hashicorp / hashicorp/packer-plugin-sdk
SSH Communicator fails when using signed key for bastion connection
- Dominant language
- Go
- Stars
- 42
- Forks
- 62
- Avg merge
- 29m
- Merged PRs (30d)
- 2
Description
#### Overview of the Issue
When using a key signing strategy via Vault (https://developer.hashicorp.com/vault/docs/secrets/ssh/signed-ssh-certificates#client-key-signing) Packer is unable to connect to bastion hosts.
#### Reproduction Steps
Assume bastion username `bastion-user` and bastion host `bastion-host`
Sign key with Vault CA:
ssh-keygen -t rsa -b 2048 -f id_rsa -q -N ""
vault write -field=signed_key ssh/sign/{role_in_vault} public_key=@./id_rsa.pub > id_rsa-cert.pub
Configure Packer HCL:
source "amazon-ebs" "test" {
ssh_bastion_username = "bastion-user"
ssh_bastion_host = "bastion-host"
ssh_bastion_private_key_file = "id_rsa"
ssh_bastion_certificate_file = "id_rsa-cert.pub"
// ..... rest of code
}
Execute Packer:
packer build -debug rhel_base.pkr.hcl
Note that I have tried these other configurations:
No certificate:
source "amazon-ebs" "test" {
ssh_bastion_username = "bastion-user"
ssh_bastion_host = "bastion-host"
ssh_bastion_private_key_file = "id_rsa"
// ..... rest of code
}
Agent configuration:
❯ ssh-add id_rsa
Identity added: id_rsa ([redacted])
Certificate added: id_rsa-cert.pub (vault-[redacted])
source "amazon-ebs" "test" {
ssh_bastion_username = "bastion-user"
ssh_bastion_host = "bastion-host"
ssh_bastion_agent_auth = true
// ..... rest of code
}
Note also that with `-debug` set I can auth as normal with the ephemeral SSH key that Packer spits out (`ec2_test`):
❯ ssh -J bastion-user@bastion-host -i ec2_test.pem ec2-user@{packer-instance-ip}
// works normally...
### Packer Plugin SDK version
0.3.2
Packer 1.8.4 (compiled from source at https://github.com/hashicorp/packer/commit/35496e533de73f57befe86ed277ca57b5685dcd2)
### Operating system and Environment details
Assume reasonably up to date utilities (`ssh`, etc.) per Ubuntu 20 LTS.
### Log Fragments and crash.log files
With PACKER_LOG=1 and `-debug` set.
2022/10/20 17:32:54 ui: [1;32m==> siem-rhel.amazon-ebs.siem-rhel: Using SSH communicator to connect: 172.35.4.231[0m
2022/10/20 17:32:54 packer-plugin-amazon_v1.1.5_x5.0_linux_amd64 plugin: 2022/10/20 17:32:54 [INFO] Waiting for SSH, up to timeout: 5m0s
2022/10/20 17:32:54 ui: [1;32m==> siem-rhel.amazon-ebs.siem-rhel: Waiting for SSH to become available...[0m
2022/10/20 17:32:54 packer-plugin-amazon_v1.1.5_x5.0_linux_amd64 plugin: 2022/10/20 17:32:54 Using host value: 172.35.4.231
2022/10/20 17:32:56 packer-plugin-amazon_v1.1.5_x5.0_linux_amd64 plugin: 2022/10/20 17:32:56 [DEBUG] TCP connection to SSH ip/port failed: Error connecting to bastion: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
2022/10/20 17:33:10 packer-provisioner-shell plugin: Received interrupt signal (count: 1). Ignoring.
Contributor guide
Assessment
This issue has not been assessed yet.