markolson / chef-ssh Goto Github PK
View Code? Open in Web Editor NEWChef cookbook for managing some mildly-difficult-to-automate SSH configuration
Chef cookbook for managing some mildly-difficult-to-automate SSH configuration
Although this should be better documented in the fundamental Chef documentation, the README.md here could mention the best tactics for accomplishing suitable synchronization of LWRPs in a recipe that needs to create new users and then create ssh configuration files for those new users.
Coming to Chef as a tyro, lacking a solid understanding of how Chef first accepts a specification for a change to system via a resource and then enqueues that specification for later execution, and with only a rudimentary understanding of how Chef's modularity is implemented, it can be a long trial and error process of getting a recipe for user creation, group assignment, sudo configuration, and ssh configuration to work in the presence of varying initial conditions. (The varying conditions include: total absence of anything in /etc/passwd, /etc/group, and /home for a particular user; presence of a partially constructed environment; presence of a malformed environment; and presence of a completely well-formed user environment.)
Currently, I have a manage-users recipe that seems to work for those use cases but I'm still just not sure how to program the LWRP statements so that I could definitely claim that their set could only execute with the particular execution order I intended.
The classic symptoms of out of order execution and of premature execution are exceptions thrown by Chef when the individual LWRPs find that entries in /etc/passwd are missing, that /home directories aren't in the filesystem to be the parent for subdirectories, and that various node attributes are nil. All these issues in temporal transitions resolve on subsequent chef runs. It would be far better to use notifications or ohai reloading or explicit coupling in the LWRPs to assure a particular order of execution and to flush queued changes to the actual target system.
Any advice on this?
Running ssh cookbook on RHEL OS occurs error because there is no ssh package in yum.
* yum_package[ssh] action install
* No version specified, and no candidate version available for ssh
================================================================================
Error executing action `install` on resource 'yum_package[ssh]'
================================================================================
Chef::Exceptions::Package
-------------------------
No version specified, and no candidate version available for ssh
Resource Declaration:
---------------------
# In /home/ec2-user/chef-solo/cookbooks-2/ssh/recipes/default.rb
5: package 'ssh' do
6: action :install
7: end
Compiled Resource:
------------------
# Declared in /home/ec2-user/chef-solo/cookbooks-2/ssh/recipes/default.rb:5:in `from_file'
yum_package("ssh") do
action [:install]
retries 0
retry_delay 2
default_guard_interpreter :default
package_name "ssh"
timeout 900
flush_cache {:before=>false, :after=>false}
declared_type :package
cookbook_name :ssh
recipe_name "default"
end
I think there is no need to install ssh package because running chef itself guarantees ssh is installed on the system already.
https://github.com/markolson/chef-ssh/blob/master/providers/config.rb#L45-L52
New file, results in:
-rw-r--rw- 1 jenkins jenkins 167 Jul 17 20:03 config
Which is 646 - which is pretty odd.
Because new Host
stanzas are placed by this cookbook at the end of the file, those cannot be used to override any defaults that are present in a Host *
block at the beginning of /etc/ssh/ssh_config
.
man ssh_config
says "Since the first obtained value for each parameter is used, more host-specific declarations should be given near the beginning of the file, and general defaults at the end."
For example, if StrictHostKeyChecking ask
is set in Host *
, then it is impossible to turn it off with
ssh_config 'github.com' do
options StrictHostKeyChecking: 'no'
end
I think that the ssh_config
resource should add its blocks before entries that are already in the ssh_config
file to make this override behavior possible.
Currently, to override defaults given in a Host *
block, a workaround is required: first do
ssh_config '*' do
action :remove
end
Hello, I'm using version 0.10.16, but I got duplicate entries in known_hosts file.
I call functions like this:
ssh_known_hosts "github.com" do
hashed false
path '/var/lib/jenkins/.ssh/known_hosts'
end
I ran the cookbook 3 times using kitchen converge, and I found 3 set of records in /var/lib/jenkins/.ssh/known_hosts file.
I found on stackoverflow saying this issue has been fixed long time ago, I'm not sure why I'm still seeing it. Could you help me?
Thanks
Hi,
I ahve been using this nice cookbook for a long time, now i started testing my cookbooks with chef 13 and found the following problem:
NameError
---------
uninitialized constant Chef::Resource::SshKnownHosts
Cookbook Trace:
---------------
/tmp/kitchen/cache/cookbooks/ssh/providers/authorized_keys.rb:83:in `load_current_resource'
/tmp/kitchen/cache/cookbooks/ssh/providers/authorized_keys.rb:76:in `initialize'
Regards.
