Answers: <p>There are boolean variables for this that can be set where they're needed (such as in playbooks) so as not to do this globally, which reduces overall security.</p>
  <pre class="lang-yaml prettyprint-override"><code>    var: ansible_host_key_checking
      var: ansible_ssh_host_key_checking
      var: ansible_paramiko_host_key_checking
  </code></pre>
  <p>So doing <code>ansible_ssh_host_key_checking: False</code> in a playbook should work.</p>
  <p>However, I don't believe they'll work until Ansible 2.12.  See <a href="https://github.com/ansible/ansible/issues/49254" rel="nofollow noreferrer">Disabling host key checking via variable doesn't seem to work. #49254</a> for details.</p>
  <p>For now, I'd recommend doing this:</p>
  <pre class="lang-sh prettyprint-override"><code>ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook ...
  </code></pre>
  <p>...and not setting this in the global Ansible configuration.  It's a good idea to be explicit when disabling security features so that you're aware of what you're doing.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-06-15T16:43:10.930Z
Answers: 2021-06-15T16:43:10.930Z
Answers: colan
Answers: <p>This is typically done by setting the following value in <code>ansible.cfg</code>:</p>
  
  <pre><code>[defaults]
  host_key_checking = False
  </code></pre>
  
  <p>If you don't want to modify <code>ansible.cfg</code> you can set an environment variable like so:</p>
  
  <pre><code>export ANSIBLE_HOST_KEY_CHECKING=False
  </code></pre>
  
  <p>Source: <a href="http://docs.ansible.com/ansible/intro_getting_started.html#host-key-checking" rel="noreferrer">http://docs.ansible.com/ansible/intro_getting_started.html#host-key-checking</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2019-08-02T01:19:44.893Z
Answers: I am using MacOS and setting host_key_checking=False but I still got "WARNING: POSSIBLE DNS SPOOFING DETECTED!". I fixed this after I realized that I connected to a target host of the same name earlier and then rebuilt it so there was an old key in ./ssh/known_hosts.
Answers: Chad Juliano
Answers: CC BY-SA 4.0
Answers: 2020-11-24T14:53:00.663Z
Answers: Note tht this does **not** answer the question, even though it might appear to. This will stop prompts to accept new host keys, but it will save each host key for future connections in `known_hosts`. What the question wants is " ssh to auto-accept **and redirect to /dev/null**". The [other answer](https://devops.stackexchange.com/a/726/24863) provides the correct solution.
Answers: JBentley
Answers: CC BY-SA 3.0
Answers: 2017-05-26T20:44:20.143Z
Answers: 2017-08-15T20:52:57.713Z
Answers: 2017-08-15T20:52:57.713Z
Answers: Zlemini 
Answers: <p>In your <code>ansible.cfg</code> file you need to add the following line:</p>
  
  <pre><code>ssh_args = -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no
  </code></pre>
  
  <p>You could also add those options in your <code>~/.ssh/config</code> on every machine from which you run it something like this:</p>
  
  <pre><code>Host *
     StrictHostKeyChecking no
     UserKnownHostsFile=/dev/null
  </code></pre>
  
