appleboy / appleboy/ssh-action
Host fingerprint verification fails
- Dominant language
- Shell
- Stars
- 6.2k
- Forks
- 679
- Avg merge
- 35m
- Merged PRs (30d)
- 1
Description
I'm unable to get host fingerprint verification to succeed. The following works (i.e., my SSH settings are proven to be correct since the workflow completes):
```yaml
jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- name: executing remote ssh commands using ssh key
uses: appleboy/ssh-action@v1.0.0
with:
host: ${{ secrets.SSH_HOST }}
username: ${{ secrets.SSH_USER }}
key: ${{ secrets.SSH_KEY }}
passphrase: ${{ secrets.SSH_PASSPHRASE }}
script_stop: true
script: # ...
```
But when I add my remote server's public fingerprint...
```diff
jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- name: executing remote ssh commands using ssh key
uses: appleboy/ssh-action@v1.0.0
with:
host: ${{ secrets.SSH_HOST }}
+ fingerprint: ${{ secrets.SSH_HOST_FINGERPRINT }}
username: ${{ secrets.SSH_USER }}
key: ${{ secrets.SSH_KEY }}
passphrase: ${{ secrets.SSH_PASSPHRASE }}
script_stop: true
script: # ...
```
...the workflow fails with the following message:
```bash
======END======
2023/10/17 02:28:35 ssh: handshake failed: ssh: host key fingerprint mismatch
```
I've triple-checked that I'm adding/saving the correct repo action secret, the output from the following command while logged into my remote server:
```bash
ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub | cut -d ' ' -f2
```
I've also checked against the following command:
```bash
ssh-keyscan | ssh-keygen -lf -
```
The fingerprints are consistent with each other, so I'm not sure what's causing the mismatch. Any additional debugging steps I should try? My remote server is running Ubuntu 22.04.3 LTS.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the workflow example in the issue and compare the working SSH configuration with the version that adds fingerprint. Reproduce the check using ssh-keygen on /etc/ssh/ssh_host_ed25519_key.pub and ssh-keyscan, then trace how the action receives the SSH_HOST_FINGERPRINT secret. Done means the documented fingerprint is accepted and the workflow completes without a host key fingerprint mismatch.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, shell
- Domain
- ci-cd, devops, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100