NameError
Cannot find a resource for ssh_known_hosts on ubuntu version 12.10
/tmp/vagrant-chef/chef-solo-1/cookbooks/financeRails/recipes/default.rb:65:in `from_file'
/tmp/vagrant-chef/chef-solo-1/cookbooks/financeRails/recipes/default.rb:
I am getting the above error. And the stack trace points to my recipe containing:
ssh_known_hosts "github.com" do
hashed true
user app[:deploy_user]
end
So I am not sure where to look to debug this issue.
If you accidentally include the keytype or comment in an ssh_authorized_key
it will be allowed, but the comparison will fail and the key will be added time after time to the authorized_keys file.
hey,
i'm working with version 0.10.2 and for the lwrp ssh_config it seems to use the name attribute for the Host instead of using the host attribute.
example:
ssh_config 'github config for user root' do
host 'github.com'
options(
'HostName' => 'github.com',
'User' => 'git',
'IdentityFile' => '/root/.ssh/id_rsa_github'
)
end
creates the following:
$ cat /root/.ssh/config
# Created by Chef for tm-infrastructure-chef
Host github config for user root
HostName github.com
User git
IdentityFile /root/.ssh/id_rsa_github
Some system-level services don't use /home
- like Jenkins.
default_or_user_path should be updated to inspect the ohai returned data for a given user, and use the dir attribute if available.
Amazon linux new AMI 2017.09 breaks when using hashed entries with alternate ports, or rather ignores them. As far as I've found the []:port# isn't needed and the known_host file works fine on the few linux distros I've checked without them. The fix that worked for me was to simply strip out the added syntax returned from the call to ssh-keyscan for non-standard ports. This also makes matching easier basically just an added conditional with regex and all was fine:
if new_resource.port == 22
new_resource.key keyscan.stdout.strip
else
new_resource.key keyscan.stdout.strip.sub(/[(.)].+(ssh.)/, '\1 \2')
end
Like https://github.com/markolson/chef-ssh/blob/master/providers/known_hosts.rb#L21
When chef runs, log resources are always counted as 'updated', whereas a Chef::Log.debug
will not count to the added resource collection.
This is a minor and very specific thing, but part of a pattern of whether or not a log resource 'updating' is actually useful on the resource collection.
Recipe: apps::storm�[0m
* ssh_known_hosts[files.htw.com.au] action add�[0m[2013-10-15T12:40:12+10:00] INFO: Processing ssh_known_hosts[files.htw.com.au] action add (apps::storm line 149)
# files.htw.com.au SSH-2.0-OpenSSH_5.3
�[0m
================================================================================�[0m
�[31mError executing action `add` on resource 'ssh_known_hosts[files.htw.com.au]'�[0m
================================================================================�[0m
�[0m
NameError�[0m
---------�[0m
Cannot find a resource for only_if on centos version 6.4�[0m
�[0m
Cookbook Trace:�[0m
---------------�[0m
/tmp/chef/cookbooks/ssh/providers/known_hosts.rb:22:in `block (2 levels) in class_from_file'
/tmp/chef/cookbooks/ssh/providers/known_hosts.rb:21:in `block in class_from_file'�[0m
�[0m
Resource Declaration:�[0m
---------------------�[0m
# In /tmp/chef/site-cookbooks/apps/recipes/storm.rb
149: ssh_known_hosts node['backup']['host'] do
150: hashed false
151: end
152:
�[0m
�[0m
Compiled Resource:�[0m
------------------�[0m
# Declared in /tmp/chef/site-cookbooks/apps/recipes/storm.rb:149:in `from_file'
ssh_known_hosts("files.htw.com.au") do
action :add
retries 0
retry_delay 2
cookbook_name :apps
recipe_name "storm"
host "files.htw.com.au"
end
�[0m
�[0m
[2013-10-15T12:40:12+10:00] DEBUG: Re-raising exception: NameError - ssh_known_hosts[files.htw.com.au] (apps::storm line 149) had an error: NameError: Cannot find a resource for only_if on centos version 6.4
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/resource_platform_map.rb:126:in `get'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/resource.rb:761:in `resource_for_platform'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/resource.rb:778:in `resource_for_node'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/dsl/recipe.rb:55:in `method_missing'
/tmp/chef/cookbooks/ssh/providers/known_hosts.rb:22:in `block (2 levels) in class_from_file'
/opt/chef/embedded/lib/ruby/1.9.1/logger.rb:371:in `add'
/opt/chef/embedded/lib/ruby/1.9.1/logger.rb:399:in `debug'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/mixlib-log-1.6.0/lib/mixlib/log.rb:113:in `block in debug'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/mixlib-log-1.6.0/lib/mixlib/log.rb:113:in `each'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/mixlib-log-1.6.0/lib/mixlib/log.rb:113:in `debug'
