From fd1c9287cd0297927a4c7e0cc264e1bf51c619e1 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Tue, 21 Apr 2026 16:53:56 -0700 Subject: [PATCH] scripts/refresh-*: StrictHostKeyChecking=accept-new on first connect MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BatchMode=yes (which the scripts set) implies strict host key checking and refuses to prompt — so first-time SSH to a host that isn't in known_hosts fails with "Host key verification failed". Every new host we register needs a manual `ssh ` round-trip first to store the key before the refresh scripts can reach it. accept-new fixes that: unknown hosts are auto-accepted into known_hosts on first connect; subsequent key CHANGES still fail loudly (as they should — that'd be a MITM signal). Matches the pattern already used by deploy-stack.sh. Affects only refresh-server-info.sh and refresh-proxmox-info.sh; deploy-stack.sh + sync-stacks.sh use their own targets that may or may not want the same treatment (leaving alone for now). --- scripts/refresh-proxmox-info.sh | 2 +- scripts/refresh-server-info.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/refresh-proxmox-info.sh b/scripts/refresh-proxmox-info.sh index 184bb81..def425b 100755 --- a/scripts/refresh-proxmox-info.sh +++ b/scripts/refresh-proxmox-info.sh @@ -233,7 +233,7 @@ for host in "${HOSTS[@]}"; do mkdir -p "$SERVERS_DIR/$host" - if ssh -o BatchMode=yes -o ConnectTimeout=10 "$target" 'bash -s' < "$INSPECT" > "$tmp" 2> "$tmp.err"; then + if ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$target" 'bash -s' < "$INSPECT" > "$tmp" 2> "$tmp.err"; then mv "$tmp" "$out" rm -f "$tmp.err" bytes=$(wc -c < "$out") diff --git a/scripts/refresh-server-info.sh b/scripts/refresh-server-info.sh index f110199..3b1f0f2 100755 --- a/scripts/refresh-server-info.sh +++ b/scripts/refresh-server-info.sh @@ -240,7 +240,7 @@ for host in "${HOSTS[@]}"; do mkdir -p "$SERVERS_DIR/$host" - if ssh -o BatchMode=yes -o ConnectTimeout=10 "$target" 'bash -s' < "$INSPECT" > "$tmp" 2> "$tmp.err"; then + if ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$target" 'bash -s' < "$INSPECT" > "$tmp" 2> "$tmp.err"; then mv "$tmp" "$out" rm -f "$tmp.err" bytes=$(wc -c < "$out")