hashicorp / hashicorp/packer-plugin-sdk

SSH Communicator fails when using signed key for bastion connection

Open
#136 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
42
Forks
62
Avg merge
29m
Merged PRs (30d)
2

Description

#### Overview of the Issue

When using a key signing strategy via Vault (https://developer.hashicorp.com/vault/docs/secrets/ssh/signed-ssh-certificates#client-key-signing) Packer is unable to connect to bastion hosts.

#### Reproduction Steps
Assume bastion username `bastion-user` and bastion host `bastion-host`

Sign key with Vault CA:

ssh-keygen -t rsa -b 2048 -f id_rsa -q -N ""
vault write -field=signed_key ssh/sign/{role_in_vault} public_key=@./id_rsa.pub > id_rsa-cert.pub

Configure Packer HCL:

source "amazon-ebs" "test" {
ssh_bastion_username = "bastion-user"
ssh_bastion_host = "bastion-host"
ssh_bastion_private_key_file = "id_rsa"
ssh_bastion_certificate_file = "id_rsa-cert.pub"
// ..... rest of code
}

Execute Packer:

packer build -debug rhel_base.pkr.hcl

Note that I have tried these other configurations:

No certificate:

source "amazon-ebs" "test" {
ssh_bastion_username = "bastion-user"
ssh_bastion_host = "bastion-host"
ssh_bastion_private_key_file = "id_rsa"
// ..... rest of code
}

Agent configuration:

❯ ssh-add id_rsa
Identity added: id_rsa ([redacted])
Certificate added: id_rsa-cert.pub (vault-[redacted])

source "amazon-ebs" "test" {
ssh_bastion_username = "bastion-user"
ssh_bastion_host = "bastion-host"
ssh_bastion_agent_auth = true
// ..... rest of code
}

Note also that with `-debug` set I can auth as normal with the ephemeral SSH key that Packer spits out (`ec2_test`):

❯ ssh -J bastion-user@bastion-host -i ec2_test.pem ec2-user@{packer-instance-ip}
// works normally...

### Packer Plugin SDK version

0.3.2
Packer 1.8.4 (compiled from source at https://github.com/hashicorp/packer/commit/35496e533de73f57befe86ed277ca57b5685dcd2)

### Operating system and Environment details

Assume reasonably up to date utilities (`ssh`, etc.) per Ubuntu 20 LTS.

### Log Fragments and crash.log files

With PACKER_LOG=1 and `-debug` set.

2022/10/20 17:32:54 ui: ==> siem-rhel.amazon-ebs.siem-rhel: Using SSH communicator to connect: 172.35.4.231
2022/10/20 17:32:54 packer-plugin-amazon_v1.1.5_x5.0_linux_amd64 plugin: 2022/10/20 17:32:54 [INFO] Waiting for SSH, up to timeout: 5m0s
2022/10/20 17:32:54 ui: ==> siem-rhel.amazon-ebs.siem-rhel: Waiting for SSH to become available...
2022/10/20 17:32:54 packer-plugin-amazon_v1.1.5_x5.0_linux_amd64 plugin: 2022/10/20 17:32:54 Using host value: 172.35.4.231
2022/10/20 17:32:56 packer-plugin-amazon_v1.1.5_x5.0_linux_amd64 plugin: 2022/10/20 17:32:56 [DEBUG] TCP connection to SSH ip/port failed: Error connecting to bastion: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
2022/10/20 17:33:10 packer-provisioner-shell plugin: Received interrupt signal (count: 1). Ignoring.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.