13

"Host key verification failed." on Gitlab_ci when running "ssh name@server"

Here's a part of my gitlab_ci which is supposed to login to my server and run scripts from the repo:

script:
  - which ssh-agent || ( apt-get update -y && apt-get install openssh-client -y )
  - eval $(ssh-agent -s)
  - ssh-add <(echo -e "$SSH_PRIVATE_KEY")


  - echo "debug"
  - echo "$SSH_PRIVATE_KEY" # all is ok here, it'll be printed
  - echo "debug"


  # - here comes an error
  - (cat ./script/script1.sh) | ssh -t -t $SSH_USERNAME@$SSH_HOST

And the errror:

  Host key verification failed.
  ERROR: Job failed: exit code 1

Why the error? The variables are set.

The private key does work when I'm doing the same thing manually from my local computer and Gitlab.

Oddamati
  • 183
  • 1
  • 2
  • 6
  • 1
    Possible duplicate of [Git error: "Host Key Verification Failed" when connecting to remote repository](https://stackoverflow.com/questions/13363553/git-error-host-key-verification-failed-when-connecting-to-remote-repository) – phd Sep 27 '18 at 22:01
  • https://stackoverflow.com/search?q=%5Bssh-keys%5D+%22Host+key+verification+failed.%22 – phd Sep 27 '18 at 22:02
  • @Oddamati did the answer solved your issue? because I'm facing a similar issue – Mary Oct 29 '20 at 11:20

2 Answers2

12

In addition of Git error: “Host Key Verification Failed” when connecting to remote repository, check your .known_hosts file.

If that same private key is working locally, that might be because, locally, your ~/.ssh/known_hosts file does include the ssh_keyscan of the remote server you want to connect to.
Make sure your GitLab CI job does too.

vvvvv
  • 25,404
  • 19
  • 49
  • 81
VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
3

I hit the same wall today and resolved it.
My solution is adding a -oStrictHostKeyChecking=no option to the ssh.

I found out this problem has been caused by ssh asking you the question below and this isn't supposed to appear in logs.

The authenticity of host 'xxx' can't be established.
ESDSA key fingerprint is xxxxxxxxxxxxx.
Are you sure you want to continue connecting (yes/no)?

The option -oStrictHostKeyChecking=no will suppress this so your ssh might work well.

I hope it will help people who have the same problem.

Akumachan
  • 81
  • 2
  • 9
  • It would work, yes, but at what cost? Removing this security check is generally not recommended (https://security.stackexchange.com/a/40002). – VonC Oct 29 '21 at 12:15