2

In running ssh with agent forwarding. This allows me to do hg/git pulls from my server from systems that I have been authorized to based on my local

i.e

ssh -A myserver
hg clone ssh://myreposerver/repo

However, my local known_hosts is not used when for the clearing of known hosts. This means I'll have to type "yes" after verifying the host is correct. That in itself is not so much of a problem, but I'm automating all of this, so I never get to see the input prompt.

i.e. I'm really doing this:

ssh -A myserver "hg clone ssh://myreposerver/repo"

Of course, I could simply copy the whole known_hosts file, but that's not really elegant and causes maintenance problems of itself. For example, every project runs on its own user account to provide an extra layer of security, and I don't want to copy the known_hosts file to every user.

Any idea on how to do "known_hosts" forwarding?

=====

EDIT for workaround:

ssh -t -A myserver "hg clone ssh://myreposerver/repo"

Forces a pseudo tty allocation, which means in practice that I can at least send "yes" to the remote call of ssh (that is itself being called by hg)

  • 1
    I think this question might better be suited at ServerFault – Peter Manton May 13 '11 at 18:32
  • One work-around is to run ssh-keygen -R yourserver && ssh-keyscan -H yourserver >> ~/.ssh/known_hosts. Not sure if it's possible to forward your known_hosts file though. – ZachB Apr 26 '18 at 18:35
  • (However that's vulnerable to MITM attacks. Appending specific keys to your known_hosts file is probably the best option.) – ZachB Apr 26 '18 at 19:13
0

For the purposes of automation, you could also disable known hosts checking in ssh when cloning your repository.

Git allows to customise the ssh command, by using GIT_SSH_COMMAND env variable. To disable known host checking, you have to set it like this: GIT_SSH_COMMAND='ssh -o StrictHostKeyChecking=no'.

OP's full command would look like this:

ssh -A myserver "GIT_SSH_COMMAND='ssh -o StrictHostKeyChecking=no' git clone ssh://myreposerver/repo"

Before doing it make sure you're familiar with security risk of disabling strict host checking or make sure you're only doing it within your internal infrastructure.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.