<p>There are boolean variables for this that can be set where they're needed (such as in playbooks) so as not to do this globally, which reduces overall security.</p>
<pre class="lang-yaml prettyprint-override"><code>    var: ansible_host_key_checking
    var: ansible_ssh_host_key_checking
    var: ansible_paramiko_host_key_checking
</code></pre>
<p>So doing <code>ansible_ssh_host_key_checking: False</code> in a playbook should work.</p>
<p>However, I don't believe they'll work until Ansible 2.12.  See <a href="https://github.com/ansible/ansible/issues/49254" rel="nofollow noreferrer">Disabling host key checking via variable doesn't seem to work. #49254</a> for details.</p>
<p>For now, I'd recommend doing this:</p>
<pre class="lang-sh prettyprint-override"><code>ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook ...
</code></pre>
<p>...and not setting this in the global Ansible configuration.  It's a good idea to be explicit when disabling security features so that you're aware of what you're doing.</p>

CC BY-SA 4.0
2021-06-15T16:43:10.930Z
2021-06-15T16:43:10.930Z
colan
<p>This is typically done by setting the following value in <code>ansible.cfg</code>:</p>

<pre><code>[defaults]
host_key_checking = False
</code></pre>

<p>If you don't want to modify <code>ansible.cfg</code> you can set an environment variable like so:</p>

<pre><code>export ANSIBLE_HOST_KEY_CHECKING=False
</code></pre>

<p>Source: <a href="http://docs.ansible.com/ansible/intro_getting_started.html#host-key-checking" rel="noreferrer">http://docs.ansible.com/ansible/intro_getting_started.html#host-key-checking</a></p>

CC BY-SA 4.0
2019-08-02T01:19:44.893Z
I am using MacOS and setting host_key_checking=False but I still got "WARNING: POSSIBLE DNS SPOOFING DETECTED!". I fixed this after I realized that I connected to a target host of the same name earlier and then rebuilt it so there was an old key in ./ssh/known_hosts.
Chad Juliano
CC BY-SA 4.0
2020-11-24T14:53:00.663Z
Note tht this does **not** answer the question, even though it might appear to. This will stop prompts to accept new host keys, but it will save each host key for future connections in `known_hosts`. What the question wants is " ssh to auto-accept **and redirect to /dev/null**". The [other answer](https://devops.stackexchange.com/a/726/24863) provides the correct solution.
JBentley
CC BY-SA 3.0
2017-05-26T20:44:20.143Z
2017-08-15T20:52:57.713Z
2017-08-15T20:52:57.713Z
Zlemini 
<p>In your <code>ansible.cfg</code> file you need to add the following line:</p>

<pre><code>ssh_args = -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no
</code></pre>

<p>You could also add those options in your <code>~/.ssh/config</code> on every machine from which you run it something like this:</p>

<pre><code>Host *
   StrictHostKeyChecking no
   UserKnownHostsFile=/dev/null
</code></pre>

CC BY-SA 3.0
2017-03-30T16:32:18.217Z
This should work.  Also, look at the [ansible.cfg](https://raw.githubusercontent.com/ansible/ansible/devel/examples/ansible.cfg) file for more settings :)
Dawny33
CC BY-SA 3.0
2017-03-30T17:19:52.380Z
+1 for Dawny's addition, because those using Paramiko will need to use ansible.cfg
Woodland
CC BY-SA 3.0
2017-03-30T18:03:05.530Z
Is there an appropriate way to set that inside the playbook?  I've tried `ansible_ssh_common_args` and `ansible_ssh_extra_args` and it doesn't override what I've got in the ansible.cfg.  I've got an ansible.cfg that I use for everything else and would rather just override those parameters for this type of playbook than copy it just to make that change.
Peter Turner
CC BY-SA 3.0
2017-03-30T21:37:51.777Z
I can't speak to those variables, Peter, but you could put a modified ansible.cfg in the directory with this playbook, and it will take precedence.
Woodland
CC BY-SA 3.0
2018-02-03T19:19:52.417Z
UserKnownHostsFile=/dev/null completly break ssh security
mmv-ru
CC BY-SA 4.0
2020-11-24T15:02:55.513Z
@mmv-ru That depends on the context . Not everyone uses ssh for the standard "connect to remote machine" scenario. E.g. it's common to use constantly-recycled Vagrant boxes for testing. If you use `StrictHostKeyChecking = no` without `UserKnownHostsFile=/dev/null` you will pollute `known_hosts` with useless keys. This creates an attack surface: anyone who gets their hand on one of your Vagrant boxes has a public key which your SSH client will accept from remote hosts. If instead the key is discarded every time, then your soon-to-be-recycled Vagrant box leaves no lasting trace on your system.
JBentley
CC BY-SA 4.0
2018-12-22T20:36:16.230Z
I believe the best option is to use StrictHostKeyChecking no and not to use  UserKnownHostsFile=/dev/null, you got a vote up anyway :)
Waheed
CC BY-SA 3.0
2017-03-30T16:13:06.910Z
2017-05-27T05:25:39.413Z
2017-05-27T05:25:39.413Z
Jiri Klouda
<p><strong>Bypassing host key checking in ansible</strong></p>
<p>To bypass host key authenticity in ansible; you can follow any of the method:</p>
<p><strong>(1) Using ansible.cfg file:</strong></p>
<pre><code>In the playbook/project  directory, create a file ansible.cfg and add the following line:
    [defaults]
    host_key_checking = False
Note, that this method will work globally and all the hosts that are present in inventory/hosts file will suffer the effect unless mentioned in the hosts file.
</code></pre>
<p><strong>(2) Exporting environment variable from your machine : (Temporary method)</strong></p>
<pre><code>    export ANSIBLE_HOST_KEY_CHECKING=False  
This is the temporary method and will only work as long the session is connected (SSH-session). Once, you break the session, the environment variable will be removed.
</code></pre>
<p><strong>(3) Exporting environment variable from your machine: (Permanent method)</strong></p>
<p>To set the variable “ANSIBLE_HOST_KEY_CHECKING=False ” permanently, edit the ~/.bashrc file of the user running the ansible commands. Add the below line at the end of the file and save and exit.
export ANSIBLE_HOST_KEY_CHECKING=False
Then, source the file so that changes take effect for the current ssh session accordingly by using the command below:
source ~/.bashrc</p>
<p><strong>(3) Using ansible ssh commom arguments Variable:</strong></p>
<pre><code>(a) You can specify SSH options directly in your inventory file for specific hosts or groups:
    [myhosts]
    host1 ansible_ssh_common_args='-o StrictHostKeyChecking=no'
    host2 ansible_ssh_common_args='-o StrictHostKeyChecking=no'

(b) You can also define the the above arguments in playbooks:
    
    For example:
    -name: Playbook for copying files from local machine to remote server
          hosts: all
                  vars:
                  ansible_ssh_common_args: '-o StrictHostKeyChecking=no'
          roles:
           - copy_files
</code></pre>
<p><strong>(4) By simply using cli interface and running the ansible command:</strong></p>
<pre><code>For example:
    ansible-playbook -i '52.8.13.17,' -e 'host=52.8.13.17' test-copy-files.yml --private-key /home/ansible-user/.ssh/ansible-user.key --ssh-extra-args='-p 2222' -e &quot;ansible_ssh_common_args='-o StrictHostKeyChecking=no'&quot; --check 
</code></pre>

CC BY-SA 4.0
2024-12-09T10:54:59.313Z
2024-12-09T10:54:59.313Z
Rimsha Gill
<p>I'm running an Ansible playbook with a subtle hack to work on an arbitrary port forwarded port (so I can use one machine with no direct access to lots of machines).  </p>

<p>I've got a pre-task to change the <code>ansible_port</code> variable, so then when I start running my real tasks and roles, I get prompted to accept the hostkeys for localhost on some random port.  </p>

<p>Because I am naive and don't care about security, I would like ssh to auto-accept and redirect to <code>/dev/null</code> (or another file for logging). </p>

<p>Is this possible?</p>

CC BY-SA 3.0
2017-03-30T15:23:21.913Z
You can do it through ssh options you pass to the ansible config.
Jiri Klouda
<ansible><linux>
Can I bypass host key checking in Ansible?
Peter Turner
# Can I bypass host key checking in Ansible?

(Asked by: username_0 on 2017-03-30)

I'm running an Ansible playbook with a subtle hack to work on an arbitrary port forwarded port (so I can use one machine with no direct access to lots of machines).

I've got a pre-task to change the `ansible_port` variable, so then when I start running my real tasks and roles, I get prompted to accept the hostkeys for localhost on some random port.

Because I am naive and don't care about security, I would like ssh to auto-accept and redirect to `/dev/null` (or another file for logging).

Is this possible?

**Tags:** ansible, linux

> **Comments:**
> **username_1**: You can do it through ssh options you pass to the ansible config.  

---

## 4 answers

### Answer by username_3 on 2017-05-26. Score: 37

This is typically done by setting the following value in ansible.cfg:
[defaults]
host_key_checking = False

If you don't want to modify ansible.cfg you can set an environment variable like so:
export ANSIBLE_HOST_KEY_CHECKING=False

Source: http://docs.ansible.com/ansible/intro_getting_started.html#host-key-checking

> **Comments:**
> **username_4**: I am using MacOS and setting host_key_checking=False but I still got "WARNING: POSSIBLE DNS SPOOFING DETECTED!". I fixed this after I realized that I connected to a target host of the same name earlier and then rebuilt it so there was an old key in ./ssh/known_hosts.  
> **username_5**: Note tht this does **not** answer the question, even though it might appear to. This will stop prompts to accept new host keys, but it will save each host key for future connections in `known_hosts`. What the question wants is " ssh to auto-accept **and redirect to /dev/null**". The [other answer](https://devops.stackexchange.com/a/726/24863) provides the correct solution.  