/tmp/chef/cookbooks/ssh/providers/known_hosts.rb:21:in `block in class_from_file'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/provider/lwrp_base.rb:138:in `instance_eval'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/provider/lwrp_base.rb:138:in `block in action'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/provider.rb:118:in `run_action'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/resource.rb:606:in `run_action'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/runner.rb:50:in `run_action'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/runner.rb:82:in `block (2 levels) in converge'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/runner.rb:82:in `each'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/runner.rb:82:in `block in converge'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/resource_collection.rb:94:in `block in execute_each_resource'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/resource_collection/stepable_iterator.rb:116:in `call'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/resource_collection/stepable_iterator.rb:116:in `call_iterator_block'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/resource_collection/stepable_iterator.rb:85:in `step'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/resource_collection/stepable_iterator.rb:104:in `iterate'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/resource_collection/stepable_iterator.rb:55:in `each_with_index'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/resource_collection.rb:92:in `execute_each_resource'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/runner.rb:81:in `converge'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/client.rb:404:in `converge'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/client.rb:469:in `do_run'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/client.rb:200:in `run'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/application.rb:190:in `run_chef_client'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/application/solo.rb:239:in `block in run_application'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/application/solo.rb:231:in `loop'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/application/solo.rb:231:in `run_application'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/lib/chef/application.rb:73:in `run'
/opt/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.4.4/bin/chef-solo:25:in `<top (required)>'
/usr/bin/chef-solo:23:in `load'
/usr/bin/chef-solo:23:in `<main>'
ssh
git: https://github.com/markolson/chef-ssh.git
revision: ca59ec5bf27ea9ed05d54a1d4304fd74b2ccc3f7
Deprecated features used!
Default value TrueClass is invalid for property hashed of resource ssh_known_hosts. In Chef 13 this will become an error: Option hashed must be a kind of [TrueClass, FalseClass]! You passed TrueClass.. at 1 location:
- /tmp/chef/cookbooks/ssh/resources/known_hosts.rb:6:in `class_from_file'
Most of the cookbooks have a "View Source" button that links back to the github repo, I don't see one for this cookbook though
I'm facing Parent directory /var/backups/.ssh does not exist.
crash when the user doesn't have the .ssh
directory. Should this cookbook create it?
We have an instance in which we would like to provide several SSH keys as IdentityFile
s (specifically github deploy keys for multiple private dependencies), but as far as I know, this use-case is not supported.
Perhaps the logic here could be expanded to honor the case that the provided options might contain arrays for values:
ssh_config 'github.com' do
options(User: 'git',
IdentityFile: ['/path/to/key-one', '/path/to/key-two', ...],
StrictHostKeyChecking: 'no')
end
In that instance, it may be understood that it's meant to have two instances of IdentityFile
with each of the provided paths.
I don't know how the empty line got in to the authorized_keys file (maybe this is another bug in this cookbook), but when the first line is empty and we try to maintain the key which already exists (nothing should change) we get an exception.
Removing a line by hand works.
Cookbook version:
name 'ssh'
maintainer 'Tejay Cardon'
maintainer_email '[email protected]'
license 'Apache 2.0'
description 'LWRPs for managing SSH known_hosts and config files'
long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
version '0.10.24'
issues_url 'https://github.com/markolson/chef-ssh/issues'
source_url 'https://github.com/markolson/chef-ssh'
supports 'ubuntu'
supports 'rhel'
Stacktrace:
* ssh_authorized_keys[remote server access for Xxxx - 201909] action add
================================================================================
Error executing action `add` on resource 'ssh_authorized_keys[remote server access for Xxxx - 201909]'
================================================================================
TypeError
---------
no implicit conversion of Symbol into Integer