Answers: CC BY-SA 3.0
Answers: 2017-03-30T16:32:18.217Z
Answers: This should work.  Also, look at the [ansible.cfg](https://raw.githubusercontent.com/ansible/ansible/devel/examples/ansible.cfg) file for more settings :)
Answers: Dawny33
Answers: CC BY-SA 3.0
Answers: 2017-03-30T17:19:52.380Z
Answers: +1 for Dawny's addition, because those using Paramiko will need to use ansible.cfg
Answers: Woodland
Answers: CC BY-SA 3.0
Answers: 2017-03-30T18:03:05.530Z
Answers: Is there an appropriate way to set that inside the playbook?  I've tried `ansible_ssh_common_args` and `ansible_ssh_extra_args` and it doesn't override what I've got in the ansible.cfg.  I've got an ansible.cfg that I use for everything else and would rather just override those parameters for this type of playbook than copy it just to make that change.
Answers: Peter Turner
Answers: CC BY-SA 3.0
Answers: 2017-03-30T21:37:51.777Z
Answers: I can't speak to those variables, Peter, but you could put a modified ansible.cfg in the directory with this playbook, and it will take precedence.
Answers: Woodland
Answers: CC BY-SA 3.0
Answers: 2018-02-03T19:19:52.417Z
Answers: UserKnownHostsFile=/dev/null completly break ssh security
Answers: mmv-ru
Answers: CC BY-SA 4.0
Answers: 2020-11-24T15:02:55.513Z
Answers: @mmv-ru That depends on the context . Not everyone uses ssh for the standard "connect to remote machine" scenario. E.g. it's common to use constantly-recycled Vagrant boxes for testing. If you use `StrictHostKeyChecking = no` without `UserKnownHostsFile=/dev/null` you will pollute `known_hosts` with useless keys. This creates an attack surface: anyone who gets their hand on one of your Vagrant boxes has a public key which your SSH client will accept from remote hosts. If instead the key is discarded every time, then your soon-to-be-recycled Vagrant box leaves no lasting trace on your system.
Answers: JBentley
Answers: CC BY-SA 4.0
Answers: 2018-12-22T20:36:16.230Z
Answers: I believe the best option is to use StrictHostKeyChecking no and not to use  UserKnownHostsFile=/dev/null, you got a vote up anyway :)
Answers: Waheed
Answers: CC BY-SA 3.0
Answers: 2017-03-30T16:13:06.910Z
Answers: 2017-05-27T05:25:39.413Z
Answers: 2017-05-27T05:25:39.413Z
Answers: Jiri Klouda
Answers: <p><strong>Bypassing host key checking in ansible</strong></p>
  <p>To bypass host key authenticity in ansible; you can follow any of the method:</p>
  <p><strong>(1) Using ansible.cfg file:</strong></p>
  <pre><code>In the playbook/project  directory, create a file ansible.cfg and add the following line:
      [defaults]
      host_key_checking = False
  Note, that this method will work globally and all the hosts that are present in inventory/hosts file will suffer the effect unless mentioned in the hosts file.
  </code></pre>
  <p><strong>(2) Exporting environment variable from your machine : (Temporary method)</strong></p>
  <pre><code>    export ANSIBLE_HOST_KEY_CHECKING=False  
  This is the temporary method and will only work as long the session is connected (SSH-session). Once, you break the session, the environment variable will be removed.
  </code></pre>
  <p><strong>(3) Exporting environment variable from your machine: (Permanent method)</strong></p>
  <p>To set the variable “ANSIBLE_HOST_KEY_CHECKING=False ” permanently, edit the ~/.bashrc file of the user running the ansible commands. Add the below line at the end of the file and save and exit.
  export ANSIBLE_HOST_KEY_CHECKING=False
  Then, source the file so that changes take effect for the current ssh session accordingly by using the command below:
  source ~/.bashrc</p>
  <p><strong>(3) Using ansible ssh commom arguments Variable:</strong></p>
  <pre><code>(a) You can specify SSH options directly in your inventory file for specific hosts or groups:
      [myhosts]
      host1 ansible_ssh_common_args='-o StrictHostKeyChecking=no'
      host2 ansible_ssh_common_args='-o StrictHostKeyChecking=no'
  
  (b) You can also define the the above arguments in playbooks:
      
      For example:
      -name: Playbook for copying files from local machine to remote server
            hosts: all
                    vars:
                    ansible_ssh_common_args: '-o StrictHostKeyChecking=no'
            roles:
             - copy_files
  </code></pre>
  <p><strong>(4) By simply using cli interface and running the ansible command:</strong></p>
  <pre><code>For example:
      ansible-playbook -i '52.8.13.17,' -e 'host=52.8.13.17' test-copy-files.yml --private-key /home/ansible-user/.ssh/ansible-user.key --ssh-extra-args='-p 2222' -e &quot;ansible_ssh_common_args='-o StrictHostKeyChecking=no'&quot; --check 
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2024-12-09T10:54:59.313Z
Answers: 2024-12-09T10:54:59.313Z
Answers: Rimsha Gill
Body: <p>I'm running an Ansible playbook with a subtle hack to work on an arbitrary port forwarded port (so I can use one machine with no direct access to lots of machines).  </p>
  
