Central Bastion (Jump box) setup - RAJANKUMARManglani/Robot-framework GitHub Wiki

What is the Bastion SSH Tunnel?

The Central AWS Bastion (Jumpbox) is just a pair of EC2 instances whose IPs are whitelisted by ISO for us to SSH (port 22) through them to our internal VPC bastion instances such as the Cloud Foundry bastions.

Port 22 is usually blocked for external connections due to security considerations.

Why FarmRise team need access to central bastion ?

FarmRise DB's and application servers are accessible only from the bastion servers (hosted in farmrise VPC) and to connect to farmrise bastion servers people should connect to the Central AWS bastion as port 22 is blocked for external connections.

Requesting access to the AWS Central Bastion (Jumpbox)

If you are not in the “Software Developers” group, you can go to Velocity Profiles and request membership in the exception group for “SSH Bastion Users”. Please check first whether or not you already have access before requesting membership so we don’t have to sort through unnecessary requests.

Installation

Using Homebrew Mac users with Homebrew installed can install Vault like so:

# $ brew install vault

Configuration

You’ll need to set an environment variable so the Vault CLI knows the address of the Vault server. In most linux based shells (bash, zsh, etc):

$ export VAULT_ADDR='https://vault.agro.services' This environment variable will need to be set for every new shell. In bash, you can ensure it always gets set by adding it to your ~/.bashrc or ~/.bash_profile file. Other shells have mechanisms to do this as well.

Authenticating

vault login --method=oidc

Note: Your Vault auth token is valid for 8 hours. After 8 hours, your token will expire and you will have to re-authenticate to get a new, valid token.

Manual step-by-step SSH access

Below are the manual steps to sign your SSH public key and use it to proxy through the jumpbox.

First, if you don’t already have an SSH key-pair, you’ll need to generate one like so (you can leave passphrase empty):

$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/<USER>/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
  • vault write -field signed_key ssh/sign/monuser public_key=@$HOME/.ssh/id_rsa.pub > $HOME/.ssh/id_rsa-cert.pub

  • chmod 0600 $HOME/.ssh/id_rsa-cert.pub

  • ssh -i $HOME/.ssh/id_rsa [email protected]

Creating/Updating your SSH config file

##Begin Climate Managed SSH Portion
Include ~/.ssh/config.d/tcc-config
##End Climate Managed SSH Portion
Host *
    IdentityFile ~/.ssh/id_rsa

Host jumpbox
    HostName ssh.platforms.engineering
    User monuser
    IdentityFile ~/.ssh/id_rsa
Host test
    User <USERNAME>
    Hostname <IP>
    ProxyCommand ssh -q -F ~/.ssh/config -W %h:%p jumpbox
    IdentityFile ~/.ssh/<KEY>.pem

Host prod
    User <USERNAME>
    Hostname <IP>
    ProxyCommand ssh -q -F ~/.ssh/config -W %h:%p jumpbox
    IdentityFile ~/.ssh/<KEY>.pem

Note: IP and USERNAME can be replaced with actual values once the request is completed.

Once the setup is completed share the public key (id_rsa.pub) with CloudOps team and raise a access request here.

References

https://devtools.bayer.com/docs/hosting/aws/bastion/

⚠️ **GitHub.com Fallback** ⚠️