Host key verification failed, tried all possible ways

Icinga 2
1

I trying to use by_ssh to run a script from the remote. I Created a user “xxx” in both server1 and server2.
Also configured the ssh , I am able to login to server2 from server1 as “xxx” user without password.

I created the below simple by_ssh server to run a basic script but it fails with “Remote command execution failed: Host key verification failed” Error.

template Host "ssh-agent" {
  check_command = "hostalive"

  vars.agent_type = "ssh"
  vars.os_type = "linux"
}

object Host "qa Abilash" {
  import "ssh-agent"

  address = "10.**.**.244"
}


apply Service "Testing qa from prod" {
  check_command = "by_ssh"

  vars.by_ssh_command = [ "./ping" ]
  vars.by_ssh_logname = "testprod"
  vars.by_ssh_identity = "/home/testprod/.ssh/id_rsa"

  assign where host.vars.os_type == "linux" && host.vars.agent_type == "ssh"
}

What am I missing?

2

You need to connect once with the user that Icinga runs as and accept the host key or start to sign your ssh-keys.

3

To emphasise what @rivad has written, you should not create an user on server1 to login on server2. Depending on you distribution icinga runs as icinga or nagios. For this user you need to configure ssh connection to the user on server2. To do so you could run e.g.

sudo -u nagios bash
ssh testprod@server2

Once this is working with without asking for a password, your checks will work as well.

1 Like
4

Not entirely true.

@AbilashKriz
You could add a config file /var/lib/nagios/.ssh/config

with:

Host *
StrictHostKeyChecking no

Worked for me !

2 Likes
5

worked for me as well! Thanxx

6

Since this thread was just revived, I wanted to warn that this configuration is potentially dangerous!

According to the section in ssh_config(5), “[i]f this flag is set to no or off, ssh will automatically add new host keys to the user known hosts files and allow connections to hosts with changed hostkeys to proceed, subject to some restrictions.” In other words, this allows MITM attacks.

Please try to verify the peer’s public key once, which can also be done via some script.

In case you are unable to do so and want to proceed with StrictHostKeyChecking, then set it to accept-new.

2 Likes