{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible/issues/14920","repository_url":"https://api.github.com/repos/ansible/ansible","labels_url":"https://api.github.com/repos/ansible/ansible/issues/14920/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible/issues/14920/comments","events_url":"https://api.github.com/repos/ansible/ansible/issues/14920/events","html_url":"https://github.com/ansible/ansible/issues/14920","id":140175589,"number":14920,"title":"ssh-extra-args ProxyCommand disables host_key_checking=False","user":{"login":"aioue","id":1254905,"avatar_url":"https://avatars.githubusercontent.com/u/1254905?v=3","gravatar_id":"","url":"https://api.github.com/users/aioue","html_url":"https://github.com/aioue","followers_url":"https://api.github.com/users/aioue/followers","following_url":"https://api.github.com/users/aioue/following{/other_user}","gists_url":"https://api.github.com/users/aioue/gists{/gist_id}","starred_url":"https://api.github.com/users/aioue/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aioue/subscriptions","organizations_url":"https://api.github.com/users/aioue/orgs","repos_url":"https://api.github.com/users/aioue/repos","events_url":"https://api.github.com/users/aioue/events{/privacy}","received_events_url":"https://api.github.com/users/aioue/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-11T12:47:28Z","updated_at":"2016-03-11T12:51:12Z","closed_at":null,"body":"##### Issue Type:\r\n\r\n - Bug Report\r\n\r\n##### Ansible Version:\r\n\r\n```\r\nansible 2.0.1.0\r\n  config file = /Users/tpai/src/cm/ansible.cfg\r\n  configured module search path = Default w/o overrides\r\n```\r\n\r\n##### Ansible Configuration:\r\n\r\n```\r\n[defaults]\r\n\r\nhost_key_checking=False\r\ntimeout=20\r\nforks=20\r\n\r\nforce_handlers = True\r\nroles_path = ./roles\r\ncallback_whitelist=profile_tasks\r\nfilter_plugins = ./filter_plugins\r\n\r\n[ssh_connection]\r\npipelining = True\r\ncontrol_path = /tmp/ansible-ssh-%%h-%%p-%%r\r\n```\r\n\r\n##### Environment:\r\n\r\n**Ansible host**: OS X 10.11.3\r\n**Targets**: Ubuntu 14.04.02\r\n\r\n##### Summary:\r\n\r\n`ssh-extra-args` ProxyCommand breaks `host_key_checking=False`.\r\n\r\nWhen using `ssh-extra-args` with `host_key_checking=False` set in either `ansible.cfg` or in the `ssh-extra-args` itself, I am still prompted to accept the key for a host I have not connected to before.\r\n\r\n##### Steps To Reproduce:\r\n\r\n```\r\nansible-playbook provision_envs/configure-sid.yml -i inventory/sid --limit=tag_build_5 --vault-password-file ../vault_key --ssh-extra-args='-o ProxyCommand=\"ssh -W %h:%p user@host.com\"' -vvvvv\r\n```\r\n\r\n##### Expected Results:\r\n\r\nRuns playbook against new host.\r\n\r\n##### Actual Results:\r\n\r\nYou are asked to accept the key as if `StrictHostKeyChecking` was enabled.\r\n\r\n```\r\n$ ansible-playbook provision_envs/configure-sid.yml -i inventory/sid --limit=tag_build_5 --vault-password-file ../vault_key --ssh-extra-args='-o ProxyCommand=\"ssh -W %h:%p user@host.com\"' -vvvvv\r\nUsing /Users/tpai/src/cm/ansible.cfg as config file\r\nLoaded callback default of type stdout, v2.0\r\nLoaded callback profile_tasks of type aggregate, v2.0\r\n2 plays in provision_envs/configure-sid.yml\r\n\r\nPLAY ***************************************************************************\r\nskipping: no hosts matched\r\n\r\nPLAY ***************************************************************************\r\n\r\nTASK [setup] *******************************************************************\r\nFriday 11 March 2016  12:40:12 +0000 (0:00:00.122)       0:00:00.122 **********\r\n<10.0.251.222> ESTABLISH SSH CONNECTION FOR USER: user\r\n<10.0.251.222> SSH: ansible.cfg set ssh_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s)\r\n<10.0.251.222> SSH: ANSIBLE_HOST_KEY_CHECKING/host_key_checking disabled: (-o)(StrictHostKeyChecking=no)\r\n<10.0.251.222> SSH: ansible_password/ansible_ssh_pass not set: (-o)(KbdInteractiveAuthentication=no)(-o)(PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey)(-o)(PasswordAuthentication=no)\r\n<10.0.251.222> SSH: ANSIBLE_REMOTE_USER/remote_user/ansible_user/user/-u set: (-o)(User=user)\r\n<10.0.251.222> SSH: ANSIBLE_TIMEOUT/timeout set: (-o)(ConnectTimeout=20)\r\n<10.0.251.222> SSH: PlayContext set ssh_common_args: ()\r\n<10.0.251.222> SSH: PlayContext set ssh_extra_args: (-o)(ProxyCommand=ssh -W %h:%p user@host.com)\r\n<10.0.251.222> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/tmp/ansible-ssh-%h-%p-%r)\r\n<10.0.251.222> SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=user -o ConnectTimeout=20 -o 'ProxyCommand=ssh -W %h:%p user@host.com' -o ControlPath=/tmp/ansible-ssh-%h-%p-%r 10.0.251.222 '/bin/sh -c '\"'\"'LANG=en_GB.UTF-8 LC_ALL=en_GB.UTF-8 LC_MESSAGES=en_GB.UTF-8 /usr/bin/python'\"'\"''\r\nThe authenticity of host 'host.com (1.2.3.4)' can't be established.\r\nECDSA key fingerprint is SHA256:kjghdfjkghdkfjghkdjfgdfgdfjghdkjfg.\r\nAre you sure you want to continue connecting (yes/no)? \r\n\r\n**ssh connection times out**\r\n\r\nfatal: [7.8.9.0]: UNREACHABLE! => {\"changed\": false, \"msg\": \"SSH Error: data could not be sent to the remote host. Make sure this host can be reached over ssh\", \"unreachable\": true}\r\n        to retry, use: --limit @provision_envs/configure-sid.retry\r\n\r\nPLAY RECAP *********************************************************************\r\n7.8.9.0               : ok=0    changed=0    unreachable=1    failed=0\r\n```"},"comment":{"url":"https://api.github.com/repos/ansible/ansible/issues/comments/195352871","html_url":"https://github.com/ansible/ansible/issues/14920#issuecomment-195352871","issue_url":"https://api.github.com/repos/ansible/ansible/issues/14920","id":195352871,"user":{"login":"amenonsen","id":23628,"avatar_url":"https://avatars.githubusercontent.com/u/23628?v=3","gravatar_id":"","url":"https://api.github.com/users/amenonsen","html_url":"https://github.com/amenonsen","followers_url":"https://api.github.com/users/amenonsen/followers","following_url":"https://api.github.com/users/amenonsen/following{/other_user}","gists_url":"https://api.github.com/users/amenonsen/gists{/gist_id}","starred_url":"https://api.github.com/users/amenonsen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/amenonsen/subscriptions","organizations_url":"https://api.github.com/users/amenonsen/orgs","repos_url":"https://api.github.com/users/amenonsen/repos","events_url":"https://api.github.com/users/amenonsen/events{/privacy}","received_events_url":"https://api.github.com/users/amenonsen/received_events","type":"User","site_admin":false},"created_at":"2016-03-11T12:51:12Z","updated_at":"2016-03-11T12:51:12Z","body":"This is not a bug. You can add ``-o StrictHostKeyChecking=no`` in your ProxyCommand if you want that behaviour. It would be very unwise for Ansible to try and insert extra arguments into an ssh_extra_args specified by the user."}}