From 1a68fdb4f6144ffbdeb9959800e2a25f64a33c67 Mon Sep 17 00:00:00 2001 From: James Bardin Date: Tue, 13 Feb 2018 19:27:56 -0500 Subject: [PATCH] add support for ssh host key checking Add `host_key` and `bastion_host_key` fields to the ssh communicator config for strict host key checking. Both fields expect the contents of an openssh formated public key. This key can either be the remote host's public key, or the public key of the CA which signed the remote host certificate. Support for signed certificates is limited, because the provisioner usually connects to a remote host by ip address rather than hostname, so the certificate would need to be signed appropriately. Connecting via a hostname needs to currently be done through a secondary provisioner, like one attached to a null_resource. --- communicator/ssh/communicator.go | 8 +++-- communicator/ssh/provisioner.go | 51 +++++++++++++++++++++++++++----- terraform/eval_validate.go | 2 ++ 3 files changed, 52 insertions(+), 9 deletions(-) diff --git a/communicator/ssh/communicator.go b/communicator/ssh/communicator.go index 4ad67aefc..ba0efe482 100644 --- a/communicator/ssh/communicator.go +++ b/communicator/ssh/communicator.go @@ -117,11 +117,13 @@ func (c *Communicator) Connect(o terraform.UIOutput) (err error) { " User: %s\n"+ " Password: %t\n"+ " Private key: %t\n"+ - " SSH Agent: %t", + " SSH Agent: %t\n"+ + " Checking Host Key: %t", c.connInfo.Host, c.connInfo.User, c.connInfo.Password != "", c.connInfo.PrivateKey != "", c.connInfo.Agent, + c.connInfo.HostKey != "", )) if c.connInfo.BastionHost != "" { @@ -131,11 +133,13 @@ func (c *Communicator) Connect(o terraform.UIOutput) (err error) { " User: %s\n"+ " Password: %t\n"+ " Private key: %t\n"+ - " SSH Agent: %t", + " SSH Agent: %t\n"+ + " Checking Host Key: %t", c.connInfo.BastionHost, c.connInfo.BastionUser, c.connInfo.BastionPassword != "", c.connInfo.BastionPrivateKey != "", c.connInfo.Agent, + c.connInfo.BastionHostKey != "", )) } } diff --git a/communicator/ssh/provisioner.go b/communicator/ssh/provisioner.go index 69923017e..b6cb1b05f 100644 --- a/communicator/ssh/provisioner.go +++ b/communicator/ssh/provisioner.go @@ -18,6 +18,7 @@ import ( "github.com/xanzy/ssh-agent" "golang.org/x/crypto/ssh" "golang.org/x/crypto/ssh/agent" + "golang.org/x/crypto/ssh/knownhosts" ) const ( @@ -43,6 +44,7 @@ type connectionInfo struct { Password string PrivateKey string `mapstructure:"private_key"` Host string + HostKey string `mapstructure:"host_key"` Port int Agent bool Timeout string @@ -53,6 +55,7 @@ type connectionInfo struct { BastionPassword string `mapstructure:"bastion_password"` BastionPrivateKey string `mapstructure:"bastion_private_key"` BastionHost string `mapstructure:"bastion_host"` + BastionHostKey string `mapstructure:"bastion_host_key"` BastionPort int `mapstructure:"bastion_port"` AgentIdentity string `mapstructure:"agent_identity"` @@ -144,34 +147,38 @@ func prepareSSHConfig(connInfo *connectionInfo) (*sshConfig, error) { return nil, err } + host := fmt.Sprintf("%s:%d", connInfo.Host, connInfo.Port) + sshConf, err := buildSSHClientConfig(sshClientConfigOpts{ user: connInfo.User, + host: host, privateKey: connInfo.PrivateKey, password: connInfo.Password, + hostKey: connInfo.HostKey, sshAgent: sshAgent, }) if err != nil { return nil, err } + connectFunc := ConnectFunc("tcp", host) + var bastionConf *ssh.ClientConfig if connInfo.BastionHost != "" { + bastionHost := fmt.Sprintf("%s:%d", connInfo.BastionHost, connInfo.BastionPort) + bastionConf, err = buildSSHClientConfig(sshClientConfigOpts{ user: connInfo.BastionUser, + host: bastionHost, privateKey: connInfo.BastionPrivateKey, password: connInfo.BastionPassword, + hostKey: connInfo.HostKey, sshAgent: sshAgent, }) if err != nil { return nil, err } - } - host := fmt.Sprintf("%s:%d", connInfo.Host, connInfo.Port) - connectFunc := ConnectFunc("tcp", host) - - if bastionConf != nil { - bastionHost := fmt.Sprintf("%s:%d", connInfo.BastionHost, connInfo.BastionPort) connectFunc = BastionConnectFunc("tcp", bastionHost, bastionConf, "tcp", host) } @@ -188,11 +195,41 @@ type sshClientConfigOpts struct { password string sshAgent *sshAgent user string + host string + hostKey string } func buildSSHClientConfig(opts sshClientConfigOpts) (*ssh.ClientConfig, error) { + hkCallback := ssh.InsecureIgnoreHostKey() + + if opts.hostKey != "" { + // The knownhosts package only takes paths to files, but terraform + // generally wants to handle config data in-memory. Rather than making + // the known_hosts file an exception, write out the data to a temporary + // file to create the HostKeyCallback. + tf, err := ioutil.TempFile("", "tf-known_hosts") + if err != nil { + return nil, fmt.Errorf("failed to create temp known_hosts file: %s", err) + } + defer tf.Close() + defer os.RemoveAll(tf.Name()) + + // we mark this as a CA as well, but the host key fallback will still + // use it as a direct match if the remote host doesn't return a + // certificate. + if _, err := tf.WriteString(fmt.Sprintf("@cert-authority %s %s\n", opts.host, opts.hostKey)); err != nil { + return nil, fmt.Errorf("failed to write temp known_hosts file: %s", err) + } + tf.Sync() + + hkCallback, err = knownhosts.New(tf.Name()) + if err != nil { + return nil, err + } + } + conf := &ssh.ClientConfig{ - HostKeyCallback: ssh.InsecureIgnoreHostKey(), + HostKeyCallback: hkCallback, User: opts.user, } diff --git a/terraform/eval_validate.go b/terraform/eval_validate.go index e48af84ac..16bca3587 100644 --- a/terraform/eval_validate.go +++ b/terraform/eval_validate.go @@ -144,8 +144,10 @@ func (n *EvalValidateProvisioner) validateConnConfig(connConfig *ResourceConfig) // For type=ssh only (enforced in ssh communicator) PrivateKey interface{} `mapstructure:"private_key"` + HostKey interface{} `mapstructure:"host_key"` Agent interface{} `mapstructure:"agent"` BastionHost interface{} `mapstructure:"bastion_host"` + BastionHostKey interface{} `mapstructure:"bastion_host_key"` BastionPort interface{} `mapstructure:"bastion_port"` BastionUser interface{} `mapstructure:"bastion_user"` BastionPassword interface{} `mapstructure:"bastion_password"`