It works because this creates a separate $HOME/.ssh/known_hosts for
Capistrano / Net-SSH to use. The issue people are seeing is when OpenSSH and
Net-SSH share a known_hosts file, and there's already a (say DSA) host key
in there from OpenSSH, and Net-SSH receives a RSA host key -- it doesn't
take into account that different key types for the same host *shouldn't*
match, and raises the exception you see.

I've suggested raising a different exception in this case, which by default
could cause the key to be added to known_hosts as for a truly unknown host.
Genuine same-type mismatches should still raise, of course.

The suggestion to change $HOME is good - thinking about it, instead of that,
I'd like to see the location of known_hosts be configurable, and default to
(say) $RAILS_ROOT/config/known_hosts. You could then prepopulate that with
the keys for your servers, which would be an improvement on just accepting
them the first time you deploy.

Thoughts?


Chris.

On 24/05/07, Khaled Hassounah <[EMAIL PROTECTED]> wrote:
>
>
> the common theme in all I have read in this thread is that it is not
> just that Capistrano fails, but that command line ssh doesn't warn
> about keys. the server I was deploying to was in my ~/.ssh/known_host,
> Capistrano was complaining about it. So I set HOME to my rails root
> and that solved the problem.
>
> What it did is that it created a .ssh file in my rails root which
> contained the keys of all the servers Capistrano talked to. Since I
> haven't thought through why this works, it is still officially a work
> around. But I believe it is safer than disabling ssh paranoia
> (ssh_options[:paranoid] = false).
>
> cheers
> Khaled
>
> On May 1, 10:17 am, Jamis Buck <[EMAIL PROTECTED]> wrote:
> > Try this:
> >
> >    ssh_options[:paranoid] = false
> >
> > That'll skip any host key verification.
> >
> > If you try to use the command-line ssh client to connect to
> > "myserver", do you get any hostkey mismatch warnings?
> >
> > - Jamis
> >
> > On May 1, 2007, at 11:12 AM, [EMAIL PROTECTED] wrote:
> >
> >
> >
> > > I'm currently using Capistrano 1.4.1 and I upgraded net-ssh to version
> > > 1.1.0 this morning.  I'm also using Jim Morris's SCM module for local
> > > SVN access. When I try to deploy, my deployment blows up when trying
> > > to connect to my remote server with the following output (I've replace
> > > my fingerprint and server name to protect the innocent):
> >
> > >   * querying latest revision...
> > >   * local executing: svn export    -q -r15800 svn+ssh://dev/vol2/svn/
> > > fsg/cap-one/branches/PR3 /tmp/CAP_TEMP_1178037278.66282
> > >   * local creating tar file: /tmp/CAP_TEMP_1178037278.66282.tar.gz
> > >   * sending tar file: /tmp/CAP_TEMP_1178037278.66282.tar.gz to
> > > remote /
> > > tmp/CAP_TEMP_1178037278.66282.tar.gz
> > >    servers: ["myserver"]
> > > *** [update_code] transaction: rollback
> > >   * [update_code] rolling back
> > >   * executing "rm -rf /var/www/www.myserver.com/releases/
> > > 20070501163438"
> > >     servers: ["myserver"]
> > >  ** [update_code] exception while rolling back:
> > > Net::SSH::HostKeyMismatch, fingerprint my_fingerprint does not match
> > > for myserver
> > > /opt/local/lib/ruby/gems/1.8/gems/net-ssh-1.1.0/lib/net/ssh/host-key-
> > > verifier.rb:47:in `process_cache_miss': fingerprint my_fingerprint
> > > does not match for myserver (Net::SSH::HostKeyMismatch)
> > >         from /opt/local/lib/ruby/gems/1.8/gems/net-ssh-1.1.0/lib/net/
> > > ssh/host-key-verifier.rb:38:in `verify'
> > >         from /opt/local/lib/ruby/gems/1.8/gems/net-ssh-1.1.0/lib/net/
> > > ssh/lenient-host-key-verifier.rb:9:in `verify'
> > >         from /opt/local/lib/ruby/gems/1.8/gems/net-ssh-1.1.0/lib/net/
> > > ssh/transport/kex/dh.rb:165:in `verify_server_key'
> > >         from /opt/local/lib/ruby/gems/1.8/gems/net-ssh-1.1.0/lib/net/
> > > ssh/transport/kex/dh.rb:232:in `exchange_keys'
> > >         from /opt/local/lib/ruby/gems/1.8/gems/needle-1.3.0/lib/
> > > needle/
> > > lifecycle/proxy.rb:60:in `__send__'
> > >         from /opt/local/lib/ruby/gems/1.8/gems/needle-1.3.0/lib/
> > > needle/
> > > lifecycle/proxy.rb:60:in `method_missing'
> > >         from /opt/local/lib/ruby/gems/1.8/gems/net-ssh-1.1.0/lib/net/
> > > ssh/transport/session.rb:182:in `exchange_keys'
> > >         from /opt/local/lib/ruby/gems/1.8/gems/net-ssh-1.1.0/lib/net/
> > > ssh/transport/session.rb:143:in `kexinit'
> > >          ... 57 levels...
> > >         from /opt/local/lib/ruby/gems/1.8/gems/capistrano-1.4.1/lib/
> > > capistrano/cli.rb:12:in `execute!'
> > >         from /opt/local/lib/ruby/gems/1.8/gems/capistrano-1.4.1/bin/
> > > cap:11
> > >         from /opt/local/bin/cap:18:in `load'
> > >         from /opt/local/bin/cap:18
> >
> > > I rolled back my net-ssh version installed to 1.0.10 and everything
> > > works fine.  There weren't any warnings I noticed about version
> > > incompatibilities on the announcement page.  Has anyone else
> > > encountered this?
>
>
> >
>

--~--~---------~--~----~------------~-------~--~----~
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/capistrano
-~----------~----~----~----~------~----~------~--~---

Reply via email to