Cookbook Trace:
---------------
/etc/chef/local-mode-cache/cache/cookbooks/ssh/providers/authorized_keys.rb:25:in `[]'
/etc/chef/local-mode-cache/cache/cookbooks/ssh/providers/authorized_keys.rb:25:in `block (2 levels) in class_from_file'
/etc/chef/local-mode-cache/cache/cookbooks/ssh/providers/authorized_keys.rb:25:in `each'
/etc/chef/local-mode-cache/cache/cookbooks/ssh/providers/authorized_keys.rb:25:in `find'
/etc/chef/local-mode-cache/cache/cookbooks/ssh/providers/authorized_keys.rb:25:in `block in class_from_file'
/etc/chef/local-mode-cache/cache/cookbooks/ssh/providers/authorized_keys.rb:13:in `block in class_from_file'
Resource Declaration:
---------------------
# In /etc/chef/local-mode-cache/cache/cookbooks/lmcrm/recipes/user.rb
76: ssh_authorized_keys "remote server access for Xxxx - 201909" do
77: user 'xxx'
78: key 'AAAAB3NzaC1yc2EAAAABJQAAAQEA4ntKq2j33CIKgoqNpd1aYPWVs3sR1yNV/G8kdpV1VNs7oAJqkVugEX7cbSlP8UEdYDfIvu0yEzwL850eoze03SY0ZCELfPeh9mR/zqd1i0a8cK7BQrUpruerCtEy8mXEtSh9DqcjTSpDqeuJC9eHJHbMkSR9OEOkCh4GPVNUUho0tSvzPBN07ewP4cuRe2Fx0xLtuVWllPFGELE48MW+l5hYLcfV5gIegQzgoYtjAX2XrSs8/gpQsp0IcVjPCC4wj9tLhLkTfs8sJR4mpFwZIbHide2fAyb7xKkdDU7lkS+ZDVcbM41Cia5noTJoQIcqoLmnfjTCOxtCI19ahZJuZQ=='
79: comment 'Xxxx'
80:
81: end
82: user 'zzzz' do
Compiled Resource:
------------------
# Declared in /etc/chef/local-mode-cache/cache/cookbooks/lmcrm/recipes/user.rb:76:in `from_file'
ssh_authorized_keys("remote server access for Xxxx - 201909") do
action [:add]
default_guard_interpreter :default
declared_type :ssh_authorized_keys
cookbook_name "yyy"
recipe_name "user"
user "xxx"
key "AAAAB3NzaC1yc2EAAAABJQAAAQEA4ntKq2j33CIKgoqNpd1aYPWVs3sR1yNV/G8kdpV1VNs7oAJqkVugEX7cbSlP8UEdYDfIvu0yEzwL850eoze03SY0ZCELfPeh9mR/zqd1i0a8cK7BQrUpruerCtEy8mXEtSh9DqcjTSpDqeuJC9eHJHbMkSR9OEOkCh4GPVNUUho0tSvzPBN07ewP4cuRe2Fx0xLtuVWllPFGELE48MW+l5hYLcfV5gIegQzgoYtjAX2XrSs8/gpQsp0IcVjPCC4wj9tLhLkTfs8sJR4mpFwZIbHide2fAyb7xKkdDU7lkS+ZDVcbM41Cia5noTJoQIcqoLmnfjTCOxtCI19ahZJuZQ=="
comment "Xxxx"
end
System Info:
------------
chef_version=13.0.118
platform=debian
platform_version=6.0.4
ruby=ruby 2.4.1p111 (2017-03-22 revision 58053) [x86_64-linux]
program_name=chef-solo worker: ppid=28010;start=11:32:37;
executable=/opt/chef/bin/chef-solo
Berkshelf::MissingLockfileCookbookVersion: Cookbook 'ssh' (0.10.5) not found in any of the sources! This can happen if the remote cookbook has been deleted or if the sources inside the Berksfile have changed. Please run
berks update ssh
to resolve to a valid version.
It seems as though versions older than 0.10.6 have been purged from supermarket. How come?
Fix FC023 on providers/known_hosts.rb:37
A very useful cookbook. Not sure I am using the authorized_keys function correctly.
ssh_authorized_keys 'non-root authorized_keys' do
user user_name
key master_pub_key
type 'ssh-rsa'
end
fails with does not match regular expression [/^\S*$/]
. The key contains:
ssh-rsa AAAAB3NzaC....7eqMQiiJAQ==
. The invocation specifies type 'ssh-rsa'
. Should the function process the key including ssh-rsa
+space? I generated the pub key without the trailing comment (space + email) using ssh-keygen -y -f ~/.ssh/master.id_rsa > ~/.ssh/master.id_rsa.pub
. I could not find options to strip the leading ssh-rsa
.
Not sure you knew... The "Resources & Providers" section of the README is difficult to read in Chef Supermarket. I used Atom's markdown viewer.
==> vb-tt-dev: [2014-12-15T10:16:17-07:00] ERROR: ssh_known_hosts[bitbucket.org] (get-gitrepos::default line 54) had an error: NoMethodError: No resource or method named `default_or_user_path' for `Chef::Provider::SshKnownHosts ""'
@tejaycar did you just change something here with the PR merge?
would be nice if the opscode community site would be updated to refer to this repo. There is an old entry for 'ssh-util' which seems to be the ancestor of this repo.
http://community.opscode.com/cookbooks/ssh-util
To be honest, actually I'd prefer to stick with something like 'ssh-util'.
This is a really useful little cookbook but I am curious why is does not support the two other basic SSH features, generation of ssh public/private key pairs and adding keys to the authorized_keys file (and making sure it and its folders permissions are set correctly in the process). With those to features in place, this would be a near perfect little cookbook for SSH.
Yikes, just saw that the host and port attributes are completely ignored by known_hosts when the key is provided. This will be a breaking change, but I think we should accept ONLY the key for key, and then concatenate everything as needed.
Not sure how that works with obfuscated keys....
Somehow I put id_rsa rather than ssh_rsa as the default type of ssh_authorized_keys. That's not even a valid option.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.