Operations grimoire/Recommended SSH configuration

From Nasqueron Agora

📕📁📜 Old technical information :: content warning

⌛ This Nasqueron Operations Grimoire page hasn't been updated for a long time.

☣ As our infrastructure evolves quickly, there is a good chance this information is outdated or now inaccurate. Be careful and consider update it.

➡️ To assert the information is still up-to-date or not, you can check the history of the relevant role in our Operations repository.

Consolidated OpenSSH configuration

The introduction of ProxyJump has simplified the bastion configuration since OpenSSH version 7.5: 

Host *.nasqueron.drake
    ProxyJump windriver.nasqueron.org

Host 172.27.27.* 
    ProxyJump windriver.nasqueron.org

Older version of OpenSSH can use instead: ProxyCommand "ssh -W %h:%p windriver.nasqueron.org"

Use bastion as proxy

To connect on a server where the port 22 isn't publicly accessible, use a development server as a bastion.

Do you do extensive work on the development server?

  • YES -> a good workflow is to create a tmux panel for your remote server connection
  • NO -> use the development server as proxy

All the following works: 

# Connect first to the bastion. Then, to the destination server (useful as tmux pane)
$ ssh windriver.nasqueron.org
$ ssh docker-002

# Connect with ProxyJump option (OpenSSH 7.5+)
$ ssh -J windriver.nasqueron.org 172.27.27.5

# Connect with ProxyCommand option for older OpenSSH clients
$ ssh -o ProxyCommand="ssh -W %h:%p windriver.nasqueron.org" docker-002.nasqueron.drake

Note you can generally use short names, fully qualified names or IP. If a short name doesn't work, but the IP works, the /etc/hosts of the bastion needs to be updated.

Retrieved from "https://agora.nasqueron.org/index.php?title=Operations_grimoire/Recommended_SSH_configuration&oldid=2034"