---

### Answer by username_1 on 2017-03-30. Score: 28

In your ansible.cfg file you need to add the following line:
ssh_args = -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no

You could also add those options in your ~/.ssh/config on every machine from which you run it something like this:
Host *
   StrictHostKeyChecking no
   UserKnownHostsFile=/dev/null

> **Comments:**
> **username_6**: This should work.  Also, look at the [ansible.cfg](https://raw.githubusercontent.com/ansible/ansible/devel/examples/ansible.cfg) file for more settings :)  
> **username_7**: +1 for Dawny's addition, because those using Paramiko will need to use ansible.cfg  
> **username_0**: Is there an appropriate way to set that inside the playbook?  I've tried `ansible_ssh_common_args` and `ansible_ssh_extra_args` and it doesn't override what I've got in the ansible.cfg.  I've got an ansible.cfg that I use for everything else and would rather just override those parameters for this type of playbook than copy it just to make that change.  
> **username_7**: I can't speak to those variables, Peter, but you could put a modified ansible.cfg in the directory with this playbook, and it will take precedence.  
> **username_8**: UserKnownHostsFile=/dev/null completly break ssh security  
> **username_9**: I believe the best option is to use StrictHostKeyChecking no and not to use  UserKnownHostsFile=/dev/null, you got a vote up anyway :)  
> **username_5**: @username_8 That depends on the context . Not everyone uses ssh for the standard "connect to remote machine" scenario. E.g. it's common to use constantly-recycled Vagrant boxes for testing. If you use `StrictHostKeyChecking = no` without `UserKnownHostsFile=/dev/null` you will pollute `known_hosts` with useless keys. This creates an attack surface: anyone who gets their hand on one of your Vagrant boxes has a public key which your SSH client will accept from remote hosts. If instead the key is discarded every time, then your soon-to-be-recycled Vagrant box leaves no lasting trace on your system.  

---

### Answer by username_2 on 2021-06-15. Score: 3

There are boolean variables for this that can be set where they're needed (such as in playbooks) so as not to do this globally, which reduces overall security.
    var: ansible_host_key_checking
    var: ansible_ssh_host_key_checking
    var: ansible_paramiko_host_key_checking

So doing ansible_ssh_host_key_checking: False in a playbook should work.
However, I don't believe they'll work until Ansible 2.12.  See Disabling host key checking via variable doesn't seem to work. #49254 for details.
For now, I'd recommend doing this:
ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook ...

...and not setting this in the global Ansible configuration.  It's a good idea to be explicit when disabling security features so that you're aware of what you're doing.


---

### Answer by username_10 on 2024-12-09. Score: 0

Bypassing host key checking in ansible
To bypass host key authenticity in ansible; you can follow any of the method:
(1) Using ansible.cfg file:
In the playbook/project  directory, create a file ansible.cfg and add the following line:
    [defaults]
    host_key_checking = False
Note, that this method will work globally and all the hosts that are present in inventory/hosts file will suffer the effect unless mentioned in the hosts file.

(2) Exporting environment variable from your machine : (Temporary method)
    export ANSIBLE_HOST_KEY_CHECKING=False  
This is the temporary method and will only work as long the session is connected (SSH-session). Once, you break the session, the environment variable will be removed.

(3) Exporting environment variable from your machine: (Permanent method)
To set the variable “ANSIBLE_HOST_KEY_CHECKING=False ” permanently, edit the ~/.bashrc file of the user running the ansible commands. Add the below line at the end of the file and save and exit.
export ANSIBLE_HOST_KEY_CHECKING=False
Then, source the file so that changes take effect for the current ssh session accordingly by using the command below:
source ~/.bashrc
(3) Using ansible ssh commom arguments Variable:
(a) You can specify SSH options directly in your inventory file for specific hosts or groups:
    [myhosts]
    host1 ansible_ssh_common_args='-o StrictHostKeyChecking=no'
    host2 ansible_ssh_common_args='-o StrictHostKeyChecking=no'

(b) You can also define the the above arguments in playbooks:
    
    For example:
    -name: Playbook for copying files from local machine to remote server
          hosts: all
                  vars:
                  ansible_ssh_common_args: '-o StrictHostKeyChecking=no'
          roles:
           - copy_files

(4) By simply using cli interface and running the ansible command:
For example:
    ansible-playbook -i '52.8.13.17,' -e 'host=52.8.13.17' test-copy-files.yml --private-key /home/ansible-user/.ssh/ansible-user.key --ssh-extra-args='-p 2222' -e "ansible_ssh_common_args='-o StrictHostKeyChecking=no'" --check


---

