Plugins » Ansible

When you run Ansible against a host that is not yet in the foreman-proxy '.ssh/known_hosts', Ansible prompts you to verify the key (actually, ssh does).

Since Foreman REX does not have an interactive mode where I could say yes or no, I think a sensible approach would be the following:

• Read '~foreman-proxy/.known_hosts' before running Ansible.
• Add a playbook in foreman_ansible seeds that basically runs 'ssh-keyscan' and adds the public SSH of a host to known_hosts.
• If the host is not found in .known_hosts (first Ansible run through the proxy), we prefix that to the regular playbook.
• If it's found, we just run the playbook as always and would detect MITM.