I'm using the installSshKey task to install an SSH key that the build agent needs to connect to a private repo in a later step - however when the agent attempts to clone the repo the connection is rejected with the error:
Host key verification failed.
This appears to be due to the server using a non-default port (2222):
git clone ssh://codeserver.dev.example@codeserver.dev.example.com:2222/~/repository.git pantheon
- task: InstallSSHKey@0
inputs:
knownHostsEntry: $(GitHost)
sshPublicKey: $(GitKeyPublic)
sshKeySecureFile: "AzureDevOps-GitKey.ssh"
displayName: "Use DevOps SSH Key"
The GitHost variable is in the form:
codeserver.dev.example.com ssh-rsa ....
Running a straight ssh-keyscan on the agent returns the expected server, but on port 22
# codeserver.dev.example.com:22 SSH-2.0-OpenSSH_7.5
# codeserver.dev.example.com:22 SSH-2.0-OpenSSH_7.5
# codeserver.dev.example.com:22 SSH-2.0-OpenSSH_7.5
# codeserver.dev.example.com:22 SSH-2.0-OpenSSH_7.5
# codeserver.dev.example.com:22 SSH-2.0-OpenSSH_7.5
codeserver.dev.example.com ssh-rsa ...
codeserver.dev.example.com ecdsa-sha2-nistp256 ...
codeserver.dev.example.com ssh-ed25519 ...
I've managed to get this to work by using the following steps (note the call to ssh-keyscan forcing a port and adding that to known-hosts):
steps:
- task: InstallSSHKey@0
inputs:
knownHostsEntry: $(GitHost)
sshPublicKey: $(GitKeyPublic)
sshKeySecureFile: "AzureDevOps-GitKey.ssh"
displayName: "Use DevOps SSH Key"
- task: Bash@3
inputs:
targetType: "inline"
script: |
ssh-keyscan -p 2222 -t rsa $(GitHostServer) >> ~/.ssh/known_hosts
if [ -d "$(Pipeline.Workspace)/pantheon" ]; then rm -Rf $(Pipeline.Workspace)/pantheon; fi
git clone $(pantheonGit) --depth 1 $(Pipeline.Workspace)/pantheon
workingDirectory: $(Pipeline.Workspace)
displayName: "Clone Pantheon Repo"
The GitHostServer variable is in the form:
codeserver.dev.example.com
I've tried adding a port to the GitHost variable (codeserver.dev.example.com:2222) but it didn't seem to make any difference.
Is there a better way to format the KnownHostsEntry in the InstallSSHKey step to get this work first time, without having to manually add it later?