[BUG] mine.get does not use no_host_keys: True in salt-ssh
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description
When using salt-ssh with no_host_keys mine.get tries to call target host without -o StrictHostKeyChecking=no and stuck on
The authenticity of host 'simple-server-one-0-ip (simple-server-one-0-ip)' can't be established.
ECDSA key fingerprint is SHA256:something
Are you sure you want to continue connecting (yes/no/[fingerprint])?
Setup
/root/.salt/Saltfile
salt-ssh:
no_host_keys: True
/etc/salt/roster
simple-server-one-0:
host: simple-server-one-0-ip # The IP addr or DNS hostname
user: administrator # Remote executions will be executed as user fred
passwd: Test123! # The password to use for login, if omitted, keys are used
sudo: True # Whether to sudo to root, not enabled by default
mine_functions:
network.ip_addrs
simple-server-one-1:
host: simple-server-one-1-ip # The IP addr or DNS hostname
user: administrator # Remote executions will be executed as user fred
passwd: Test123! # The password to use for login, if omitted, keys are used
sudo: True # Whether to sudo to root, not enabled by default
mine_functions:
network.ip_addrs
simple-server-two-0:
host: simple-server-two-0-ip # The IP addr or DNS hostname
user: administrator # Remote executions will be executed as user fred
passwd: Test123! # The password to use for login, if omitted, keys are used
sudo: True # Whether to sudo to root, not enabled by default
mine_functions:
network.ip_addrs
simple-server-two-1:
host: simple-server-two-1-ip # The IP addr or DNS hostname
user: administrator # Remote executions will be executed as user fred
passwd: Test123! # The password to use for login, if omitted, keys are used
sudo: True # Whether to sudo to root, not enabled by default
mine_functions:
network.ip_addrs
Steps to Reproduce the behavior
salt-ssh -i -l trace 'simple-server-one-1' mine.get 'simple-server-one-0' network.interfaces
from log
....
118 [DEBUG ] Executed SHIM command. Command logged to TRACE
119 [TRACE ] Executing command: ssh simple-server-one-1-ip -o KbdInteractiveAuthentication=no -o PasswordAuthentication=yes -o GSSAPIAuthentication=no -o ConnectTimeout=65 -o StrictHostKeyChecking=no -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o Port=22 -o IdentityFile=/etc/salt/pki/master/ssh/salt-ssh.rsa -o User=administrator /bin/sh << 'EOF'
....
6280 [DEBUG ] Child Forked! PID: 5663 STDOUT_FD: 17 STDERR_FD: 19
6281 [DEBUG ] VT: Salt-SSH SHIM Terminal Command executed. Logged to TRACE
6282 [TRACE ] Terminal Command: ssh simple-server-one-0 -o KbdInteractiveAuthentication=no -o PasswordAuthentication=yes -o GSSAPIAuthentication=no -o ConnectTimeout=65 -o Port=22 -o IdentityFile=/etc/salt/pki/master/ssh/salt-ssh.rsa -o User=administrator /bin/sh << 'EOF'
...
Expected behavior
salt should use config from salt-ssh: in every ssh call
Screenshots
If applicable, add screenshots to help explain your problem.
Versions Report
Salt Version:
Salt: 3002.5
Dependency Versions:
cffi: 1.14.3
cherrypy: unknown
dateutil: 2.8.1
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
Jinja2: 2.10.1
libgit2: Not Installed
M2Crypto: Not Installed
Mako: Not Installed
msgpack: 1.0.0
msgpack-pure: Not Installed
mysql-python: Not Installed
pycparser: 2.17
pycrypto: Not Installed
pycryptodome: 3.9.8
pygit2: Not Installed
Python: 3.7.10 (default, Feb 25 2021, 02:08:18)
python-gnupg: 0.4.4
PyYAML: 5.3.1
PyZMQ: 18.0.1
smmap: Not Installed
timelib: 0.2.4
Tornado: 4.5.3
ZMQ: 4.3.1
System Versions:
dist: alpine 3.12.4
locale: UTF-8
machine: x86_64
release: 5.4.72-microsoft-standard-WSL2
system: Linux
version: Alpine Linux 3.12.4
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the salt-ssh mine.get entry point and the SSH command construction, using the Saltfile no_host_keys setting and the roster configuration as inputs. Compare the SSH options for the initial command with those used to contact the target host; done means every SSH call includes the configured host-key options and the reproduction no longer prompts for confirmation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100