0

I am setting up an EC2 instance with Terraform, and I need to run a large script during this process. I want to download the script from our gitlab repository with something like:

git clone [email protected]:a_name/project.git
Cloning into 'project'...
The authenticity of host 'gitlab.something.org (12.34.56.78)' can't be established.
ECDSA key fingerprint is SHA256:....
Are you sure you want to continue connecting (yes/no)? yes
Cloning into ...

When I run this from the command line, I have to confirm, but this isn't possible in my situation.

However in /var/log/cloud-init-output.log I see this (after having uploaded the correct, private key):

Cloning into 'project'...
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

I am hoping this error is simply the result of not responding with a 'yes' - is there a way to tell git that it's OK, I know what I am doing, and just get on with it?

Improve this question

1 Answer 1

Reset to default
2

Use your automated system to deploy a known_hosts file which has the correct hostkeys. You can copy the entries from your own known_hosts, e.g. using ssh-keygen -F gitlab.something.org (this works even if the file has been hashed).

The file could be deployed either at ~/.ssh/known_hosts or at /etc/ssh/ssh_known_hosts.

Note that the hostkey verification isn't there just to make you confirm what you're doing; it's there to confirm that what you're trying to do matches with what is actually happening. Much like HTTPS, it's meant to guard against external factors such as MITM attacks – the URL you've entered might be 100% correct the whole time, but the packets might suddenly get rerouted to the wrong server months or years later.

Improve this answer
3
  • I understand - however, in this particular situation I'm creating an EC2 instance about once a month, that will download a script, run it to test a database backup by restoring it, and then the instance is destroyed. I think it is probably going to be safe enough, but I do appreciate the security concerns. I tried to run ssh-keyscan as part of the user_data, but it doesn't seem to get run at all.
    – j4nd3r53n
    Oct 21, 2019 at 15:09
  • You don't need to automate running ssh-keyscan at all. Just deploy a static one-line file that contains your GitLab server's public key.
    – u1686_grawity
    Oct 21, 2019 at 15:11
  • That works fine - only problem now is that git apparently fails automatically simply because it is not running on a tty, but that is another problem. Thanks!
    – j4nd3r53n
    Oct 21, 2019 at 15:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .