I've looked [to faq][1] , but there is no answer for my task.
How can I access to bastion (jump box) host using password with Ansible? We do not consider using SSH keys. How will SSH config (or Ansible config) be look like for this situation?
For instance using SSH keys, the configuration looks like this:
ansible_ssh_common_args: '-o ProxyCommand="ssh -W %h:%p -q user#gateway.example.com"'
How to achieve the same result by using password?
You can use the ProxyJump ssh option which does not require netcat/nc to be installed on the jump host.
So in the ~/.ssh/config file of the user you are using to run the Ansible commands, add something like this
Host jumphost
HostName 1.1.1.1 # use actual ip address or fqdn
Host *
ProxyJump jumphost
In my ~/.ssh/config file, I have configured the bastion host like this:
##### Private hosts access through bastion host #####
Host bastion-host
HostName 52.13.2.54
ForwardAgent yes
Host 10.10.*
ProxyCommand ssh -q bastion-host nc -q0 %h %p
Then I can directly run the Ansible over the hosts in private subnet. Hope that might help you
Related
i have a question regarding port forwarding in combination with proxy jump in my ssh config:
Is it possible to make use of DynamicForward from the host used as proxy? Here's my config:
Host proxy
HostName proxy.private.com
User user
IdentityFile ~/path/to/file
DynamicForward 3000
Host target
HostName target.somewhere.com
User user
IdentityFile ~/path/to/file
ProxyJump proxy
It does not work with this config, but this would be exactly what i need.
Any tips on how to get it to work?
If there is nothing preventing you from using ProxyCommand you can most likely use this approach:
In your ~/.ssh/config file:
Host target
HostName target.somewhere.com
User target-user
IdentityFile ~/path/to/target-user-file
ProxyCommand ssh -A <proxy-user>#<proxy-host> -i <proxy-user-key> -W %h:%p
DynamicForward 3000
You can then run this command on your local machine:
ssh target -D 3000
I was able to test this by running this command locally and retreiving public IP of the target host:
curl -x socks5h://localhost:3000 https://ifconfig.me/
Usefull links I read:
More details on these use cases can be found here
Detail on this very approach can be found on this site (sadly not in english nor HTTPS)
You can probably define another Host on top to avoid having to mess with ssh parameter each time. This would be done by using CanonicalizeHostname, but I couldn't manage to it. An alias might be more interesting at that point ?
Using OpenSSH, I have set my /etc/ssh/ssh_config to have a ProxyCommand so all SSH connections go through that proxy.
/etc/ssh/ssh_config:
Host *
ProxyCommand nc -X connect -x localhost:8111 %h %p
But I would like to disable the proxy for one particular SSH host.
I have added the following to my ~/.ssh/config:
Host ssh.example.org
HostName ssh.example.org
ProxyCommand ""
What should I put with ProxyCommand so that it doesn't use a proxy for that particular host only, but the default is still to go through the proxy for SSH conncetions?
The solution is to use ProxyCommand none for hosts that should go outside the proxy!
Host ssh.example.org
HostName ssh.example.org
ProxyCommand none
I have a dd-wrt router where I setup a ssh port-forwarding rule to redirect each WAN request towards a host in the private LAN that at the moment is unavailable. Is it possible to avoid the firewall redirection with a ssh parameter and connect directly to the router via ssh ? Note: At the moment I haven't direct access to the router.
One effective solution is to setup a single SSH port forward to one host on the network, and then use SSH forwarding via that host to the others.
This can be added easily to the client ssh config:
host AnyNameYouLike
Hostname remoteHostnameOrIp
Proxycommand ssh -q proxyuser#proxyhostname.remotely.accessible nc -q0 %h %p
User remoteHostnameOrIpUser
IdentityFile ~/.ssh/remoteHostnameOrIp_id_rsa
You can omit the IdentityFile line if you prefer alternative authentication. If you set up an entry for proxyuser#proxyhostname.remotely.accessible too you can have completely passwordless and transparent proxying.
Further, you can use wildcards, and have ssh automatically ssh via the proxy for any matching host, eg:
host 10.10.10.*
proxycommand ssh -q proxyuser#proxyhostname.remotely.accessible nc -q0 %h %p
with two consecutive ssh authentications I mean the following:
I ssh to remote system A
from remote system A, I ssh to remote system B
There is no way to ssh to B directly.
I have no problems mounting directories from A using sshfs.
I thought about mounting directories from B on A but unfortunately A does not have sshfs installed. Even if, I would not know if it works.
Is there maybe another way to access directories on B in a convenient way?
My ~/.ssh/config looks like this now:
Host A
User user
HostName A.example.com
ControlMaster auto
ControlPath ~/.ssh/%r#%h:%p
Host B
User user
HostName B.example.com
ProxyCommand ssh -W %h:%p A
How would my sshfs command look like?
This does not work:
sshfs -o allow_other,defer_permissions -o user#B.example.com:/somedir ~/somedir
It outputs the error message:
remote host has disconnected
Use ProxyCommand or ProxyJump to do that transparently for the end application (sshfs). For example in ~/.ssh/config
Host A
# other configuration options needed
Host B
ProxyCommand ssh -W %h:%p A
Then you should be able to use sshfs transparently by directly specifying host B.
I have database server on AWS and from my PC i have to access that database using ssh tunneling for below scenario.
PC --> Jump1 [x.pem, port:22] --> Jump2 [y.pem, port:443] --> mysqldb:3306
For this kind of scenarios, Config File is the best way to do it.
Run
$ touch ~/.ssh/config
Add host entries in a config file.
Host <Host_Name>
HostName <URL/IP of Jump2>
User <>
Port <>
Identityfile <yyy.pem>
StrictHostKeyChecking no
ProxyCommand ssh -i <xxx.pem> <user>#<IP/DNS of Jump1> nc %h %p 2> /dev/null
and then to create a tunnel
$ ssh <local_port>:DB_URL:<DB PORT> <Host_name>
that's it.
Now you can connect to DB using
localhost:<local_port>
If you already have your public keys in authorized_keys on respective hosts
then you can use -J directive.
like this:
ssh -J user1#host1 user2#host2
If you have more than one jump host you can concatenate it inside of -J directive like this:
ssh -J user1#host1,user2#host2,user(n-1)#host(n-1) userN#hostN
I also using port forwarding so it takes your port data all the way to the last site and then connect to specific site like this:
ssh -L 8080:microsoft.com:80 -J user1#host1 user2#host2
It will create unencrypted connection only from host2 to microsoft.com:80