From fff6875d33dab77bd9ee2cd5d4b5f5288ff3306c Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Tue, 25 Aug 2026 10:59:29 -0400 Subject: [PATCH] Limit host based key types used by ansible By default, ansible prefers to try host based authentication, which is good. But when it doesn't work, it tries every key attempt, which is normally fine. However, SSH counts key attempts the same as passwords, so hardening that restirct password attempts are fouled before it can even get to try a public key. Thus let host based only consume one attempt. --- confluent_server/confluent/runansible.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/confluent_server/confluent/runansible.py b/confluent_server/confluent/runansible.py index dc9ce32d..1cc3cb4e 100644 --- a/confluent_server/confluent/runansible.py +++ b/confluent_server/confluent/runansible.py @@ -130,6 +130,11 @@ class PlayRunner(object): feedback.setblocking(False) localenv = os.environ.copy() localenv['FEEDBACK_SOCK'] = sockpath + # limit host based algorithms to avoid excessive authentication attempts + ansiblesshargs = os.environ.get('ANSIBLE_SSH_ARGS', '') + if 'hostbasedkeytypes' not in ansiblesshargs.lower() and 'hostbasedacceptedalgorithms' not in ansiblesshargs.lower(): + ansiblesshargs += ' -o HostbasedAcceptedAlgorithms=*ed25519*' + localenv['ANSIBLE_SSH_ARGS'] = ansiblesshargs with feedback: for playfilename in self.playfiles: worker = await asyncio.create_subprocess_exec(