{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible-modules-extras/issues/2651","repository_url":"https://api.github.com/repos/ansible/ansible-modules-extras","labels_url":"https://api.github.com/repos/ansible/ansible-modules-extras/issues/2651/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible-modules-extras/issues/2651/comments","events_url":"https://api.github.com/repos/ansible/ansible-modules-extras/issues/2651/events","html_url":"https://github.com/ansible/ansible-modules-extras/issues/2651","id":168838950,"number":2651,"title":"known_hosts doesn't support entries with ssh port specified","user":{"login":"rija","id":11455,"avatar_url":"https://avatars.githubusercontent.com/u/11455?v=3","gravatar_id":"","url":"https://api.github.com/users/rija","html_url":"https://github.com/rija","followers_url":"https://api.github.com/users/rija/followers","following_url":"https://api.github.com/users/rija/following{/other_user}","gists_url":"https://api.github.com/users/rija/gists{/gist_id}","starred_url":"https://api.github.com/users/rija/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rija/subscriptions","organizations_url":"https://api.github.com/users/rija/orgs","repos_url":"https://api.github.com/users/rija/repos","events_url":"https://api.github.com/users/rija/events{/privacy}","received_events_url":"https://api.github.com/users/rija/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ansible/ansible-modules-extras/labels/bug_report","name":"bug_report","color":"fbca04"},{"url":"https://api.github.com/repos/ansible/ansible-modules-extras/labels/waiting_on_maintainer","name":"waiting_on_maintainer","color":"ededed"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-08-02T09:27:00Z","updated_at":"2016-08-05T07:43:10Z","closed_at":null,"body":"##### ISSUE TYPE\r\n - Bug Report\r\n\r\n\r\n##### COMPONENT NAME\r\nknown_hosts\r\n\r\n##### ANSIBLE VERSION\r\n<!--- Paste verbatim output from “ansible --version” between quotes below -->\r\n```\r\nansible 2.1.0.0\r\n  config file = /etc/ansible/ansible.cfg\r\n  configured module search path = Default w/o overrides\r\n```\r\n\r\n##### CONFIGURATION\r\n\r\nn/a\r\n\r\n##### OS / ENVIRONMENT\r\n\r\n\r\n- OS where I run ansible from: Mac OS X 10.11.6 El Capitan\r\n- OS being configured: Ubuntu 16.04 LTS 64-bits on a Digital Ocean Droplet\r\n\r\n##### SUMMARY\r\nWhen the known_hosts file has entries is in the format below,\r\nknown_hosts module is unable to remove these entries and it doesn't know how\r\nto write that in that format either.\r\n\r\n**\\[ public-ip\\]:port ecdsa-sha2-nistp256 key**\r\n\r\nIt is a problem because I don't want to use default port and I use ssh-keyscan\r\nto discover the host's public key and I need the playbook to be idempotent.\r\n\r\nssh-keyscan can take a -p to specify the port but when doing so,\r\nit creates entries in the format mentioned above.\r\n\r\nTo keep known_hosts (and my playbook) idempotent, I need to use -p\r\nwhether the Sshd is using default port or custom port (first run or subsquent runs respctively)\r\n\r\nWhen I use ssh-keyscan with -p and known_hosts,\r\nit works the first time (changing port from default 22 to custom port)\r\nbecause ssh-keyscan use the classic form: **public-ip type key**\r\nwhen it detects that it's called with -p 22.\r\n\r\n\r\n\r\n\r\n##### STEPS TO REPRODUCE\r\n\r\nStarting point: SSHd port has successfully been changed from port 22\r\nto custom port (and the steps below worked that first time).\r\nThen I run the steps again.\r\n\r\n```\r\n- name: first remove the host from our known hosts list as we might have re-spun the hosts\r\n  local_action: known_hosts name={{ansible_host}} state=absent\r\n  tags:\r\n    - sshd.known_hosts.key.remove\r\n\r\n- name: retrieve public host key for the host\r\n  local_action: command ssh-keyscan -p {{ansible_port}} -t ecdsa -H {{ansible_host}}\r\n  register: new_host_key\r\n  tags:\r\n    - sshd.known_hosts.key.retrieve\r\n\r\n- name: add the new host key for the host to our known hosts list\r\n  local_action: known_hosts name={{ansible_host}} key={{new_host_key.stdout}} state=present\r\n  tags:\r\n    - sshd.known_hosts.key.add\r\n\r\n```\r\n\r\n\r\n(note: the problem is the same whether the public ip is hashed with -H or not)\r\n\r\n##### EXPECTED RESULTS\r\n\r\nknown_hosts entry after first step:\r\n\r\n|1|Wo/iD2OG3FQxTJRT0qggIQTx8C0=|fr6pjJDB19AczvlACt6M5HQk1CU= ecdsa-sha2-nistp256 ...