Skip to content

Commit b9609ad

Browse files
topofocustopofocus
committed
included Reverse SSH configuration
1 parent 1b8c630 commit b9609ad

File tree

2 files changed

+88
-55
lines changed

2 files changed

+88
-55
lines changed

‎keygen.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/bash
2+
# https://stackoverflow.com/questions/43235179/how-to-execute-ssh-keygen-without-prompt
3+
ssh-keygen -q -t rsa -N '' <<< ""$'\n'"y" 2>&1 >/dev/null

‎setup.sh‎

Lines changed: 85 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -83,12 +83,13 @@ RUBY_VERSION=3.0.0
8383
################## no modifications beyond this line ##############################################################
8484
###################################################################################################################
8585
### Speicherort der Konfiguration des ssh-tunnels
86-
SSH_TUNNEL_LOCATION="/etc/network/if-up.d/reverse_ssh_tunnel"
86+
SSH_TUNNEL_LOCATION="etc/network/if-up.d/reverse_ssh_tunnel"
8787

8888
### Alle Ausgaben in die Datei containerbau.log umleiten
89-
rm containerbau.log
90-
touch containerbau.log
91-
SILENT=containerbau.log
89+
logfile=containerbau.log
90+
if [ -f $logfile ] ; then rm $logfile ; fi
91+
touch $logfile
92+
SILENT=$logfile
9293

9394

9495
if test -n "${2}"
@@ -118,9 +119,11 @@ fi
118119

119120
if test -n "${5}"
120121
then
121-
MIDDLEMAN_SERVER=${5}
122+
SSH_MIDDLEMAN_SERVER=${5}
122123
else
124+
if [[ -z $SSH_MIDDLEMAN_SERVER ]] ; then
123125
read -p "Bezeichnung oder IP des Endpunkts des SSH-Tunnels [return=keinen Tunnel verwenden]: " SSH_MIDDLEMAN_SERVER
126+
fi
124127
if [[ -z $SSH_MIDDLEMAN_SERVER ]] ; then
125128
SETUP_AUTOSSH=0
126129
else
@@ -129,7 +132,7 @@ else
129132
then
130133
SSH_PORT_NUMBER=${4}
131134
else
132-
echo "Kein Port angegeben. Erzeuge zufällige Ports ..."
135+
echo "Erzeuge zufällige Ports ..."
133136
SSH_PORT_NUMBER=$[ ( $RANDOM % 10000 ) + 10000 ]
134137
read -p "Port für SSH-Tunnel [$SSH_PORT_NUMBER]: " port
135138
if [[ -n $port ]] ; then
@@ -139,11 +142,12 @@ else
139142
SSH_MONITORING_PORT_NUMBER=`expr $SSH_PORT_NUMBER + 10000`
140143
if test -n "${6}"
141144
then
142-
SSH_MIDDLEMAN_USERNAME=${5}
145+
SSH_MIDDLEMAN_USER=${5}
143146
else
144-
read "Benutzer auf dem Endpunkt des SSH-Tunnels: $SSH_MIDDLEMAN_SERVER:[`whoami`] " MIDDLEMAN_USERNAME
145-
if [[ -z $SSH_MIDDLEMAN_USERNAME ]]; then
146-
SSH_MIDDLEMAN_USERNAME=`whoami`
147+
user=`whoami`
148+
read -p "Benutzer auf dem Endpunkt des SSH-Tunnels: $SSH_MIDDLEMAN_SERVER:[$user] " SSH_MIDDLEMAN_USER
149+
if [[ -z $SSH_MIDDLEMAN_USER ]]; then
150+
SSH_MIDDLEMAN_USER=$user
147151
fi
148152
fi
149153
fi
@@ -158,7 +162,7 @@ echo "Demoaccount: `if [ $DEMOACCOUNT -eq 1 ] ; then echo "ja" ; else echo "nei
158162
echo "PORT: $SSH_PORT_NUMBER"
159163
echo "Backport: $SSH_MONITORING_PORT_NUMBER"
160164
echo "Middleman: $SSH_MIDDLEMAN_SERVER"
161-
echo "Middleman User: $SSH_MIDDLEMAN_USERNAME"
165+
echo "Middleman User: $SSH_MIDDLEMAN_USER"
162166
echo "......................................"
163167

164168
read -p "Installieren? [Y/n]:" cont
@@ -231,8 +235,6 @@ prepare_lxd(){
231235
launch_image(){
232236
## Test ob das Image bereits angelegt ist
233237
if lxc list | grep -q $CONTAINER ; then
234-
echo "Container ist bereits angelegt"
235-
echo "Bitte Container >> $CONTAINER << zuerst manuell entfernen"
236238
return 1
237239
else
238240
lxc launch --profile default --profile gui ubuntu-minimal:f $CONTAINER
@@ -245,7 +247,7 @@ launch_image(){
245247

