PPDBastionHost < Computing/Documentation

Tags: view all tags
The PPD Linux and Windows systems are behind the RAL site firewall so for offsite access you need to either use the RAL VPN or use the PPD SSH Bastion host.

---++ Access to the PPD SSH Bastion

Accounts on the PPD SSH bastion are separate from the standard PPD linux account and need to be requested from PPDITHelpdesk@stfc.ac.uk.

The Bastion host only supports ssh key authentication not passwords so you need to send us a copy of your public key. If you want to use ssh keys to log on to the PPD Linux machines or Windows Terminal Server please set up a separate key pair for that and use ssh-agent to manage them. We will occasionally compare authorized_key files.

---+++ Creating an ssh key pair.
<pre>ssh-keygen -t rsa [-C "Comment"] [-f output_keyfile] </pre>

if you don't supply the "-f output_keyfile" this prompt you for the files to create, the default being =~/.ssh/id_rsa= and =~/.ssh/id_rsa.pub=. It will then prompt you for a passphrase to encrypt you private key, please choose a strong passphrase.

If you are logging in from a linux or OSX desktop/laptop you may be able to run ssh-add to load up your new ssh key into an "agent" that will save you having to enter the passphrase every time you log in. Instructions for using the ssh agent with PuTTY on the PPD Windows desktops can be found [[SSHPUTTY][here]].

---++ Logging onto the PPD SSH Bastion
<pre>ssh [-i private_keyfile] &lt;username&gt;@&voyager.pp.rl.ac.uk </pre>

If your ssh-keyfile is in the standard location or you are using an agent you can omit the =-i= option.

This will present you with a normal bash shell on the bastion host, from there you can ssh on to the PPD Linux systems or [[SshWindowsTerminalServer][Windows Terminal Server]]. The home area is local to the bastion host but your PPD linux home area is available under =/home/ppd/&lt;username&gt;=.

If you use =ssh-agent= a useful way of simplifying this is to add the following section to your =.ssh/config= file

<pre>Host voyager
   Hostname              voyager.pp.rl.ac.uk
   ForwardAgent          yes
   ForwardX11            yes
   ControlMaster         auto
   ControlPath           /tmp/%r@%h:%p
   ServerAliveInterval   15
   ServerAliveCountMax   3
   ProxyCommand          none
</pre>

Then create an alias such as:

<pre>alias bssh='ssh -o "ProxyCommand = ssh &lt;your-bastion-username&gt;@voyager nc %h %p 2&gt; /dev/null"'
</pre>

That will allow you to run =bssh &lt;host&gt;= to log into one of the PPD machines.

This also works with =scp= so you can also define:

<pre>alias bscp='scp -o "ProxyCommand = ssh &lt;your-bastion-username&gt;@voyager nc %h %p 2&gt; /dev/null”’
</pre>

In Windows you can achieve the same first follow the [[SSHPUTTY]] instructions to set up =pagent= and make sure you can log into both voyager and the final target from RAL without needing a passphrase.

Then open the config to log into your target machine and open the Connection -&gt; Proxy tab and set:
   * Proxy type: =Local=
   * Proxy hostname: =voyager.pp.rl.ac.uk=
   * Port: =22=
   * Telnet command, or local proxy command: =plink.exe -agent -l &lt;username&gt; %proxyhost -nc %host:%port=

Save the config as target via voyager and test, you should get a login on your target machine.

-- Main.ChrisBrew - 2013-11-09
Topic revision: r8 - 2022-07-28 - ChrisBrew