add support for ssh host key checking
Add `host_key` and `bastion_host_key` fields to the ssh communicator config for strict host key checking. Both fields expect the contents of an openssh formated public key. This key can either be the remote host's public key, or the public key of the CA which signed the remote host certificate. Support for signed certificates is limited, because the provisioner usually connects to a remote host by ip address rather than hostname, so the certificate would need to be signed appropriately. Connecting via a hostname needs to currently be done through a secondary provisioner, like one attached to a null_resource.
This commit is contained in:
parent
a65089fcea
commit
1a68fdb4f6
|
@ -117,11 +117,13 @@ func (c *Communicator) Connect(o terraform.UIOutput) (err error) {
|
||||||
" User: %s\n"+
|
" User: %s\n"+
|
||||||
" Password: %t\n"+
|
" Password: %t\n"+
|
||||||
" Private key: %t\n"+
|
" Private key: %t\n"+
|
||||||
" SSH Agent: %t",
|
" SSH Agent: %t\n"+
|
||||||
|
" Checking Host Key: %t",
|
||||||
c.connInfo.Host, c.connInfo.User,
|
c.connInfo.Host, c.connInfo.User,
|
||||||
c.connInfo.Password != "",
|
c.connInfo.Password != "",
|
||||||
c.connInfo.PrivateKey != "",
|
c.connInfo.PrivateKey != "",
|
||||||
c.connInfo.Agent,
|
c.connInfo.Agent,
|
||||||
|
c.connInfo.HostKey != "",
|
||||||
))
|
))
|
||||||
|
|
||||||
if c.connInfo.BastionHost != "" {
|
if c.connInfo.BastionHost != "" {
|
||||||
|
@ -131,11 +133,13 @@ func (c *Communicator) Connect(o terraform.UIOutput) (err error) {
|
||||||
" User: %s\n"+
|
" User: %s\n"+
|
||||||
" Password: %t\n"+
|
" Password: %t\n"+
|
||||||
" Private key: %t\n"+
|
" Private key: %t\n"+
|
||||||
" SSH Agent: %t",
|
" SSH Agent: %t\n"+
|
||||||
|
" Checking Host Key: %t",
|
||||||
c.connInfo.BastionHost, c.connInfo.BastionUser,
|
c.connInfo.BastionHost, c.connInfo.BastionUser,
|
||||||
c.connInfo.BastionPassword != "",
|
c.connInfo.BastionPassword != "",
|
||||||
c.connInfo.BastionPrivateKey != "",
|
c.connInfo.BastionPrivateKey != "",
|
||||||
c.connInfo.Agent,
|
c.connInfo.Agent,
|
||||||
|
c.connInfo.BastionHostKey != "",
|
||||||
))
|
))
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -18,6 +18,7 @@ import (
|
||||||
"github.com/xanzy/ssh-agent"
|
"github.com/xanzy/ssh-agent"
|
||||||
"golang.org/x/crypto/ssh"
|
"golang.org/x/crypto/ssh"
|
||||||
"golang.org/x/crypto/ssh/agent"
|
"golang.org/x/crypto/ssh/agent"
|
||||||
|
"golang.org/x/crypto/ssh/knownhosts"
|
||||||
)
|
)
|
||||||
|
|
||||||
const (
|
const (
|
||||||
|
@ -43,6 +44,7 @@ type connectionInfo struct {
|
||||||
Password string
|
Password string
|
||||||
PrivateKey string `mapstructure:"private_key"`
|
PrivateKey string `mapstructure:"private_key"`
|
||||||
Host string
|
Host string
|
||||||
|
HostKey string `mapstructure:"host_key"`
|
||||||
Port int
|
Port int
|
||||||
Agent bool
|
Agent bool
|
||||||
Timeout string
|
Timeout string
|
||||||
|
@ -53,6 +55,7 @@ type connectionInfo struct {
|
||||||
BastionPassword string `mapstructure:"bastion_password"`
|
BastionPassword string `mapstructure:"bastion_password"`
|
||||||
BastionPrivateKey string `mapstructure:"bastion_private_key"`
|
BastionPrivateKey string `mapstructure:"bastion_private_key"`
|
||||||
BastionHost string `mapstructure:"bastion_host"`
|
BastionHost string `mapstructure:"bastion_host"`
|
||||||
|
BastionHostKey string `mapstructure:"bastion_host_key"`
|
||||||
BastionPort int `mapstructure:"bastion_port"`
|
BastionPort int `mapstructure:"bastion_port"`
|
||||||
|
|
||||||
AgentIdentity string `mapstructure:"agent_identity"`
|
AgentIdentity string `mapstructure:"agent_identity"`
|
||||||
|
@ -144,34 +147,38 @@ func prepareSSHConfig(connInfo *connectionInfo) (*sshConfig, error) {
|
||||||
return nil, err
|
return nil, err
|
||||||
}
|
}
|
||||||
|
|
||||||
|
host := fmt.Sprintf("%s:%d", connInfo.Host, connInfo.Port)
|
||||||
|
|
||||||
sshConf, err := buildSSHClientConfig(sshClientConfigOpts{
|
sshConf, err := buildSSHClientConfig(sshClientConfigOpts{
|
||||||
user: connInfo.User,
|
user: connInfo.User,
|
||||||
|
host: host,
|
||||||
privateKey: connInfo.PrivateKey,
|
privateKey: connInfo.PrivateKey,
|
||||||
password: connInfo.Password,
|
password: connInfo.Password,
|
||||||
|
hostKey: connInfo.HostKey,
|
||||||
sshAgent: sshAgent,
|
sshAgent: sshAgent,
|
||||||
})
|
})
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, err