\r\nis removed from my known_hosts file\r\n\r\nthen following entry is appended at the end of the file after the third step:\r\n\r\n[|1|YNgaK1Kk3z/J79OgnEcapwmHpXE=|/IWqIMeFwmIKmta/PAH846rpcQ0=]:6547 ecdsa-sha2-nistp256 ...\r\n\r\n\r\n\r\n\r\n##### ACTUAL RESULTS\r\n\r\nthe entry:\r\n\r\n|1|Wo/iD2OG3FQxTJRT0qggIQTx8C0=|fr6pjJDB19AczvlACt6M5HQk1CU= ecdsa-sha2-nistp256 ...\r\nis removed from my known_hosts file\r\n\r\nbut the new entry with port specified is not added to the known_hosts file:\r\n\r\n\r\n```\r\nfatal: [mydroplet -> localhost]:\r\nFAILED! => {\"changed\": false,\r\n\"cmd\": \"/usr/bin/ssh-keygen -F public-ip-here -f /var/folders/t9/5tvwz9yn69xfgtqdzq9lbgvr0000gn/T/tmpLOzsBv\",\r\n\"failed\": true,\r\n\"invocation\": {\"module_args\": {\"key\": \"[|1|hEXzfBLAh2UefDLbleLkow7HfjI=|wHcBCyoUF8aTkkNIqTqnh5Y6GNw=]:6547 ecdsa-sha2-nistp256 ...\",\r\n                \"name\": \"public-ip-here\",\r\n                \"path\": \"path/to/my/known_hosts\",\r\n                \"state\": \"present\"}, \"module_name\": \"known_hosts\"},\r\n\"msg\": \"\", \"rc\": 1, \"stderr\": \"\", \"stdout\": \"\", \"stdout_lines\": []}\r\n```\r\n\r\nI then manually added the entry with the port specified in the known_hosts file,\r\nand after running the steps again, the entry is not removed after the first step:\r\n\r\n\r\n```\r\nok:\r\n[mydroplet -> localhost] => {\"changed\": false, \"gid\": 20, \"group\": \"staff\",\r\n                              \"invocation\": {\"module_args\": {\"key\": null, \"name\": \"public-ip-here\",\r\n                              \"path\": \"path/to/my/known_hosts\", \"state\": \"absent\"},\r\n                              \"module_name\": \"known_hosts\"},\r\n\"key\": null, \"mode\": \"0600\", \"name\": \"public-ip-here\",\r\n\"owner\": \"xxxx\", \"path\": \"path/to/my/known_hosts\",\r\n\"size\": 32259, \"state\": \"file\", \"uid\": 501}\r\n```"},"comment":{"url":"https://api.github.com/repos/ansible/ansible-modules-extras/issues/comments/237779052","html_url":"https://github.com/ansible/ansible-modules-extras/issues/2651#issuecomment-237779052","issue_url":"https://api.github.com/repos/ansible/ansible-modules-extras/issues/2651","id":237779052,"user":{"login":"rija","id":11455,"avatar_url":"https://avatars.githubusercontent.com/u/11455?v=3","gravatar_id":"","url":"https://api.github.com/users/rija","html_url":"https://github.com/rija","followers_url":"https://api.github.com/users/rija/followers","following_url":"https://api.github.com/users/rija/following{/other_user}","gists_url":"https://api.github.com/users/rija/gists{/gist_id}","starred_url":"https://api.github.com/users/rija/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rija/subscriptions","organizations_url":"https://api.github.com/users/rija/orgs","repos_url":"https://api.github.com/users/rija/repos","events_url":"https://api.github.com/users/rija/events{/privacy}","received_events_url":"https://api.github.com/users/rija/received_events","type":"User","site_admin":false},"created_at":"2016-08-05T07:43:10Z","updated_at":"2016-08-05T07:43:10Z","body":"Hi, thanks for your reply. \r\nIt would make sense (and makes the problem moot)  if the port was inside the hash, but it doesn't seem to be the case as you can see in my example wish I repeat below (6547 is the port): \r\n\r\n```\r\n[|1|YNgaK1Kk3z/J79OgnEcapwmHpXE=|/IWqIMeFwmIKmta/PAH846rpcQ0=]:6547\r\n```\r\n\r\nalso the fact that ssh-keyscan omit the port altogether if the port is 22 doesn't help as it creates inconsistencies. \r\n\r\nAt the moment, my workaround is to not use known_hosts and to call ssh-keyscan manually with the command module and update the known_hosts file using lineinfile module. (And I still need to use ssh-keygen to verify the new key).  It's hacky, but I needed to move forward. \r\n\r\n[known_hosts.py](https://github.com/ansible/ansible-modules-extras/blob/devel/system/known_hosts.py) should be agnostic about whether we use ssh-keyscan or not as the input is \"key=<key>\".  It probably just needs to know that the key can be of the format **[ip]:port** and not strip the port somewhere in the process. \r\n\r\nWhen called directly,  ssh-keygen -R is able to recognise that format and it seems that [known_hosts.py](https://github.com/ansible/ansible-modules-extras/blob/devel/system/known_hosts.py) use ssh-keygen, so the issue might be fairly localised.\r\n\r\n"}}
{"actor":{"display_login":"rija"}}