appleboy / appleboy/ssh-action

Host fingerprint verification fails

Open
#275 12 comments 8 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
6.2k
Forks
679
Avg merge
35m
Merged PRs (30d)
1

Description

I'm unable to get host fingerprint verification to succeed. The following works (i.e., my SSH settings are proven to be correct since the workflow completes):

```yaml
jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- name: executing remote ssh commands using ssh key
uses: appleboy/ssh-action@v1.0.0
with:
host: ${{ secrets.SSH_HOST }}
username: ${{ secrets.SSH_USER }}
key: ${{ secrets.SSH_KEY }}
passphrase: ${{ secrets.SSH_PASSPHRASE }}
script_stop: true
script: # ...
```

But when I add my remote server's public fingerprint...

```diff
jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- name: executing remote ssh commands using ssh key
uses: appleboy/ssh-action@v1.0.0
with:
host: ${{ secrets.SSH_HOST }}
+ fingerprint: ${{ secrets.SSH_HOST_FINGERPRINT }}
username: ${{ secrets.SSH_USER }}
key: ${{ secrets.SSH_KEY }}
passphrase: ${{ secrets.SSH_PASSPHRASE }}
script_stop: true
script: # ...
```

...the workflow fails with the following message:

```bash
======END======
2023/10/17 02:28:35 ssh: handshake failed: ssh: host key fingerprint mismatch
```

I've triple-checked that I'm adding/saving the correct repo action secret, the output from the following command while logged into my remote server:

```bash
ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub | cut -d ' ' -f2
```

I've also checked against the following command:

```bash
ssh-keyscan | ssh-keygen -lf -
```

The fingerprints are consistent with each other, so I'm not sure what's causing the mismatch. Any additional debugging steps I should try? My remote server is running Ubuntu 22.04.3 LTS.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the workflow example in the issue and compare the working SSH configuration with the version that adds fingerprint. Reproduce the check using ssh-keygen on /etc/ssh/ssh_host_ed25519_key.pub and ssh-keyscan, then trace how the action receives the SSH_HOST_FINGERPRINT secret. Done means the documented fingerprint is accepted and the workflow completes without a host key fingerprint mismatch.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, shell
Domain
ci-cd, devops, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.