Host key verification failed on SFTP Pipeline

Question

Hello,

I'm trying to deploy to an testing server. As my server can't be accessed from internet, I’m using a self.hosted runner to copy my files and deploy inside my network

As my server is on a local network, I use cat command to add my know_host information but i always get a Host Key Verification Fail.  I'ts like the sftp pipeline doesn't read from the same know_host file.

Any help will be appreciated.

YML File

Cat Log

Error:

Igor Stoyanov · Answer

@Caleb L_ Power . Our team will investigate this and notify you when this feature will become available.

Regards, Igor

Caleb L_ Power · Answer

I think the standards should be consistent, at the very least, so that the fixes for one pipe aren't different from another. My recommendations in the short term would be to set it to "yes" actually on both repositories (it's probably safer to have users opt out of security), and then to improve the documentation on the actual ssh-run and sftp-deploy repos. The documentation should include two options:

* Option one, to explicitly set the fingerprint in a secret deployment variable and to add it to the correct known_hosts file, and
* Option two, to explicitly set the EXTRA_ARGS flag to skip strict host key checking

I would think that the documentation should explicitly include examples in both instances. However, in general the hack-and-slash method of redirecting secret deployment variables into those files isn't super user-friendly (esp. if the users have to go hunt around in the code for that), so long-term I'd recommend having a pipe or something similar to do that automatically. Something like this would be nice:

pipe: atlassian/add-host:0.0.1
  USER: $USER # remote username
  KEY: $SSH_PRIVKEY # base64 private key representation
  HOST: $HOST_IP # remote IP address
  PORT: $HOST_PORT # remote port
  FINGERPRINT: $FINGERPRINT # optional, to verify fingerprint

That long-term idea would be to add a host on the fly to known_hosts (and match against the queried fingerprint), add the new private key wherever it needs to go, etc.

Igor Stoyanov · Answer

@Caleb L_ Power. It is worked in shh-run, because StrictHostKeyChecking is set to no by default there.
So you think it is a good idea to add this behaviour to the sftp-deploy pipe too?

Also you should put your known_hosts file here: /opt/atlassian/pipelines/agent/ssh
according to logic.

Regards, Igor