Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1362644 - [RFE] Support ForwardAgent in SSH Proxy
Summary: [RFE] Support ForwardAgent in SSH Proxy
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Satellite 6
Classification: Red Hat
Component: Remote Execution
Version: 6.2.0
Hardware: Unspecified
OS: Unspecified
medium
medium with 1 vote vote
Target Milestone: Unspecified
Assignee: satellite6-bugs
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-02 18:11 UTC by Stephen Benjamin
Modified: 2018-09-04 19:05 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-09-04 19:05:11 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Foreman Issue Tracker 21850 None None None 2017-12-04 11:59:42 UTC

Description Stephen Benjamin 2016-08-02 18:11:10 UTC
Description of problem:
The ruby library we use reads ~foreman-proxy/ssh/config, and supports a number of options[1] including ForwardAgent, however unlike the SSH CLI, it does not start an agent if one's not started. So, we would need to actually start an agent.


Version-Release number of selected component (if applicable):
6.2 GA

How reproducible:
Always


Steps to Reproduce:
1. Configure ~foreman-proxy/.ssh/config as such:

  Host *
    ForwardAgent yes
    StrictHostKeyChecking no # just for testing

2. Create a job in Satellite that SSH's to another host that is configured to allow foreman-proxy keys, e.g the satellite itself

  ssh localhost hostname -f

Actual results:
Job fails, agent is not used. If you look at SSH logs (see ), you'll see this:

    I, [2016-08-02T13:04:47.697219 #1422]  INFO -- net.ssh.service.forward[253c094]: opening auth-agent channel
    D, [2016-08-02T13:04:47.697262 #1422] DEBUG -- net.ssh.authentication.agent[14d9af8]: connecting to ssh-agent
    E, [2016-08-02T13:04:47.697305 #1422] ERROR -- net.ssh.authentication.agent[14d9af8]: could not connect to ssh-agent
    E, [2016-08-02T13:04:47.697340 #1422] ERROR -- net.ssh.service.forward[253c094]: attempted to connect to agent but failed: Net::SSH::Authentication::AgentNotAvailable (no implicit conversion of nil into String)
    E, [2016-08-02T13:04:47.697378 #1422] ERROR -- net.ssh.connection.session[255524c]: [2, "could not connect to authentication agent"]


Expected results:
Job succeeds


Additional info:

You can make it work by editing connector.rb and starting an agent before we do Net::SSH.start.

Of course this should be refactored, and a single agent should be used for the life of the dynflow process, but this works:


vars = `ssh-agent`
vars = vars.split(';').reject { |r| !r.strip.include?('=') }
vars.each do |var|
  name, value = var.split('=')
  ENV[name.strip] = value.strip
end

`ssh-add ~/.ssh/id_rsa_foreman_proxy` # add our identity to the agent

Comment 1 Stephen Benjamin 2016-08-02 18:12:41 UTC
To view the logs I pasted in in 'Actual results', you'll need BZ1362630 to be solved

Comment 2 Craig Donnelly 2016-08-03 14:22:41 UTC
Customer was able to work around this issue via the following steps:

1) Setup pam_ssh_agent_auth for sudo
2) Put the foreman_proxy's pub key in the appropriate location
3) Copy the foreman_proxy's private key to the remote user's .ssh directory
4) Preface remote jobs with starting ssh-agent and line to add key to agent
5) use sudo as needed
6) kill agent on exit 

Example Job (confirmed works for cu):
eval $(ssh-agent)
ssh-add /home/satellite/.ssh/id_rsa_foreman_proxy
sudo -i bash -c 'whoami; sleep 1; df -h'
ssh-agent -k

Comment 3 roger.m.hay.ctr 2016-08-03 19:13:23 UTC
Here is a template version of the work around above, I am using this in place of the default ssh remote execution template.


#####################################################

eval $(ssh-agent) >/dev/null 2>&1
ssh-add /home/satellite/.ssh/id_rsa_foreman_proxy >/dev/null 2>&1

sudo -i bash << "EOF"
<%= input("command") %>

EOF

ssh-agent -k >/dev/null 2>&1

#####################################################

Comment 4 Adam Ruzicka 2017-12-04 11:59:38 UTC
Created redmine issue http://projects.theforeman.org/issues/21850 from this bug

Comment 5 Bryan Kearney 2018-09-04 18:55:05 UTC
Thank you for your interest in Satellite 6. We have evaluated this request, and we do not expect this to be implemented in the product in the foreseeable future. We are therefore closing this out as WONTFIX. If you have any concerns about this, please feel free to contact Rich Jerrido or Bryan Kearney. Thank you.

Comment 6 Bryan Kearney 2018-09-04 19:05:11 UTC
Thank you for your interest in Satellite 6. We have evaluated this request, and we do not expect this to be implemented in the product in the foreseeable future. We are therefore closing this out as WONTFIX. If you have any concerns about this, please feel free to contact Rich Jerrido or Bryan Kearney. Thank you.


Note You need to log in before you can comment on or make changes to this bug.