k0sproject / k0sproject/k0sctl

ssh host key mismatch (again)

Open
#813 3 comments 3 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
582
Forks
113
Avg merge
2d 13h
Merged PRs (30d)
34

Description

I'm having an issue where k0sctl and openssh seem to add conflicting entries to `~/.ssh/known_hosts` for the *same* host.

I first connect to the hostname `bne-nxt1-vr-1` using openssh. It connects OK and I see this entry appear in known_hosts:
```
bne-nxt1-vr-1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMeZMXleTWOrjmhYAwcfPZuv/CCkT0GLpIKPtjcWu+ip
```
if I then run k0sctl against the same hostname (using builtin `ssh` not `openSSH` config), I get an error:
```
- [SSH] bne-nxt1-vr-1: retrying aborted
not connected: client connect: can't connect: ssh: handshake failed: host key mismatch: knownhosts: key mismatch
```
If I remove the entry from known_hosts and try k0sctl again, it connects fine and I see this new entry in known_hosts (10.1.3.14 corresponds with the hostname):
```
10.1.3.14 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFAFlkzOExRFx4CF3vEs5/wWhtZx+HUoEW4fKoyBUfsbuMdS4N7Xri+J1XCI3jiOvvkzAz9gOeohmlo0cFOfJPg=
```

Additionally, I noticed k0sctl is adding the same entry to known_hosts repeatedly for this host (and others) e.g.
```
10.5.48.17 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMbTbLidJyADmGw6uPgC+x16OlQrm3O6SeT3ujFLWjkNESI89mqVtuvfn21sQ4S1L8Fj6+GeOQQq+AofXD04/SE=
10.5.48.239 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFFq7/UAvpe1P/7g/FS1lS3ZYpUWNsWuEST2glfSbj+sabppXC3J7MVctv8lOw18xwoAcPApFJj7RQDw6hLFKUg=
10.5.48.17 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMbTbLidJyADmGw6uPgC+x16OlQrm3O6SeT3ujFLWjkNESI89mqVtuvfn21sQ4S1L8Fj6+GeOQQq+AofXD04/SE=
10.5.48.239 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFFq7/UAvpe1P/7g/FS1lS3ZYpUWNsWuEST2glfSbj+sabppXC3J7MVctv8lOw18xwoAcPApFJj7RQDw6hLFKUg=
10.1.171.18 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAcAH2R1wU9GVkqPz21LAHP002ouhFwVvgC9AJqpJV+SlSuCZsSd+ukgq96yHnAC+d1/KF4S7bvO0ZbqW9Z9Ecc=
10.5.48.239 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFFq7/UAvpe1P/7g/FS1lS3ZYpUWNsWuEST2glfSbj+sabppXC3J7MVctv8lOw18xwoAcPApFJj7RQDw6hLFKUg=
10.5.48.17 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMbTbLidJyADmGw6uPgC+x16OlQrm3O6SeT3ujFLWjkNESI89mqVtuvfn21sQ4S1L8Fj6+GeOQQq+AofXD04/SE=
10.1.171.18 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAcAH2R1wU9GVkqPz21LAHP002ouhFwVvgC9AJqpJV+SlSuCZsSd+ukgq96yHnAC+d1/KF4S7bvO0ZbqW9Z9Ecc=
10.5.48.239 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFFq7/UAvpe1P/7g/FS1lS3ZYpUWNsWuEST2glfSbj+sabppXC3J7MVctv8lOw18xwoAcPApFJj7RQDw6hLFKUg=
10.5.48.17 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMbTbLidJyADmGw6uPgC+x16OlQrm3O6SeT3ujFLWjkNESI89mqVtuvfn21sQ4S1L8Fj6+GeOQQq+AofXD04/SE=
10.1.171.18 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAcAH2R1wU9GVkqPz21LAHP002ouhFwVvgC9AJqpJV+SlSuCZsSd+ukgq96yHnAC+d1/KF4S7bvO0ZbqW9Z9Ecc=
10.5.48.239 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFFq7/UAvpe1P/7g/FS1lS3ZYpUWNsWuEST2glfSbj+sabppXC3J7MVctv8lOw18xwoAcPApFJj7RQDw6hLFKUg=
10.5.48.17 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMbTbLidJyADmGw6uPgC+x16OlQrm3O6SeT3ujFLWjkNESI89mqVtuvfn21sQ4S1L8Fj6+GeOQQq+AofXD04/SE=
10.1.171.18 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAcAH2R1wU9GVkqPz21LAHP002ouhFwVvgC9AJqpJV+SlSuCZsSd+ukgq96yHnAC+d1/KF4S7bvO0ZbqW9Z9Ecc=
10.1.3.14 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFAFlkzOExRFx4CF3vEs5/wWhtZx+HUoEW4fKoyBUfsbuMdS4N7Xri+J1XCI3jiOvvkzAz9gOeohmlo0cFOfJPg=
10.5.48.239 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFFq7/UAvpe1P/7g/FS1lS3ZYpUWNsWuEST2glfSbj+sabppXC3J7MVctv8lOw18xwoAcPApFJj7RQDw6hLFKUg=
10.5.48.17 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMbTbLidJyADmGw6uPgC+x16OlQrm3O6SeT3ujFLWjkNESI89mqVtuvfn21sQ4S1L8Fj6+GeOQQq+AofXD04/SE=
10.1.3.14 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFAFlkzOExRFx4CF3vEs5/wWhtZx+HUoEW4fKoyBUfsbuMdS4N7Xri+J1XCI3jiOvvkzAz9gOeohmlo0cFOfJPg=
10.1.171.18 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAcAH2R1wU9GVkqPz21LAHP002ouhFwVvgC9AJqpJV+SlSuCZsSd+ukgq96yHnAC+d1/KF4S7bvO0ZbqW9Z9Ecc=
```
I'm using k0sctl v0.21.0 on MacOS 15.1.1

If I use `openSSH` rather than `ssh` I don't have this issue, however it is much slower that way. It would be nice not to have to call out to openssh.

Last time [I had a similar issue](https://github.com/k0sproject/k0sctl/issues/717) the problem was in the [rig](https://github.com/k0sproject/rig) library. I mean no disrespect to the maintainers of rig, but I wonder if it's not yet mature enough for use in k0sctl?

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the issue with k0sctl v0.21.0 using the built-in `ssh` path, comparing it with `openSSH` and inspecting the referenced rig library. Trace how the hostname and IP address are written to `~/.ssh/known_hosts`; done means the built-in path accepts the same host identity as OpenSSH and does not append duplicate entries.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.