rundeck-plugins / openssh-bastion-node-execution

OpenSSH Bastion Host Node Execution Plugins

This plugin provides a node-executor and file-copier supporting ssh actions through a bastion host. Use this plugin if you must access remote servers via a jump host.

Dry run mode

You can configure the plugin to just print the invocation string to the console. This can be useful when defining the configuration properties.

Plugin Configuration Properties

• Bastion SSH Key Storage Path: Identity to use for the bastion host connection.
• SSH Options: Extra options to pass to the ssh command invocation. You can overwrite this attribute at node level, using ssh-bastion-ssh-config (node-executor) and scp-bastion-ssh-config (file-copier).
• ssh_config: Specify ProxyCommand and other flags. Consult the reference for ssh_config(5) to learn about posible settings.
• Dry run? If set true, just print the command invocation that would be used but do not execute the command. This is useful to preview.

Node Specific Key

If the node is configured with the ssh-key-storage-path attribute, the ssh connection will use that to connect to the remote node.

• ssh-key-storage-path: Set to location in Rundeck Keystore

Configuration

The plugin can be configured as a default node executor and file copier for a Project. Use the Simple Conguration tab to see the configuration properties. The page has a form with inputs to configure the connection to the bastion host.

You can also modify the project.properties or use the API/CLI to define the plugin configuration. The Plugin List page will describe the key names to set.

Customize the ssh_config

You can define multiple lines using a trailing backslash and an indent on the following line.

Here is an example that defines ssh_config file.

project.plugin.NodeExecutor.openssh-bastion-host.node-executor.ssh_config=Host * \
  StrictHostKeyChecking no
  Port 22
  ProxyCommand ssh user@bastionhost -W %h\:%p
  IdentityFile @plugin.config.identity_file@

Here ssh_options are set.

project.plugin.NodeExecutor.openssh-bastion-host.node-executor.ssh_options="-q -oCiphers=arcfour -oClearAllForwardings=yes"

Using Dry run, you might see output similar to this:

[dry-run] +------------------------------------------+
[dry-run] | ssh_config                               |
[dry-run] +------------------------------------------+
[dry-run] | Host *
[dry-run] |   StrictHostKeyChecking no
[dry-run] |   Port 22
[dry-run] |   ProxyCommand ssh user@bastion -W %h:%p
[dry-run] |   IdentityFile /tmp/bastion.ssh-keyfile.prWLUyFU
[dry-run] +------------------------------------------+
[dry-run] ssh -q -oCiphers=arcfour -oClearAllForwardings=yes -F /tmp/ssh_config.zTr9j5KK -i /tmp/host1234.ssh-keyfile.4cjnI2qL [email protected] whoami
Begin copy 18 bytes to node host1234: /etc/motd -> /tmp/motd
[dry-run] +------------------------------------------+
[dry-run] | ssh_config                               |
[dry-run] +------------------------------------------+
[dry-run] | Host *
[dry-run] |   StrictHostKeyChecking no
[dry-run] |   Port 22
[dry-run] |   ProxyCommand ssh user@bastion -W %h:%p
[dry-run] |   IdentityFile /tmp/bastion.ssh-keyfile.XXXXX.WAlpZLNb
[dry-run] | 
[dry-run] +------------------------------------------+
[dry-run] scp -q -oCiphers=arcfour -oClearAllForwardings=yes -F /tmp/ssh_config.XXXX.cosJ7xQ2 -i /tmp/host1234.ssh-keyfile.XXXXX.BOqYAKRu /etc/motd [email protected]:/tmp/motd
/tmp/motd
Copied: /tmp/motd

Docker Example

To star the docker example:

• Run ./start-docker-example.sh
• Got to http://localhost:8080
• User/Password => admin/admin

The example has two networks:

• Network1: rundeck, bastion
• Network2: bastion, linux-1 (running on port 2223), linux-2 (running on default port)

The goal of this example is that Rundeck connects to the nodes linux-1 and linux-2 through the bastion container (Rundeck cannot see linux-X nodes). Notices the node attribute for "linux-1" node, we set the port connection on the "SSH Options" at the node level.

openssh-bastion-node-execution's Issues

Add Bastion host with SSH Password

Hi,

I am new to RunDeck. I would like to add nodes behind a bastion host. The plugin is only accepting SSH key for authentication. I cannot see any field to add SSH passwords under project settings.

Would you give me any idea?

This module isn't working AT ALL

Hi,

Sorry to be upset, but this plugin isn't fonctionnal at all...

At least you're going to have a loop
You can't set easily bastion user and bastion host
What you need is

• bastion : user/host/key set node by node or globally
• node: THE same user/host/key set node by node or globally

Then the ssh_config is easy to set :

Host proxy
   User @proxy_user@
   Hostname @proxy_host@
   IdentityFile @proxy_key@

Host * !proxy
   ProxyJump proxy

Then the ssh line is straight :

$ ssh -F /tmp/proxy_config.AezfeDEZ5 WHATEVER@WHATEVER

Final point.

---

Here we have : /tmp/bastion.ssh-keyfile.XXXXX which contains the PATH OF THE IDENTITYFILE we put in the form ...

Frankly : just say bastion can't be and that's all

How to install this plugin?

Hi,

very basic question, how to install this plugin to rundeck?
I downloaded the zip & put the zip file in /var/lib/rundeck/libext and its not visible in UI.

I am definitely missing something. I am new to rundeck.

Rohit

honor project level user name

We are using rundeck 2.10.8 and trying to adopt openssh bastion node execution plugin,
However, I have to set username as node attribute. Otherwise, openssh node executor cannot get the username for the remote host, e.g

ssh -q -oClearAllForwardings=yes -F /tmp/ssh_config.WG9t @my-remote-host uptime

I have already set property project.ssh.user in project.properties. But it does not get honored.

In Rundeck document https://docs.rundeck.com/2.10.8/plugins-user-guide/ssh-plugins.html :

If the username node attribute is not set, then the static value provided via project or framework configuration is used. The username for a node is determined by looking for a value in this order:

Node level: username node attribute. Can contain property references to dynamically set it from Option or Execution values.
Project level: project.ssh.user property in project.properties file for the project.
Rundeck level: framework.ssh.user property in framework.properties file for the Rundeck installation.

Unable to load configuration key

Hi,

with Rundeck 4.14.0 the plugin fails with following message:

ERROR services.ExecutionUtilService [quartzScheduler_Worker-1] - Execution failed: 17 in project my_project: [Workflow result: , step failures: {2=Dispatch failed on 2 nodes: [my_node01: ConfigurationFailure: [openssh-bastion-host.file-copier]: Unable to load configuration key 'bastion_ssh_key_storage_path' value from storage path: /opt/rundeck/.cert/id_rsa, my_node02: ConfigurationFailure: [openssh-bastion-host.file-copier]: Unable to load configuration key 'bastion_ssh_key_storage_path' value from storage path: /opt/rundeck/.cert/id_rsa, Node failures: {my_node01=[ConfigurationFailure: [openssh-bastion-host.file-copier]: Unable to load configuration key 'bastion_ssh_key_storage_path' value from storage path: /opt/rundeck/.cert/id_rsa], flow control: Continue, status: failed]

With this we cannot connect to nodes via bastion host and breaks our whole Rundeck instance.

Until Rundeck 4.13.0 it was working without any issues.

Please update the plugin to run with Rundeck 4.14.0 and later.

Thanks
Mirko

Host key verification failed

hi there, great plugin, unfortunately I always get the following issue: Host key verification failed..
Setup is like that:

Connecting to the bastion host using rundeck's base ssh works fine, any ideas?
I'm running rundeck as Docker container by the way, thanks

license

Can you add a license readme to this plugin? My business needs a license.txt file to reference for approval

Execution on Remote node behind bastion host with keys + passphrase

Hi,

I am new to rundeck.

I have remote nodes behind bastion host. The ssh keys are used for both a bastion and remote node to connect & these keys have passphrase too.

I have installed this plugin but not able to succeed in executing a command on the remote node so far.

What am I missing? Can you please give brief steps and proof points to check?

Thanks in advance.