  <p>I've got a pre-task to change the <code>ansible_port</code> variable, so then when I start running my real tasks and roles, I get prompted to accept the hostkeys for localhost on some random port.  </p>
  
  <p>Because I am naive and don't care about security, I would like ssh to auto-accept and redirect to <code>/dev/null</code> (or another file for logging). </p>
  
  <p>Is this possible?</p>
  
Comments: CC BY-SA 3.0
Comments: 2017-03-30T15:23:21.913Z
Comments: You can do it through ssh options you pass to the ansible config.
Comments: Jiri Klouda
Tags: <ansible><linux>
Title: Can I bypass host key checking in Ansible?
UserDisplayName: Peter Turner
ThreadText: # Can I bypass host key checking in Ansible?
  
  (Asked by: username_0 on 2017-03-30)
  
  I'm running an Ansible playbook with a subtle hack to work on an arbitrary port forwarded port (so I can use one machine with no direct access to lots of machines).
  
  I've got a pre-task to change the `ansible_port` variable, so then when I start running my real tasks and roles, I get prompted to accept the hostkeys for localhost on some random port.
  
  Because I am naive and don't care about security, I would like ssh to auto-accept and redirect to `/dev/null` (or another file for logging).
  
  Is this possible?
  
  **Tags:** ansible, linux
  
  > **Comments:**
  > **username_1**: You can do it through ssh options you pass to the ansible config.  
  
  ---
  
  ## 4 answers
  
  ### Answer by username_3 on 2017-05-26. Score: 37
  
  This is typically done by setting the following value in `ansible.cfg`:
  
  ```
  [defaults]
  host_key_checking = False
  
  ```
  
  If you don't want to modify `ansible.cfg` you can set an environment variable like so:
  
  ```
  export ANSIBLE_HOST_KEY_CHECKING=False
  
  ```
  
  Source: <http://docs.ansible.com/ansible/intro_getting_started.html#host-key-checking>
  
  > **Comments:**
  > **username_4**: I am using MacOS and setting host_key_checking=False but I still got "WARNING: POSSIBLE DNS SPOOFING DETECTED!". I fixed this after I realized that I connected to a target host of the same name earlier and then rebuilt it so there was an old key in ./ssh/known_hosts.  
  > **username_5**: Note tht this does **not** answer the question, even though it might appear to. This will stop prompts to accept new host keys, but it will save each host key for future connections in `known_hosts`. What the question wants is " ssh to auto-accept **and redirect to /dev/null**". The [other answer](https://devops.stackexchange.com/a/726/24863) provides the correct solution.  
  
  ---
  
  ### Answer by username_1 on 2017-03-30. Score: 28
  
  In your `ansible.cfg` file you need to add the following line:
  
  ```
  ssh_args = -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no
  
  ```
  
  You could also add those options in your `~/.ssh/config` on every machine from which you run it something like this:
  
  ```
  Host *
     StrictHostKeyChecking no
     UserKnownHostsFile=/dev/null
  
  ```
  
