ssh tunnels / gateway about sash

[uriagassi]

Hi Patrick!

Thank you for your kind words!

Regarding your use-case - if your instances do not have a public IP, sash will fallback to their private IP, which is exactly what you want if you ssh from the gateway instance.

If they do have a public IP, you might want to add an environment variable which will instruct sash to ignore the public IP, and use the private IP instead (see the ips variable and the private_ips variable).

If your use-case is not to ssh to the gateway instance, and then ssh to the intended instance, but rather using a tunnel, you would need to help sash know which instance is configured to which port (so it can add -p XXXX to the ssh command). To do that you can use tags to hold this metadata, quite like how I'm using tags to allow for custom user names (see set_users command, and users variable - I'm using a tag named SashUserName for this purpose).

I would be happy for any enhancement to this library, just remember to add the proper user guidance in the Readme file!

Thanks,
Uri

[PLaRoche]

Hmm, lets see if I get this:

if your instances do not have a public IP, sash will fallback to their private IP, which is exactly what you want if you ssh from the gateway instance.

• how does it ssh into them in this case, using the internal IP address?

but rather using a tunnel, you would need to help sash know which instance is configured to which port (so it can add -p XXXX to the ssh command).

• exactly what I would like to do (tunnel), but I'd prefer not to have to set up all the tunnels ahead of time, which would require knowing each IP, negating the need for sash). Is there anyway where I can do something like:

sash ec2_I_want_to_connect_to --tunnel-through ec2_that_is_the_gateway

where sash would do something similar to:

ssh -L 22:ec2_I_want_to_connect_to:22 ubuntu@ec2_that_is_the_gateway

(forgive me if that is not a correct ssh tunnel command, its been a while)

[uriagassi]

1. yes, if there is no public IP address, sash will use the internal IP address.

2. ssh has a -t flag you can use to ssh more than one hop (see here):

   ssh -A -t ec2_gateway_public_ip ssh target_ec2_internal_ip
   

   you can play with that and see how this works for you.

Since I believe in most use cases you will want to use the same gateway for all your connections, setting an environment variable specifying that you want to connect through a specific machine would eliminate the need for a cumbersome flag each time you need to connect.