Install an SSH key for a server on a custom port in Azure DevOps pipelines

Viewed 372

I'm using the installSshKey task to install an SSH key that the build agent needs to connect to a private repo in a later step - however when the agent attempts to clone the repo the connection is rejected with the error:

Host key verification failed.

This appears to be due to the server using a non-default port (2222):

git clone ssh://codeserver.dev.example@codeserver.dev.example.com:2222/~/repository.git pantheon

- task: InstallSSHKey@0
  inputs:
    knownHostsEntry: $(GitHost)
    sshPublicKey: $(GitKeyPublic)
    sshKeySecureFile: "AzureDevOps-GitKey.ssh"
  displayName: "Use DevOps SSH Key"

The GitHost variable is in the form:

codeserver.dev.example.com ssh-rsa ....

Running a straight ssh-keyscan on the agent returns the expected server, but on port 22

# codeserver.dev.example.com:22 SSH-2.0-OpenSSH_7.5
# codeserver.dev.example.com:22 SSH-2.0-OpenSSH_7.5
# codeserver.dev.example.com:22 SSH-2.0-OpenSSH_7.5
# codeserver.dev.example.com:22 SSH-2.0-OpenSSH_7.5
# codeserver.dev.example.com:22 SSH-2.0-OpenSSH_7.5
codeserver.dev.example.com ssh-rsa ...
codeserver.dev.example.com ecdsa-sha2-nistp256 ...
codeserver.dev.example.com ssh-ed25519 ...

I've managed to get this to work by using the following steps (note the call to ssh-keyscan forcing a port and adding that to known-hosts):

steps:
- task: InstallSSHKey@0
  inputs:
    knownHostsEntry: $(GitHost)
    sshPublicKey: $(GitKeyPublic)
    sshKeySecureFile: "AzureDevOps-GitKey.ssh"
  displayName: "Use DevOps SSH Key"
- task: Bash@3
  inputs:
    targetType: "inline"
    script: |
      ssh-keyscan -p 2222 -t rsa $(GitHostServer) >> ~/.ssh/known_hosts
      if [ -d "$(Pipeline.Workspace)/pantheon" ]; then rm -Rf $(Pipeline.Workspace)/pantheon; fi
      git clone $(pantheonGit) --depth 1 $(Pipeline.Workspace)/pantheon
    workingDirectory: $(Pipeline.Workspace)
  displayName: "Clone Pantheon Repo"

The GitHostServer variable is in the form:

codeserver.dev.example.com

I've tried adding a port to the GitHost variable (codeserver.dev.example.com:2222) but it didn't seem to make any difference.

Is there a better way to format the KnownHostsEntry in the InstallSSHKey step to get this work first time, without having to manually add it later?

0 Answers
Related