Commit Graph

25 Commits

Author SHA1 Message Date
James Bardin 2d7dc605a0 get communicator errors from a remote.Cmd
The remote.Cmd struct could not convey any transport related error to
the caller, meaning that interrupted commands would show that they
succeeded.

Change Cmd.SetExited to accept an exit status, as well as an error to
store for the caller.  Make the status and error fields internal,
require serialized access through the getter methods.

Users of remote.Cmd should not check both Cmd.Err() and Cmd.ExitStatus()
until after Wait returns.

Require communicators to call Cmd.Init before executing the command.
This will indicate incorrect usage of the remote.Cmd by causing a panic
in SetExitStatus.
2018-03-15 16:03:20 -04:00
James Bardin e41b29d096
Merge pull request #17354 from hashicorp/jbardin/known_hosts
Verify host keys in ssh connections
2018-02-15 18:33:41 -05:00
James Bardin c1b35ad69b have the ssh communicator return fatal errors
This will let the retry loop abort when there are errors which aren't
going to ever be corrected.
2018-02-15 16:14:33 -05:00
James Bardin 1a68fdb4f6 add support for ssh host key checking
Add `host_key` and `bastion_host_key` fields to the ssh communicator
config for strict host key checking.

Both fields expect the contents of an openssh formated public key. This
key can either be the remote host's public key, or the public key of the
CA which signed the remote host certificate.

Support for signed certificates is limited, because the provisioner
usually connects to a remote host by ip address rather than hostname, so
the certificate would need to be signed appropriately. Connecting via
a hostname needs to currently be done through a secondary provisioner,
like one attached to a null_resource.
2018-02-14 15:35:41 -05:00
Adam Shannon c9c2823f62 communicator/ssh: add what error details we can for the user
ssh.Waitmsg's String() method provides output which can include the
process status, signal, and message
2017-10-03 09:06:02 -05:00
James Bardin e1f06e5d0f Skip upload copy if we know the length
If the source length is known, we can skip copying the file.
2017-02-10 10:11:31 -05:00
Mitchell Hashimoto b486354a9c
communicator/ssh: Disconnect() should also kill the actual connection 2017-01-26 15:10:03 -08:00
Mitchell Hashimoto 4b1d9cfd7d
communicator/ssh: don't share rand object to guarantee unique values
Fixes #10463

I'm really surprised this flew under the radar for years...

By having unique PRNGs, the SSH communicator could and would
generate identical ScriptPaths and two provisioners running in parallel
could overwrite each other and execute the same script. This would
happen because they're both seeded by the current time which could
potentially be identical if done in parallel...

Instead, we share the rand now so that the sequence is guaranteed
unique. As an extra measure of robustness, we also multiple by the PID
so that we're also protected against two processes at the same time.
2016-12-06 00:21:49 -08:00
Paul Hinze 96c20f0dd7
communicator/{ssh,winrm}: seed random script paths
Without a seed, the "random" script path locations for the remote-exec
provisioner were actually deterministic!

Every rand.Int31() would return the same pseudorandom chain starting w/
the numbers: 1298498081, 2019727887, 1427131847, 939984059, ...

So here we properly seed the communicators so the script paths are
actually random, and multiple runs on a single remote host have much
less chance of clobbering each other.

Fixes #4186

Kudos to @DustinChaloupka for the correct hunch leading to this fix!
2016-06-29 09:32:24 -05:00
Paul Hinze 7ffa66d1a5 ssh: accept private key contents instead of path
We've been moving away from config fields expecting file paths that
Terraform will load, instead prefering fields that expect file contents,
leaning on `file()` to do loading from a path.

This helps with consistency and also flexibility - since this makes it
easier to shift sensitive files into environment variables.

Here we add a little helper package to manage the transitional period
for these fields where we support both behaviors.

Also included is the first of several fields being shifted over - SSH
private keys in provisioner connection config.

We're moving to new field names so the behavior is more intuitive, so
instead of `key_file` it's `private_key` now.

Additional field shifts will be included in follow up PRs so they can be
reviewed and discussed individually.
2015-11-12 14:59:14 -06:00
Anthony Scalisi 198e1a5186 remove various typos 2015-09-11 11:56:20 -07:00
Paul Hinze 814d05b96e communicator/ssh: missing newline on bastion host output 2015-07-16 12:16:39 -05:00
Paul Hinze 98891aef96 Merge pull request #2684 from hashicorp/f-print-bastion-host-details
communicator/ssh: print ssh bastion host details to output
2015-07-16 12:13:32 -05:00
Paul Hinze 448a6a1b48 communicator/ssh: print ssh bastion host details to output 2015-07-10 13:02:53 -06:00
Paul Hinze 138018c896 communicator/ssh: agent forward failure is not fatal
On connections where no second hop is made, there's no problem if the
agent forwarding connection is denied, so we shouldn't treat that as a
fatal error.
2015-07-10 12:51:45 -06:00
Paul Hinze a7cbbbd258 communicator/ssh: bastion host support
* adds `bastion_*` fields to `connection` which add configuration for a
   bastion host
 * if `bastion_host` is set, connect to that host first, then jump
   through it to make the SSH connection to `host`
 * enables SSH Agent forwarding by default
2015-06-22 18:00:18 -05:00
Sander van Harmelen f146a31ded Fixing #2033 by adding a small check on the input
If the input begins with a shebang, we’ll leave it as is. If not we’ll
add a default shebang…
2015-05-21 23:36:54 +02:00
Sander van Harmelen a8dacede24 Improved some logging...
I added a debug log line in the last commit, only to find out it’s now
logging the same info twice. So removed the double entry and tweaked
the existing once.
2015-05-11 15:18:32 +02:00
Sander van Harmelen 3881c81a66 Added the exit code as well... 2015-05-05 21:56:20 +02:00
Sander van Harmelen 48f4d499f9 Fixing a small vet warning introduced by PR #1796
While fixing the vet warning also tried to improve any feedback by
showing the actual output/error instead of just the error code.

While testing this I noticed only adding stderr output is not enough as
not all error info is send to stderr, but sometimes also to stdout.
2015-05-05 21:26:28 +02:00
Luke Amdor fbae7884eb remote-exec (ssh): chmod'ing right path 2015-05-04 15:44:44 -05:00
Luke Amdor 11b4060fee remote-exec (ssh): checking chmod command 2015-05-04 15:44:39 -05:00
Sander van Harmelen 41748003c0 Updated the PR according to the review comments
* We now return an error when you set the script_path to
C:\Windows\Temp explaining this is currently not supported
* The fix in PR #1588 is converted to the updated setup in this PR
including the unit tests

Last thing to do is add a few tests for the WinRM communicator…
2015-05-01 18:52:01 +02:00
Sander van Harmelen 4a29c714e5 Adding support for WinRM 2015-05-01 18:48:54 +02:00
Sander van Harmelen c9e9e374bb Adding some abstractions for the communicators
This is needed as preperation for adding WinRM support. There is still
one error in the tests which needs another look, but other than that it
seems like were now ready to start working on the WinRM part…
2015-05-01 18:48:54 +02:00