accept_hostkey=yes about ansible-project_deploy HOT 6 CLOSED

It would push the mimimum Ansible requirement to 1.5, but I think that's acceptable... I'll look into actual release dates a bit closer.

I do feel that accepting the hostkey without verification is on the dangerous side for a deploy role, as it opens the door to man-in-the-middle attacks that you would never know about. Not adding this option at lease forces the consumers to use some other avenue to add the github (or any VCS source server) hostkey.

from ansible-project_deploy.

Allright. I was expecting something like this. Then we will have to add the hostkey by hand.

Ping me if you changed your mind. I'll prepare a PR then.

from ansible-project_deploy.

I've used this in the past (also the same security risk, but because the 'lookup' plugin runs on the host machine, the MIM would have to target both my current location and the server I'm deploying to at the same time).

https://coderwall.com/p/wi8yrq/ansible-lineinfile-with-lookup

from ansible-project_deploy.

Thanks!

from ansible-project_deploy.

Decided agains adding the accept_hostkey option, because it makes 'doing it wrong' too easy.

from ansible-project_deploy.

@rommsen I use the bfmartin.ssh_known_hosts role to allow github.com access:

roles:
    - { role: bfmartin.ssh_known_hosts, host: github.com }

from ansible-project_deploy.