ssh:尽管禁用了严格的主机键检查，但还是会发出警告

Question

我正在运行一个ansible任务，但这更像是一个ssh问题；

我执行一个rsync命令(从我的localhost到vagrant机器)如下：

command: "rsync -zaP  -e 'ssh -p {{ ansible_port }} -o StrictHostKeyChecking=no' {{ temp_build_directory }}/artifacts.tar.gz {{ rsync_remote_user }}@{{ ansible_host }}:/tmp"

尽管我显式地禁用了主机键检查，但在某一时刻我还是得到了以下错误：

TASK [send_artifacts : Transfer Artifacts -->  Transfer tarball to deployment targets] ***
fatal: [vagrant -> localhost]: FAILED! => changed=true 
  cmd:
  - rsync
  - -zaP
  - -e
  - ssh -p 2222 -o StrictHostKeyChecking=no
  - /tmp/mdr-700263/artifacts.tar.gz
  - vagrant@127.0.0.1:/tmp
  delta: '0:00:00.351747'
  end: '2018-10-18 12:04:52.350948'
  msg: non-zero return code
  rc: 23
  start: '2018-10-18 12:04:51.999201'
  stderr: |-
    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
    @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
    IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
    Someone could be eavesdropping on you right now (man-in-the-middle attack)!
    It is also possible that a host key has just been changed.
    The fingerprint for the ECDSA key sent by the remote host is
    SHA256:8r8mZHkCiXJBAu7LeaFsjpa5g2gpQTZzf7RpesOV0QQ.
    Please contact your system administrator.
    Add correct host key in /home/ansible/.ssh/known_hosts to get rid of this message.
    Offending ECDSA key in /home/ansible/.ssh/known_hosts:3
      remove with:
      ssh-keygen -f "/home/ansible/.ssh/known_hosts" -R [127.0.0.1]:2222
    Password authentication is disabled to avoid man-in-the-middle attacks.
    Keyboard-interactive authentication is disabled to avoid man-in-the-middle attacks.
    rsync: link_stat "/tmp/mdr-700263/artifacts.tar.gz" failed: No such file or directory (2)
    rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1183) [sender=3.1.1]
  stderr_lines:

为什么会这样呢？

Answer 1

ssh对主机键的更改发出了警告。错误来自rsync，并指出在本地机器上找不到源文件(/tmp/mdr-700263/artifacts.tar.gz)。这些可能与此无关。

您将得到ssh警告，因为对主机密钥与known_hosts中已知密钥的验证总是完成的，而不管StrictHostKeyChecking设置如何。

来自ssh_config手册：

StrictHostKeyChecking如果此标志设置为“no”或“off”，ssh将自动向用户已知的主机文件中添加新的主机键，并允许与已更改主机键的主机的连接继续进行，但有一些限制。在所有情况下，都会自动验证已知主机的主机密钥。