|
return nil, err
|
||||||
}
|
}
|
||||||
|
|
||||||
|
connectFunc := ConnectFunc("tcp", host)
|
||||||
|
|
||||||
var bastionConf *ssh.ClientConfig
|
var bastionConf *ssh.ClientConfig
|
||||||
if connInfo.BastionHost != "" {
|
if connInfo.BastionHost != "" {
|
||||||
|
bastionHost := fmt.Sprintf("%s:%d", connInfo.BastionHost, connInfo.BastionPort)
|
||||||
|
|
||||||
bastionConf, err = buildSSHClientConfig(sshClientConfigOpts{
|
bastionConf, err = buildSSHClientConfig(sshClientConfigOpts{
|
||||||
user: connInfo.BastionUser,
|
user: connInfo.BastionUser,
|
||||||
|
host: bastionHost,
|
||||||
privateKey: connInfo.BastionPrivateKey,
|
privateKey: connInfo.BastionPrivateKey,
|
||||||
password: connInfo.BastionPassword,
|
password: connInfo.BastionPassword,
|
||||||
|
hostKey: connInfo.HostKey,
|
||||||
sshAgent: sshAgent,
|
sshAgent: sshAgent,
|
||||||
})
|
})
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, err
|
return nil, err
|
||||||
}
|
}
|
||||||
}
|
|
||||||
|
|
||||||
host := fmt.Sprintf("%s:%d", connInfo.Host, connInfo.Port)
|
|
||||||
connectFunc := ConnectFunc("tcp", host)
|
|
||||||
|
|
||||||
if bastionConf != nil {
|
|
||||||
bastionHost := fmt.Sprintf("%s:%d", connInfo.BastionHost, connInfo.BastionPort)
|
|
||||||
connectFunc = BastionConnectFunc("tcp", bastionHost, bastionConf, "tcp", host)
|
connectFunc = BastionConnectFunc("tcp", bastionHost, bastionConf, "tcp", host)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -188,11 +195,41 @@ type sshClientConfigOpts struct {
|
||||||
password string
|
password string
|
||||||
sshAgent *sshAgent
|
sshAgent *sshAgent
|
||||||
user string
|
user string
|
||||||
|
host string
|
||||||
|
hostKey string
|
||||||
}
|
}
|
||||||
|
|
||||||
func buildSSHClientConfig(opts sshClientConfigOpts) (*ssh.ClientConfig, error) {
|
func buildSSHClientConfig(opts sshClientConfigOpts) (*ssh.ClientConfig, error) {
|
||||||
|
hkCallback := ssh.InsecureIgnoreHostKey()
|
||||||
|
|
||||||
|
if opts.hostKey != "" {
|
||||||
|
// The knownhosts package only takes paths to files, but terraform
|
||||||
|
// generally wants to handle config data in-memory. Rather than making
|
||||||
|
// the known_hosts file an exception, write out the data to a temporary
|
||||||
|
// file to create the HostKeyCallback.
|
||||||
|
tf, err := ioutil.TempFile("", "tf-known_hosts")
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to create temp known_hosts file: %s", err)
|
||||||
|
}
|
||||||
|
defer tf.Close()
|
||||||
|
defer os.RemoveAll(tf.Name())
|
||||||
|
|
||||||
|
// we mark this as a CA as well, but the host key fallback will still
|
||||||
|
// use it as a direct match if the remote host doesn't return a
|
||||||
|
// certificate.
|
||||||
|
if _, err := tf.WriteString(fmt.Sprintf("@cert-authority %s %s\n", opts.host, opts.hostKey)); err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to write temp known_hosts file: %s", err)
|
||||||
|
}
|
||||||
|
tf.Sync()
|
||||||
|
|
||||||
|
hkCallback, err = knownhosts.New(tf.Name())
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
conf := &ssh.ClientConfig{
|
conf := &ssh.ClientConfig{
|
||||||
HostKeyCallback: ssh.InsecureIgnoreHostKey(),
|
HostKeyCallback: hkCallback,
|
||||||
User: opts.user,
|
User: opts.user,
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -144,8 +144,10 @@ func (n *EvalValidateProvisioner) validateConnConfig(connConfig *ResourceConfig)
|
||||||
|
|
||||||
// For type=ssh only (enforced in ssh communicator)
|
// For type=ssh only (enforced in ssh communicator)
|
||||||
PrivateKey interface{} `mapstructure:"private_key"`
|
PrivateKey interface{} `mapstructure:"private_key"`
|
||||||
|
HostKey interface{} `mapstructure:"host_key"`
|
||||||
Agent interface{} `mapstructure:"agent"`
|
Agent interface{} `mapstructure:"agent"`
|
||||||
BastionHost interface{} `mapstructure:"bastion_host"`
|
BastionHost interface{} `mapstructure:"bastion_host"`
|
||||||
|
BastionHostKey interface{} `mapstructure:"bastion_host_key"`
|
||||||
BastionPort interface{} `mapstructure:"bastion_port"`
|
BastionPort interface{} `mapstructure:"bastion_port"`
|
||||||
BastionUser interface{} `mapstructure:"bastion_user"`
|
BastionUser interface{} `mapstructure:"bastion_user"`
|
||||||
BastionPassword interface{} `mapstructure:"bastion_password"`
|
BastionPassword interface{} `mapstructure:"bastion_password"`
|
||||||
|
|
Loading…
Reference in New Issue