Central Bastion (Jump box) setup - RAJANKUMARManglani/Robot-framework GitHub Wiki
The Central AWS Bastion (Jumpbox) is just a pair of EC2 instances whose IPs are whitelisted by ISO for us to SSH (port 22) through them to our internal VPC bastion instances such as the Cloud Foundry bastions.
Port 22 is usually blocked for external connections due to security considerations.
FarmRise DB's and application servers are accessible only from the bastion servers (hosted in farmrise VPC) and to connect to farmrise bastion servers people should connect to the Central AWS bastion as port 22 is blocked for external connections.
If you are not in the “Software Developers” group, you can go to Velocity Profiles and request membership in the exception group for “SSH Bastion Users”. Please check first whether or not you already have access before requesting membership so we don’t have to sort through unnecessary requests.
Using Homebrew Mac users with Homebrew installed can install Vault like so:
You’ll need to set an environment variable so the Vault CLI knows the address of the Vault server. In most linux based shells (bash, zsh, etc):
$ export VAULT_ADDR='https://vault.agro.services' This environment variable will need to be set for every new shell. In bash, you can ensure it always gets set by adding it to your ~/.bashrc or ~/.bash_profile file. Other shells have mechanisms to do this as well.
vault login --method=oidc
Note: Your Vault auth token is valid for 8 hours. After 8 hours, your token will expire and you will have to re-authenticate to get a new, valid token.
Below are the manual steps to sign your SSH public key and use it to proxy through the jumpbox.
First, if you don’t already have an SSH key-pair, you’ll need to generate one like so (you can leave passphrase empty):
$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/<USER>/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
-
vault write -field signed_key ssh/sign/monuser public_key=@$HOME/.ssh/id_rsa.pub > $HOME/.ssh/id_rsa-cert.pub
-
chmod 0600 $HOME/.ssh/id_rsa-cert.pub
-
ssh -i $HOME/.ssh/id_rsa [email protected]
##Begin Climate Managed SSH Portion
Include ~/.ssh/config.d/tcc-config
##End Climate Managed SSH Portion
Host *
IdentityFile ~/.ssh/id_rsa
Host jumpbox
HostName ssh.platforms.engineering
User monuser
IdentityFile ~/.ssh/id_rsa
Host test
User <USERNAME>
Hostname <IP>
ProxyCommand ssh -q -F ~/.ssh/config -W %h:%p jumpbox
IdentityFile ~/.ssh/<KEY>.pem
Host prod
User <USERNAME>
Hostname <IP>
ProxyCommand ssh -q -F ~/.ssh/config -W %h:%p jumpbox
IdentityFile ~/.ssh/<KEY>.pem
Note: IP and USERNAME can be replaced with actual values once the request is completed.
Once the setup is completed share the public key (id_rsa.pub) with CloudOps team and raise a access request here.