How to configure SSH #398

FelixSab · 2023-07-05T15:17:32Z

FelixSab
Jul 5, 2023

I am currently setting up a deployment using gitlab-ci and encountered some issues with my SSH configuration. Is there any way to have it configured besides the user name? I tried using a config, but to no avail:

The Dockerfile I am using:

FROM ghcr.io/mrsked/mrsk:latest

RUN apk add --no-cache bash curl

RUN echo '#!/bin/bash' > /usr/local/bin/mount-env && \
    echo 'curl --silent "https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer" | bash' >> /usr/local/bin/mount-env && \
    chmod +x /usr/local/bin/mount-env

RUN echo '#!/bin/bash' > /usr/local/bin/register-ssh-key && \
    echo 'export SSH_KEY="$(realpath $SECURE_FILES_DOWNLOAD_PATH)/ssh_key"' >> /usr/local/bin/register-ssh-key && \
    echo 'chmod 600 ${SSH_KEY}' >> /usr/local/bin/register-ssh-key && \
    chmod +x /usr/local/bin/register-ssh-key

RUN mkdir /root/.ssh/ && \
    echo 'Host *' >> /root/.ssh/config && \
    echo '  IdentityFile ${SSH_KEY}' >> /root/.ssh/config && \
    echo '  StrictHostKeyChecking no' >> /root/.ssh/config && \
    echo '  UserKnownHostsFile /dev/null' >> /root/.ssh/config


ENTRYPOINT ["/bin/bash", "-l", "-c"]

My gitlab-ci.yml:

image: <<Dockerfile from above>>

stages:          # List of stages for jobs, and their order of execution
  - deploy

deploy-job:      # This job runs in the deploy stage.
  stage: deploy  # It only runs when *both* jobs in the test stage complete successfully.
  environment: production
  variables:
    SECURE_FILES_DOWNLOAD_PATH: '.'
  script:
    - mount-env
    - source register-ssh-key
    - cat ~/.ssh/config
    - ssh $SERVER_IP "ls -lah"
    - mrsk setup

My output:

$ cat ~/.ssh/config
Host *
  IdentityFile ${SSH_KEY}
  StrictHostKeyChecking no
  UserKnownHostsFile /dev/null
$ ssh <<Server-IP>> "ls -lah"
Warning: Permanently added '' (ED25519) to the list of known hosts.
total 36K
drwx------  5 root root 4.0K Jul  5 12:22 .
drwxr-xr-x 18 root root 4.0K Jul  5 12:15 ..
-rw-r--r--  1 root root   15 Jul  5 12:20 .bash_history
-rw-r--r--  1 root root 3.1K Oct 15  2021 .bashrc
drwx------  2 root root 4.0K Jul  5 12:22 .docker
-rw-r--r--  1 root root  161 Jul  9  2019 .profile
drwx------  2 root root 4.0K Jul  5 12:15 .ssh
$ mrsk setup
Acquiring the deploy lock...
  Finished all in 0.2 seconds
  ERROR (Net::SSH::AuthenticationFailed): Exception while executing on host <<Server-IP>>: Authentication failed for user root@<<Server-IP>>

As you can see, the config is working properly when using ssh by itself, but not when using mrsk. Is there a way to provide ssh options or a config?

Help would be greatly appreciated

nickhammond · 2023-07-08T16:27:26Z

nickhammond
Jul 8, 2023

@FelixSab You can specify a proxy with mrsk(https://github.com/mrsked/mrsk#using-a-proxy-ssh-host) but this seems like a question for gitlab CI though. I know with github actions you have to add in a few things to get SSH connections to work properly, I'd imagine it's the same with gitlab CI. Have you tried the docker executor steps on this gitlab CI guide? https://docs.gitlab.com/ee/ci/ssh_keys/

0 replies

FelixSab · 2023-07-10T07:16:50Z

FelixSab
Jul 10, 2023
Author

@nickhammond Yes, using ssh agent like described by the gitlab docs would be one way to solve this issue. I didn't try the proxy, but it seems counterintuitive to me to use this option only for the configuration of my ssh connection. I updated my register-ssh-key script so that the identity file gets copied into the default location, which solves the issue as well:

#!/bin/bash

SSH_PATH=$(realpath ~)/.ssh

OLD_SSH_KEY_PATH=$(realpath $SECURE_FILES_DOWNLOAD_PATH)/ssh_key
NEW_SSH_KEY_PATH=$SSH_PATH/id_ed25519

# Check if the old SSH key file exists
if [ ! -f "$OLD_SSH_KEY_PATH" ]; then
    echo "The file $OLD_SSH_KEY_PATH does not exist. Exiting script."
    exit 0
fi

mkdir $SSH_PATH

echo $PROD_SERVER_A_PUBKEY > $SSH_PATH/known_hosts
echo $STAGING_SERVER_A_PUBKEY > $SSH_PATH/known_hosts

mv $OLD_SSH_KEY_PATH $NEW_SSH_KEY_PATH
chmod 600 $NEW_SSH_KEY_PATH

If I'd change the ssh port of my servers, I'd have to use the proxy though, no?

0 replies

nickhammond · 2023-07-10T14:45:49Z

nickhammond
Jul 10, 2023

@FelixSab Yah, it looks like it.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

How to configure SSH #398

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 3 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

How to configure SSH #398

Uh oh!

Uh oh!

FelixSab Jul 5, 2023

Replies: 3 comments

Uh oh!

nickhammond Jul 8, 2023

Uh oh!

Uh oh!

FelixSab Jul 10, 2023 Author

Uh oh!

nickhammond Jul 10, 2023

FelixSab
Jul 5, 2023

nickhammond
Jul 8, 2023

FelixSab
Jul 10, 2023
Author

nickhammond
Jul 10, 2023