53-generic x86_64)

That's all.

I hope this helps

score 4 · Answer 7 · answered Sep 02 '22 at 17:53

all provided solutions require changes in global config file or adding environment variable what create problems to onboard new people.

Instead you can add following variable to your inventory or host vars

ansible_ssh_common_args: '-o StrictHostKeyChecking=no'

Pjotz · Answer 8 · 2023-01-03T14:12:18.103

0

Adding ansible_ssh_common_args='-o StrictHostKeyChecking=no' to either your inventory

like:

[all:vars]
ansible_ssh_common_args='-o StrictHostKeyChecking=no'

[all:children]
servers

[servers]
host1

OR:

[servers]
host1 ansible_ssh_common_args='-o StrictHostKeyChecking=no'

edited Jan 03 '23 at 14:12

answered Dec 23 '22 at 10:33

Pjotz

1
1

1

Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Dec 24 '22 at 10:56

Ansible provisioning ERROR! Using a SSH password instead of a key is not possible

8 Answers8