saltstack / saltstack/salt

[BUG] mine.get does not use no_host_keys: True in salt-ssh

Open
#59,842 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug Salt-SSH severity-medium
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
When using salt-ssh with no_host_keys mine.get tries to call target host without -o StrictHostKeyChecking=no and stuck on

The authenticity of host 'simple-server-one-0-ip (simple-server-one-0-ip)' can't be established.
ECDSA key fingerprint is SHA256:something
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Setup

/root/.salt/Saltfile
salt-ssh:
  no_host_keys: True
/etc/salt/roster
simple-server-one-0:
  host: simple-server-one-0-ip # The IP addr or DNS hostname
  user: administrator         # Remote executions will be executed as user fred
  passwd: Test123!  # The password to use for login, if omitted, keys are used
  sudo: True         # Whether to sudo to root, not enabled by default
  mine_functions:
    network.ip_addrs
simple-server-one-1:
  host:  simple-server-one-1-ip # The IP addr or DNS hostname
  user: administrator         # Remote executions will be executed as user fred
  passwd: Test123!  # The password to use for login, if omitted, keys are used
  sudo: True         # Whether to sudo to root, not enabled by default
  mine_functions:
    network.ip_addrs
simple-server-two-0:
  host: simple-server-two-0-ip # The IP addr or DNS hostname
  user: administrator         # Remote executions will be executed as user fred
  passwd: Test123!  # The password to use for login, if omitted, keys are used
  sudo: True         # Whether to sudo to root, not enabled by default
  mine_functions:
    network.ip_addrs
simple-server-two-1:
  host: simple-server-two-1-ip # The IP addr or DNS hostname
  user: administrator         # Remote executions will be executed as user fred
  passwd: Test123!  # The password to use for login, if omitted, keys are used
  sudo: True         # Whether to sudo to root, not enabled by default
  mine_functions:
    network.ip_addrs

Steps to Reproduce the behavior
salt-ssh -i -l trace 'simple-server-one-1' mine.get 'simple-server-one-0' network.interfaces
from log

....
118 [DEBUG   ] Executed SHIM command. Command logged to TRACE
119 [TRACE   ] Executing command: ssh simple-server-one-1-ip -o KbdInteractiveAuthentication=no -o PasswordAuthentication=yes -o GSSAPIAuthentication=no -o ConnectTimeout=65 -o StrictHostKeyChecking=no -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o Port=22 -o IdentityFile=/etc/salt/pki/master/ssh/salt-ssh.rsa -o User=administrator  /bin/sh << 'EOF'
....
6280 [DEBUG   ] Child Forked! PID: 5663  STDOUT_FD: 17  STDERR_FD: 19
6281 [DEBUG   ] VT: Salt-SSH SHIM Terminal Command executed. Logged to TRACE
6282 [TRACE   ] Terminal Command: ssh simple-server-one-0 -o KbdInteractiveAuthentication=no -o PasswordAuthentication=yes -o GSSAPIAuthentication=no -o ConnectTimeout=65 -o Port=22 -o IdentityFile=/etc/salt/pki/master/ssh/salt-ssh.rsa -o User=administrator /bin/sh  << 'EOF'
...

Expected behavior
salt should use config from salt-ssh: in every ssh call

Screenshots
If applicable, add screenshots to help explain your problem.

Versions Report

Salt Version:
          Salt: 3002.5

Dependency Versions:
          cffi: 1.14.3
      cherrypy: unknown
      dateutil: 2.8.1
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 2.10.1
       libgit2: Not Installed
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 1.0.0
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: 2.17
      pycrypto: Not Installed
  pycryptodome: 3.9.8
        pygit2: Not Installed
        Python: 3.7.10 (default, Feb 25 2021, 02:08:18)
  python-gnupg: 0.4.4
        PyYAML: 5.3.1
         PyZMQ: 18.0.1
         smmap: Not Installed
       timelib: 0.2.4
       Tornado: 4.5.3
           ZMQ: 4.3.1

System Versions:
          dist: alpine 3.12.4
        locale: UTF-8
       machine: x86_64
       release: 5.4.72-microsoft-standard-WSL2
        system: Linux
       version: Alpine Linux 3.12.4

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the salt-ssh mine.get entry point and the SSH command construction, using the Saltfile no_host_keys setting and the roster configuration as inputs. Compare the SSH options for the initial command with those used to contact the target host; done means every SSH call includes the configured host-key options and the reproduction no longer prompts for confirmation.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.