246248
download_ib_software(){
247249
if [ -f $IB_PROGRAM ] ; then
248-
echo "$PRODUCT ist bereits lokal vorhanden "
250+
:
249251
else
250252
echo "Hole $PRODUCT vom offiziellen Server"
251253
wget $IB_PATH
@@ -259,7 +261,6 @@ check_container(){
259261
### 2. IPV4 muster ist vorhanden
260262

261263
if lxc list | grep -q $CONTAINER && [ `lxc list | grep $CONTAINER | awk -F '|' '{ print $3 }' ` = "RUNNING" ] && [ `lxc list | grep $CONTAINER | awk -F'|' '{ if($4 ~ /[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ ) {print 1} else {print 0}}'` -eq 1 ] ; then
262-
echo "Container is active and running"
263264
return 0
264265
else
265266
echo 'Networking is not active'
@@ -293,7 +294,7 @@ init_container(){
293294
# >> $SILENT
294295
return 0
295296
else
296-
echo "Container ist nicht leer."
297+
echo "Container ist nicht leer. Konfiguration übersprungen!"
297298
return 1
298299
fi
299300
}
@@ -309,7 +310,7 @@ apply_ibc(){
309310
if [ -f $ibc_file ] ; then
310311
echo "IBC-$IBC_VERSION ist bereits lokal vorhanden "
311312
else
312-
echo "Hole IBC-Archib vom Git-Archiv"
313+
echo "Hole IBC-Archiv vom GitHub-Server"
313314
wget $IBC_PATH >> $SILENT
314315
fi
315316
## Erstelle ibc-Verzeichnis im Container
@@ -367,7 +368,7 @@ install_simple_monitor(){
367368
# elinks installieren
368369
# tmux- und elinks-Konfigurationen kopieren
369370
# Simple-Monitor installieren
370-
local access_container="lxc exec $CONTAINER -- sudo --login --user ubuntu -- "
371+
local access_container="lxc exec $CONTAINER -- sudo --login --user ubuntu --"
371372
if [ `$access_container find /home/ubuntu -type d -name simple-monitor | wc -l ` -ne 0 ] ; then
372373
echo "simple monitor ist bereits angelegt"
373374
return 1
@@ -396,24 +397,45 @@ setup_reverse_tunnel(){
396397
# SSH für sicheren passwortlosen Zugang aufsetzen
397398
# reverse tunnel aufsetzen
398399
# container neu starten und tunnel testen
399-
local access_container="lxc exec $CONTAINER -- sudo --login --user ubuntu -- "
400-
if [ `$access_container find /home/ubuntu -type d -name .ssh | wc -l ` -ne 0 ] ; then
401-
echo "Verzeichnis .ssh ist bereits vorhanden."
402-
else
400+
local access_container="lxc exec $CONTAINER -- sudo --login --user ubuntu --"
401+
402+
check_tunnel(){
403+
if [ `$access_container ps -ef | grep -c localhost:22 ` -eq 1 ] ; then
404+
return 0
405+
else
406+
return 1
407+
fi
408+
}
409+
410+
check_tunnel
411+
if [ $? -ne 0 ] ; then
412+
403413
$access_container sudo apt install -y openssh-server autossh >> $SILENT # add .ssh dir
404-
# https://stackoverflow.com/questions/43235179/how-to-execute-ssh-keygen-without-prompt
405-
$access_container ssh-keygen -q -t rsa -N '' -f /home/ubuntu/.ssh/id_rsa <<<y 2>&1 >/dev/null
414+
lxc file push keygen.sh $CONTAINER/home/ubuntu/
415+
$access_container /home/ubuntu/keygen.sh
406416
# download public-key and install it locally
407-
lxc file pull $CONTAINER/home/ubuntu/.ssh/id_rsa.pub .
408-
cat id_rsa.pub >> ~.ssh/autorized_keys
409-
rm id_rsa.pub
417+
418+
lxc file pull $CONTAINER/home/ubuntu/.ssh/id_rsa.pub $CONTAINER.pub
419+
echo ""
420+
echo " ++++++++++++++++++++++++++++++++++++++++++++++ "
421+
echo " Container-Zertifikat heruntergeladen! "
422+
echo " "
423+
echo " ------> $CONTAINER.pub <------ "
424+
echo " "
425+
echo " Bitte manuell an ~/ssh/autorized_keys auf dem "
426+
echo " Middleman-Server anfügen! "
427+
echo " ++++++++++++++++++++++++++++++++++++++++++++++ "
428+
read -p "nach <CR> gehts weiter" read
429+
430+
echo " Installiere lokal abgelegte Zertifikate im Container"
410431
# install certificates to access the container via ssh and reverse ssh
411432
for certificate in *.pub
412433
do
413434
[ -f $certificate ] || continue
414-
if [ "$certificate" = dummy.pub ] ; then
415-
echo `cat $certificate`
435+
if [ "$certificate" = dummy.pub ] || [ "$certificate" = $CONTAINER.pub ] ; then
436+
:
416437
else
438+
echo "installiere $certificate "
417439
lxc file push $certificate $CONTAINER/home/ubuntu/
418440
$access_container cat $certificate >> /home/ubuntu/.ssh/authorized_keys
419441
$access_container rm $certificate
@@ -422,42 +444,44 @@ setup_reverse_tunnel(){
422444

