Ssh – Puppet over ssh tunnel

puppetsshssh-tunnel

Hi I am trying to use puppet client/master to set up my servers. I have everything working perfectly on local VM's and now I'm trying to set up my first external server. However I can't get the client on the external server to connect to the master; probably because the master is behind a firewall with only port 22 open. I started looking into SSH tunnels but I can't seem to get it working. Does anyone have any experience with this?

Best Answer

Your best bet is to file a ticket requesting the following firewall rule be enabled:

PuppetClients -> PuppetMaster 8140/tcp

The Client<->Master communication is already encrypted over an SSL tunnel. In order to have it go over ssh will require some configuration hackery on both clients and server that will only serve to confuse and confound anyone else that works on your environment. You're better off having off opening the firewall.

Related Solutions

SSH Tunnel – How to Configure a Shortcut for SSH Connection

As a more concrete version of Kyle's answer, what you want to put in your ~/.ssh/config file is:

host foo
  User webby
  ProxyCommand ssh a nc -w 3 %h %p

host a
  User johndoe

Then, when you run "ssh foo", SSH will attempt to SSH to johndoe@a, run netcat (nc), then perform an SSH to webby@foo through this tunnel. Magic!

Of course, in order to do this, netcat needs to be installed on the gateway server; this package is available for every major distribution and OS.

Ssh – How to get list of open SSH tunnels

You can use lsof:

$ lsof -i tcp | grep ^ssh
ssh       2211 lcipriani    3r  IPv4  20825      0t0  TCP lcipriani-laptop.local:49164->docsuite.cefla.com:22 (ESTABLISHED)
ssh       2223 lcipriani    3r  IPv4  21945      0t0  TCP lcipriani-laptop.local:34471->gd-b-21.vps.redomino.com:22 (ESTABLISHED)
ssh       2640 lcipriani    3r  IPv4  37488      0t0  TCP lcipriani-laptop.local:45693->makeda-xen1.redomino.com:22 (ESTABLISHED)
ssh       5279 lcipriani    3r  IPv4 212324      0t0  TCP lcipriani-laptop.local:56491->67.227.82.162:22 (ESTABLISHED)
ssh       5279 lcipriani    4u  IPv6 210281      0t0  TCP lcipriani-laptop:10000 (LISTEN)
ssh       5279 lcipriani    5u  IPv4 210282      0t0  TCP localhost.localdomain:10000 (LISTEN)

The last line represent a tunnel (look at the state LISTEN).

Best Answer

Related Solutions

SSH Tunnel – How to Configure a Shortcut for SSH Connection

Ssh – How to get list of open SSH tunnels

Related Topic