  > **Comments:**
  > **username_6**: This should work.  Also, look at the [ansible.cfg](https://raw.githubusercontent.com/ansible/ansible/devel/examples/ansible.cfg) file for more settings :)  
  > **username_7**: +1 for Dawny's addition, because those using Paramiko will need to use ansible.cfg  
  > **username_0**: Is there an appropriate way to set that inside the playbook?  I've tried `ansible_ssh_common_args` and `ansible_ssh_extra_args` and it doesn't override what I've got in the ansible.cfg.  I've got an ansible.cfg that I use for everything else and would rather just override those parameters for this type of playbook than copy it just to make that change.  
  > **username_7**: I can't speak to those variables, username_0, but you could put a modified ansible.cfg in the directory with this playbook, and it will take precedence.  
  > **username_8**: UserKnownHostsFile=/dev/null completly break ssh security  
  > **username_9**: I believe the best option is to use StrictHostKeyChecking no and not to use  UserKnownHostsFile=/dev/null, you got a vote up anyway :)  
  > **username_5**: @username_8 That depends on the context . Not everyone uses ssh for the standard "connect to remote machine" scenario. E.g. it's common to use constantly-recycled Vagrant boxes for testing. If you use `StrictHostKeyChecking = no` without `UserKnownHostsFile=/dev/null` you will pollute `known_hosts` with useless keys. This creates an attack surface: anyone who gets their hand on one of your Vagrant boxes has a public key which your SSH client will accept from remote hosts. If instead the key is discarded every time, then your soon-to-be-recycled Vagrant box leaves no lasting trace on your system.  
  
  ---
  
  ### Answer by username_2 on 2021-06-15. Score: 3
  
  There are boolean variables for this that can be set where they're needed (such as in playbooks) so as not to do this globally, which reduces overall security.
  
  ```yaml
      var: ansible_host_key_checking
      var: ansible_ssh_host_key_checking
      var: ansible_paramiko_host_key_checking
  
  ```
  
  So doing `ansible_ssh_host_key_checking: False` in a playbook should work.
  
  However, I don't believe they'll work until Ansible 2.12. See [Disabling host key checking via variable doesn't seem to work. #49254](https://github.com/ansible/ansible/issues/49254) for details.
  
  For now, I'd recommend doing this:
  
  ```sh
  ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook ...
  
  ```
  
  ...and not setting this in the global Ansible configuration. It's a good idea to be explicit when disabling security features so that you're aware of what you're doing.
  
  
  ---
  
  ### Answer by username_10 on 2024-12-09. Score: 0
  
  **Bypassing host key checking in ansible**
  
  To bypass host key authenticity in ansible; you can follow any of the method:
  
  **(1) Using ansible.cfg file:**
  
  ```
  In the playbook/project  directory, create a file ansible.cfg and add the following line:
      [defaults]
      host_key_checking = False
  Note, that this method will work globally and all the hosts that are present in inventory/hosts file will suffer the effect unless mentioned in the hosts file.
  
  ```
  
  **(2) Exporting environment variable from your machine : (Temporary method)**
  
  ```
      export ANSIBLE_HOST_KEY_CHECKING=False  
  This is the temporary method and will only work as long the session is connected (SSH-session). Once, you break the session, the environment variable will be removed.
  
  ```
  
  **(3) Exporting environment variable from your machine: (Permanent method)**
  
  To set the variable “ANSIBLE\_HOST\_KEY\_CHECKING=False ” permanently, edit the ~/.bashrc file of the user running the ansible commands. Add the below line at the end of the file and save and exit.
  export ANSIBLE\_HOST\_KEY\_CHECKING=False
  Then, source the file so that changes take effect for the current ssh session accordingly by using the command below:
  source ~/.bashrc
  
  **(3) Using ansible ssh commom arguments Variable:**
  
  ```
  (a) You can specify SSH options directly in your inventory file for specific hosts or groups:
      [myhosts]
      host1 ansible_ssh_common_args='-o StrictHostKeyChecking=no'
      host2 ansible_ssh_common_args='-o StrictHostKeyChecking=no'
  
  (b) You can also define the the above arguments in playbooks:
      
      For example:
      -name: Playbook for copying files from local machine to remote server
            hosts: all
                    vars:
                    ansible_ssh_common_args: '-o StrictHostKeyChecking=no'
            roles:
             - copy_files
  
  ```
  
  **(4) By simply using cli interface and running the ansible command:**
  
  ```
  For example:
      ansible-playbook -i '52.8.13.17,' -e 'host=52.8.13.17' test-copy-files.yml --private-key /home/ansible-user/.ssh/ansible-user.key --ssh-extra-args='-p 2222' -e "ansible_ssh_common_args='-o StrictHostKeyChecking=no'" --check 
  
  ```
  
  
  ---
  
  