mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2025-01-07 04:24:10 +01:00
d5e6e39f0c
We don't want these comments to be added to docs/ssh-known_hosts.txt. From OpenSSH 9.8 release notes [1]: * ssh-keyscan(1): this tool previously emitted comment lines containing the hostname and SSH protocol banner to standard error. This release now emits them to standard output, but adds a new "-q" flag to silence them altogether. [1] https://www.openssh.com/txt/release-9.8
60 lines
1.7 KiB
YAML
60 lines
1.7 KiB
YAML
- name: Fetch ssh hostkeys
|
|
hosts: all
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Fetch hostkey checksums
|
|
shell: |
|
|
for type in sha256 md5; do
|
|
for file in /etc/ssh/ssh_host_*.pub; do
|
|
ssh-keygen -l -f $file -E $type
|
|
done
|
|
echo
|
|
done
|
|
register: ssh_hostkeys
|
|
changed_when: ssh_hostkeys | length > 0
|
|
|
|
- name: Fetch known_hosts
|
|
shell: |
|
|
set -eo pipefail
|
|
ssh-keyscan -q -p {{ ansible_port | default(22) }} 127.0.0.1 2>/dev/null \
|
|
| sed -E 's/^(\[?)127\.0\.0\.1/\1{{ inventory_hostname }}/' \
|
|
| sort
|
|
environment:
|
|
LC_COLLATE: C.UTF-8 # to ensure reproducible ordering
|
|
args:
|
|
executable: /bin/bash
|
|
register: known_hosts
|
|
changed_when: known_hosts | length > 0
|
|
|
|
- name: Store hostkeys
|
|
hosts: localhost
|
|
tasks:
|
|
- name: Store hostkeys
|
|
copy:
|
|
dest: "{{ playbook_dir }}/../../docs/ssh-hostkeys.txt"
|
|
content: |
|
|
{% for host in query('inventory_hostnames', 'all') | sort %}
|
|
# {{ host }}
|
|
{{ hostvars[host].ssh_hostkeys.stdout }}
|
|
|
|
{% endfor %}
|
|
mode: preserve
|
|
|
|
- name: Store known_hosts
|
|
blockinfile:
|
|
path: "{{ playbook_dir }}/../../docs/ssh-known_hosts.txt"
|
|
block: |
|
|
|
|
{% for host in query('inventory_hostnames', 'all') | sort %}
|
|
# {{ host }}
|
|
{{ hostvars[host].known_hosts.stdout }}
|
|
|
|
{% endfor %}
|
|
|
|
- name: Upload known_hosts to all nodes
|
|
hosts: all
|
|
tasks:
|
|
- name: Upload known_hosts
|
|
copy: dest=/etc/ssh/ssh_known_hosts src="{{ playbook_dir }}/../../docs/ssh-known_hosts.txt" owner=root group=root mode=0644
|
|
tags: ['upload-known-hosts']
|