Consolidate SSH handling to only speak to /usr/bin/ssh #380

Closed
opened 2023-01-18 18:20:54 +00:00 by decentral1se · 4 comments
Owner

Attempts in ssh do not use the binary directly and therefore we've run into a lot of issues.

Ideally, we can drop that implementation and just use SSH directly. This should make things easier to reason about and debug SSH related issues. See coop-cloud/organising#345 for more reasons why. We should then get ~/.ssh/config integration for free.

We do want to retain the TOFU prompt for servers without host keys. Instead of having our own hand-rolled one, we'll have the usual system SSH one. We just need to thread user input in.

This change should be seamless except for the change in host key prompt. There may be others and I'll update the ticket as I dive into this. Hopefully not a big breaking change.

Attempts in [`ssh`](https://git.coopcloud.tech/coop-cloud/abra/src/branch/main/pkg/ssh/ssh.go) do not use the binary directly and therefore we've run into a lot of issues. Ideally, we can drop that implementation and just use SSH directly. This should make things easier to reason about and debug SSH related issues. See https://git.coopcloud.tech/coop-cloud/organising/issues/345 for more reasons why. We should then get `~/.ssh/config` integration for free. We do want to retain the TOFU prompt for servers without host keys. Instead of having our own hand-rolled one, we'll have the usual system SSH one. We just need to thread user input in. This change should be seamless except for the change in host key prompt. There may be others and I'll update the ticket as I dive into this. Hopefully not a big breaking change.
decentral1se added the
enhancement
abra
labels 2023-01-18 18:20:54 +00:00
decentral1se added this to the Federation & abra fixes project 2023-01-18 18:20:57 +00:00
decentral1se self-assigned this 2023-01-18 18:23:11 +00:00
Author
Owner

Breaking one part of this into coop-cloud/organising#389.

Breaking one part of this into https://git.coopcloud.tech/coop-cloud/organising/issues/389.
Author
Owner

We do want to retain the TOFU prompt for servers without host keys.

Actually, I realise that the Docker CLI doesn't even bother:

docker ps
error during connect: Get "http://docker.example.com/v1.24/containers/json": command [ssh -l d -p 222 -- foo.com docker system dial-stdio] has exited with exit status 255, please make sure the URL is valid, and Docker 18.09 or later is installed on the remote host: stderr=ssh_askpass: exec(/usr/bin/ssh-askpass): No such file or directory
Host key verification failed.

It runs ssh directly and does pick up the SSH config correctly. It seems like this would be the simplest interaction model that abra could follow. I wonder if that would be useful for us also to do? 🤔

> We do want to retain the TOFU prompt for servers without host keys. Actually, I realise that the Docker CLI doesn't even bother: > docker ps > error during connect: Get "http://docker.example.com/v1.24/containers/json": command [ssh -l d -p 222 -- foo.com docker system dial-stdio] has exited with exit status 255, please make sure the URL is valid, and Docker 18.09 or later is installed on the remote host: stderr=ssh_askpass: exec(/usr/bin/ssh-askpass): No such file or directory Host key verification failed. It runs `ssh` directly and does pick up the SSH config correctly. It seems like this would be the simplest interaction model that `abra` could follow. I wonder if that would be useful for us also to do? 🤔
Author
Owner

image

![image](/attachments/396125d9-5e12-48c3-b515-823cc052fdb9)
Author
Owner

Major distros support + "The -G option was introduced in openSSH 6.8, in 2015. You should be pretty safe." so I think this is the way to go! Hope this will be simple in implementation. Taking a pause on working on this atm while we work out Autonomic budget stuff.

Major distros support + "The -G option was introduced in openSSH 6.8, in 2015. You should be pretty safe." so I think this is the way to go! Hope this will be simple in implementation. Taking a pause on working on this atm while we work out Autonomic budget stuff.
Sign in to join this conversation.
No description provided.