Adding ssh_gateway support for tunneling in VPCs

Details

  • Type: New Feature New Feature
  • Status: Closed Closed
  • Priority: Unknown Unknown
  • Resolution: Fixed
  • Affects Version/s: None
  • Fix Version/s: ec2-0.6.0
  • Component/s: knife-ec2
  • Labels:
    None

Description

Added ssh tunneling for Knife EC2.

With this support, now you can tunnel server create, bootstrap and ssh commands directly to private nodes behind your public gateway.

To use it, just ssh-add your identities (.pem) files, and add to your knife.rb:
knife[:ssh_gateway] = 'user@public_host_of_your_vpc_that_can_connect_to_private_ones'

https://github.com/opscode/knife-ec2/pull/53

Issue Links

relates to

New Feature - A new feature of the product, which has yet to be developed. KNIFE-152 Add SSH gateway and custom connection attribute support for knife ec2 server create

  • Major - Major loss of function.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are closed can be reopened.

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Steven Danna added a comment -

Resolving to get picked up in Triage meeting.

Show
Steven Danna added a comment - Resolving to get picked up in Triage meeting.
Hide
Permalink
Bryan McLellan [Opscode] added a comment -

Patrick, your commit seems to have some cruft. Why is Gemfile.lock modified? You also took out some significant chunks of code in tcp_test_ssh(hostname) without explanation, like the rescue blocks.

This functionality seems it would be more appropriate in core knife in knife bootstrap rather than the knife-ec2 plugin. Could you refactor this to there?

Show
Bryan McLellan [Opscode] added a comment - Patrick, your commit seems to have some cruft. Why is Gemfile.lock modified? You also took out some significant chunks of code in tcp_test_ssh(hostname) without explanation, like the rescue blocks. This functionality seems it would be more appropriate in core knife in knife bootstrap rather than the knife-ec2 plugin. Could you refactor this to there?
Hide
Permalink
Patrick Negri added a comment -

The changes to tcp_test_ssh are necessary because i need to test if the SSH server is UP, and the server is behind a firewall, so i need to check if it is on behind a gateway. So, i created a ssh tunnel there. tcp_test_ssh was completly rewrited to use NET:SSH (That has support to tunneling) instead of raw sockets (That only support direct connection).

Unfortunally i dont dispose much time to port this code to knife, and also, i think its ok to have that code here. The change to Gemfile was because of Net::SSH or some other dependencies. Nothing too intrusive.

What i just done was drop the raw sockets, because of lack of support for tunneling. Added the variables, for the bootstrap stuff, and added the support to check if a server sshd is up, by using Net::SSH Tunneling to check if SSL port is on.

What do you think?

Show
Patrick Negri added a comment - The changes to tcp_test_ssh are necessary because i need to test if the SSH server is UP, and the server is behind a firewall, so i need to check if it is on behind a gateway. So, i created a ssh tunnel there. tcp_test_ssh was completly rewrited to use NET:SSH (That has support to tunneling) instead of raw sockets (That only support direct connection). Unfortunally i dont dispose much time to port this code to knife, and also, i think its ok to have that code here. The change to Gemfile was because of Net::SSH or some other dependencies. Nothing too intrusive. What i just done was drop the raw sockets, because of lack of support for tunneling. Added the variables, for the bootstrap stuff, and added the support to check if a server sshd is up, by using Net::SSH Tunneling to check if SSL port is on. What do you think?
Hide
Permalink
Alex Corley added a comment -

I'm a little confused here...

I agree with the gemfile and rescue block issues, but everything else seems legit?

The gateway functionality does exist upstream in knife/bootstrap, but the ec2 plugin will not intake the options in order to pass them to bootstrap.

If I clean up the code to be just the options passing and the additional (and I think prudent) ssh connection testing in lieu of port connecting will that suffice? Of course the test logic can be conditional to the passed in params so the original usecase for non-gateway remain socket based and will not be regressed in any way.

Show
Alex Corley added a comment - I'm a little confused here... I agree with the gemfile and rescue block issues, but everything else seems legit? The gateway functionality does exist upstream in knife/bootstrap, but the ec2 plugin will not intake the options in order to pass them to bootstrap. If I clean up the code to be just the options passing and the additional (and I think prudent) ssh connection testing in lieu of port connecting will that suffice? Of course the test logic can be conditional to the passed in params so the original usecase for non-gateway remain socket based and will not be regressed in any way.
Hide
Permalink
Steven Danna added a comment -

Hi Patrick and Alex,

My apologies, we had looked at your questions via triage but the ticket was never updated. It looks like there is another pull request here that adds this same feature:

http://tickets.opscode.com/browse/KNIFE_EC2-83

I believe that patch addresses most of the concerns and adds tests. You might be interested in taking a look and making sure it meets your needs as well.

Sincerely,

Steven

Show
Steven Danna added a comment - Hi Patrick and Alex, My apologies, we had looked at your questions via triage but the ticket was never updated. It looks like there is another pull request here that adds this same feature: http://tickets.opscode.com/browse/KNIFE_EC2-83 I believe that patch addresses most of the concerns and adds tests. You might be interested in taking a look and making sure it meets your needs as well. Sincerely, Steven
Hide
Permalink
Steven Danna added a comment -

KNIFE_EC2-83 resolves this and was just merged. Thanks to everyone who has submitted pull requests, comments, and improvements!

Show
Steven Danna added a comment - KNIFE_EC2-83 resolves this and was just merged. Thanks to everyone who has submitted pull requests, comments, and improvements!

People

  • Assignee:
    Unassigned
    Reporter:
    Patrick Negri
Vote (1)
Watch (1)

Dates

  • Created:
    Updated:
    Resolved: