How to configure SSH

[FelixSab]

I am currently setting up a deployment using gitlab-ci and encountered some issues with my SSH configuration. Is there any way to have it configured besides the user name? I tried using a config, but to no avail:

The Dockerfile I am using:

FROM ghcr.io/mrsked/mrsk:latest

RUN apk add --no-cache bash curl

RUN echo '#!/bin/bash' > /usr/local/bin/mount-env && \
    echo 'curl --silent "https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer" | bash' >> /usr/local/bin/mount-env && \
    chmod +x /usr/local/bin/mount-env

RUN echo '#!/bin/bash' > /usr/local/bin/register-ssh-key && \
    echo 'export SSH_KEY="$(realpath $SECURE_FILES_DOWNLOAD_PATH)/ssh_key"' >> /usr/local/bin/register-ssh-key && \
    echo 'chmod 600 ${SSH_KEY}' >> /usr/local/bin/register-ssh-key && \
    chmod +x /usr/local/bin/register-ssh-key

RUN mkdir /root/.ssh/ && \
    echo 'Host *' >> /root/.ssh/config && \
    echo '  IdentityFile ${SSH_KEY}' >> /root/.ssh/config && \
    echo '  StrictHostKeyChecking no' >> /root/.ssh/config && \
    echo '  UserKnownHostsFile /dev/null' >> /root/.ssh/config


ENTRYPOINT ["/bin/bash", "-l", "-c"]

My gitlab-ci.yml:

image: <<Dockerfile from above>>

stages:          # List of stages for jobs, and their order of execution
  - deploy

deploy-job:      # This job runs in the deploy stage.
  stage: deploy  # It only runs when *both* jobs in the test stage complete successfully.
  environment: production
  variables:
    SECURE_FILES_DOWNLOAD_PATH: '.'
  script:
    - mount-env
    - source register-ssh-key
    - cat ~/.ssh/config
    - ssh $SERVER_IP "ls -lah"
    - mrsk setup

My output:

$ cat ~/.ssh/config
Host *
  IdentityFile ${SSH_KEY}
  StrictHostKeyChecking no
  UserKnownHostsFile /dev/null
$ ssh <<Server-IP>> "ls -lah"
Warning: Permanently added '' (ED25519) to the list of known hosts.
total 36K
drwx------  5 root root 4.0K Jul  5 12:22 .
drwxr-xr-x 18 root root 4.0K Jul  5 12:15 ..
-rw-r--r--  1 root root   15 Jul  5 12:20 .bash_history
-rw-r--r--  1 root root 3.1K Oct 15  2021 .bashrc
drwx------  2 root root 4.0K Jul  5 12:22 .docker
-rw-r--r--  1 root root  161 Jul  9  2019 .profile
drwx------  2 root root 4.0K Jul  5 12:15 .ssh
$ mrsk setup
Acquiring the deploy lock...
  Finished all in 0.2 seconds
  ERROR (Net::SSH::AuthenticationFailed): Exception while executing on host <<Server-IP>>: Authentication failed for user root@<<Server-IP>>

As you can see, the config is working properly when using ssh by itself, but not when using mrsk. Is there a way to provide ssh options or a config?

Help would be greatly appreciated

[nickhammond]

@FelixSab You can specify a proxy with mrsk(https://github.com/mrsked/mrsk#using-a-proxy-ssh-host) but this seems like a question for gitlab CI though. I know with github actions you have to add in a few things to get SSH connections to work properly, I'd imagine it's the same with gitlab CI. Have you tried the docker executor steps on this gitlab CI guide? https://docs.gitlab.com/ee/ci/ssh_keys/

[FelixSab]

@nickhammond Yes, using ssh agent like described by the gitlab docs would be one way to solve this issue. I didn't try the proxy, but it seems counterintuitive to me to use this option only for the configuration of my ssh connection. I updated my register-ssh-key script so that the identity file gets copied into the default location, which solves the issue as well:

#!/bin/bash

SSH_PATH=$(realpath ~)/.ssh

OLD_SSH_KEY_PATH=$(realpath $SECURE_FILES_DOWNLOAD_PATH)/ssh_key
NEW_SSH_KEY_PATH=$SSH_PATH/id_ed25519

# Check if the old SSH key file exists
if [ ! -f "$OLD_SSH_KEY_PATH" ]; then
    echo "The file $OLD_SSH_KEY_PATH does not exist. Exiting script."
    exit 0
fi

mkdir $SSH_PATH

echo $PROD_SERVER_A_PUBKEY > $SSH_PATH/known_hosts
echo $STAGING_SERVER_A_PUBKEY > $SSH_PATH/known_hosts

mv $OLD_SSH_KEY_PATH $NEW_SSH_KEY_PATH
chmod 600 $NEW_SSH_KEY_PATH

If I'd change the ssh port of my servers, I'd have to use the proxy though, no?

[nickhammond]

@FelixSab Yah, it looks like it.