423445
echo "#!/bin/sh
424446
425-
# This is the username on your local server who has public key authentication setup at the middleman
426-
USER_TO_SSH_IN_AS=$SSH_MIDDLEMAN_USERNAME
447+
# This is the username on your local server who has public key authentication setup at the middleman
448+
USER_TO_SSH_IN_AS=$SSH_MIDDLEMAN_USER
427449
428-
# This is the username and hostname/IP address for the middleman (internet accessible server)
429-
MIDDLEMAN_SERVER_AND_USERNAME=$SSH_MIDDLEMAN_USERNAME@$SSH_MIDDLEMAN_SERVER
450+
# This is the username and hostname/IP address for the middleman (internet accessible server)
451+
MIDDLEMAN_SERVER_AND_USER=$SSH_MIDDLEMAN_USER@$SSH_MIDDLEMAN_SERVER
430452
431-
# Port that the middleman will listen on (use this value as the -p argument when sshing)
432-
PORT_MIDDLEMAN_WILL_LISTEN_ON=$SSH_PORT_NUMBER
453+
# Port that the middleman will listen on (use this value as the -p argument when sshing)
454+
PORT_MIDDLEMAN_WILL_LISTEN_ON=$SSH_PORT_NUMBER
433455
434-
# Connection monitoring port, don't need to know this one
435-
AUTOSSH_PORT=$SSH_MONITORING_PORT_NUMBER
456+
# Connection monitoring port, don't need to know this one
457+
AUTOSSH_PORT=$SSH_MONITORING_PORT_NUMBER
436458
437-
# Ensures that autossh keeps trying to connect
438-
AUTOSSH_GATETIME=0
439-
su -c \"autossh -f -N -R *:\${PORT_MIDDLEMAN_WILL_LISTEN_ON}:localhost:22 \${MIDDLEMAN_SERVER_AND_USERNAME} -oLogLevel=error -oUserKnownHostsFile=/dev/null -oStrictHostKeyChecking=no\" ubuntu
440-
" > reverse-tunnel
459+
# Ensures that autossh keeps trying to connect
460+
AUTOSSH_GATETIME=0
461+
su -c \"autossh -f -N -R *:\${PORT_MIDDLEMAN_WILL_LISTEN_ON}:localhost:22 \${MIDDLEMAN_SERVER_AND_USER} -oLogLevel=error -oUserKnownHostsFile=/dev/null -oStrictHostKeyChecking=no\" ubuntu
462+
" > reverse-tunnel
441463
chmod +x reverse-tunnel
442464

443-
lxc file push reverse-tunnel ${CONTAINER}/${SSH_SCRIPT_LOCATION}
444-
home/ubuntu/
445-
# ly sudo mv /home/ubuntu/reverse-tunnel $SSH_SCRIPT_LOCATION
465+
lxc file push reverse-tunnel ${CONTAINER}/${SSH_TUNNEL_LOCATION}
446466
rm reverse-tunnel
447467

448-
# echo "Making script executable"
449-
# chmod +x $SSH_SCRIPT_LOCATION
468+
echo "SSH-Tunnel wird installiert."
450469

451-
echo "SSH-Tunnel ist installiert. Wird automatisch gestartet"
452-
453-
$access_containter sudo $SSH_SCRIPT_LOCATION
470+
lxc exec $CONTAINER -- /$SSH_TUNNEL_LOCATION
471+
sleep 3
472+
fi
473+
check_tunnel
474+
if [ $? -eq 0 ] ; then
475+
echo "Revese Tunnel ist gestartet"
476+
else
477+
echo "Restart des Containers erforderlich für den Start des Reverse SSH Tunnels"
454478
fi
455479
}
456480

457481
run_ats(){
458482
# starte die IB-Software
459483
local access_container="lxc exec $CONTAINER -- sudo --login --user ubuntu -- "
460-
$access_container /home/ubuntu/ibc/${INSTANCE}start.sh -inline &
484+
$access_container /home/ubuntu/ibc/${INSTANCE}start.sh -inline &
461485
sleep 5
462486
$access_container /home/ubuntu/simple-monitor/start-simple-monitor
463487
return 0
@@ -474,15 +498,21 @@ launch_image
474498
download_ib_software
475499

476500
init_container
477-
478-
apply_ibc
479-
480-
install_simple_monitor
501+
echo " +++++++++++++++++++++++++++++++++++++++ "
502+
echo " Container ${CONTAINER} ist angelegt "
481503

482504
if [ $SETUP_AUTOSSH -eq 1 ] ; then
483505
setup_reverse_tunnel
506+
echo " Reverse Tunnel ist aufgebaut "
484507
fi
485508

486-
run_ats
509+
510+
511+
echo "Installiere IBC "
512+
apply_ibc
513+
514+
echo "Installiere simple-monitor "
515+
install_simple_monitor
516+
run_ats
487517

488518

0 commit comments

Comments
 (0)