Static Code (HTML) Workflow: Host key verification failed

[stratustiercloudsec]

Select Topic Area

Question

Body

I am using Secrets for the first time. My goal is to push code from my AWS EC2 instance which is my development serer, to my Github repo then automatically push the code to my production server, which is a Digital Ocean droplet (lLinux Ubuntu). I added my public key to the production/Digital Ocean server and the private key is on the AWS EC2 instance. I also added the contents of the public key as a Repository secret. With this set up, the workflow is NOT functioning properly, The error is "Host key verification failed" , and it happens here in my static.yml file:

name: Sync files to DigitalOcean server
run: |
rsync -avz --delete --exclude='.git' ./ root@00.000.000.0:/var/www/html/example.com

Where am I going wrong? Am I missing a key in this design?

[gabrielfrimodig]

The error code suggest that SSH is unable to verify the authenticity of the remote DigitalOcean server, which usually means that the host key for your server is not recognized by your AWS EC2 instance. To resolve this issue you could add the server's host key to known_hosts.

You can solve this by:

1. Add the host key by running this command on your AWS EC2 instance:
   ssh-keyscan -H 00.000.000.0 >> ~/.ssh/known_hosts
   Where 00.000.000.0 should be replaced with the DigitalOcean server's IP address. This adds the servers SSH key to known hosts.
2. Update your workflow file (static.yml):

name: Sync files to DigitalOcean server

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      - name: Add server to known_hosts
        run: ssh-keyscan -H 00.000.000.0 >> ~/.ssh/known_hosts

      - name: Sync files to DigitalOcean server
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        run: |
          echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          rsync -avz --delete --exclude='.git' ./ root@00.000.000.0:/var/www/html/example.com

3. Lastly, make sure you have added your private key as a GitHub Secret called SSH_PRIVATE_KEY.

Let me know if that solved it.

[stratustiercloudsec]

Thanks @gabrielfrimodig, I think you have me on the right track. After following your instructions, I recieved the following error:

/home/runner/work/_temp/8a016819-f960-4802-9279-1a689f812ddf.sh: line 1: /home/runner/.ssh/known_hosts: No such file or directory
Error: Process completed with exit code 1.

Where did runner come from in the known_hosts path? This is why an error appeared, correct?

[gabrielfrimodig]

Yes, you are correct. The error is because known_hosts file path refers to a directory that doesn't exist on the GitHub Action runner as it have their own environment setup and the path /home/runner/.ssh/known_hosts is not automatically created. Make sure that the .ssh directory exists before adding the server's host key to known_hosts.

You could try to add this before adding server to known_hosts:

# Create the .ssh directory if it doesn't exist
- name: Create .ssh directory
  run: mkdir -p ~/.ssh

[stratustiercloudsec]

@gabrielfrimodig thanks for following-up. I'm confused now, because there was always an ssh directory (see attached). I guess I'm still not understanding the "runner" concept. The known_hosts file exists and was updated, but still get the error. I feel like I'm close though.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