You are browsing a read-only backup copy of Wikitech. The live site can be found at wikitech.wikimedia.org
Help:Accessing Cloud VPS instances: Difference between revisions
imported>Krinkle (→Set default configuration: include "*.wmflabs.org" in the bastion line, to make tools-login.wmflabs.org work) |
imported>BryanDavis (→Setup: tweak wording) |
||
(10 intermediate revisions by 8 users not shown) | |||
Line 19: | Line 19: | ||
=== Set up and upload SSH keys === | === Set up and upload SSH keys === | ||
# [[ | # [[Generate an SSH Key]] | ||
# [[Special:Preferences#mw-prefsection-openstack|Upload your public SSH key to Wikitech]] | # [[Special:Preferences#mw-prefsection-openstack|Upload your public SSH key to Wikitech]] | ||
# [https://gerrit.wikimedia.org Upload your public SSH key Gerrit] | # [https://gerrit.wikimedia.org Upload your public SSH key Gerrit] | ||
=== Be a member of a Cloud VPS project === | |||
In order to SSH into instances of a particular Cloud VPS project, you must be a member of that project. | |||
In order to SSH even into a bastion, you need to be a member of at least one project (then the <code>project-bastion</code> LDAP group will be added automatically). | |||
[[Help:Cloud VPS project#Request a new Cloud VPS project|Request a new Cloud VPS project]], or ask someone to add you to their existing project. | |||
== SSH Recommendations == | == SSH Recommendations == | ||
=== Linux or macOS === | === Linux or macOS === | ||
* Natively | * Natively support SSH. You should be able to SSH from the terminal. | ||
=== Windows 10 === | === Windows 10 === | ||
Line 35: | Line 41: | ||
*** Type into your search bar <code>services.msc</code> and open the Services program | *** Type into your search bar <code>services.msc</code> and open the Services program | ||
*** Find OpenSSH Authentication Agent and set that service to "Automatic" and start it if it is disabled. | *** Find OpenSSH Authentication Agent and set that service to "Automatic" and start it if it is disabled. | ||
=== Older versions of Windows === | === Older versions of Windows === | ||
Line 41: | Line 46: | ||
== Accessing Cloud VPS instances == | == Accessing Cloud VPS instances == | ||
=== Setup === | |||
{{Note|[[Portal:Toolforge|Toolforge]] has [[Portal:Toolforge/About_Toolforge#Bastion_hosts|its own bastions]] and does not require the below configuration.}} | |||
You'll need to proxy through a machine that is visible to the Internet and recognizes Cloud VPS (bastion) instances. | You'll need to proxy through a machine that is visible to the Internet and recognizes Cloud VPS (bastion) instances. | ||
Line 49: | Line 57: | ||
|- | |- | ||
|A member of Wikimedia SRE Team | |A member of Wikimedia SRE Team | ||
|restricted.bastion. | |<code>restricted.bastion.wmcloud.org</code> | ||
|- | |- | ||
|Everyone else ( | |Everyone else (including volunteers and Wikimedia Foundation staff) | ||
|primary.bastion. | |<code>primary.bastion.wmcloud.org</code><br/><code>bastion.wmcloud.org</code> (alias) | ||
|} | |} | ||
Configure your <code>$HOME/.ssh/config</code> file to instruct SSH to use <code>bastion.wmcloud.org</code> as a jump host when connecting to <code>*.wikimedia.cloud</code> instances: | |||
<syntaxhighlight lang="apache"> | <syntaxhighlight lang="apache"> | ||
Host | Host *.wmflabs.org *.wmcloud.org *.toolforge.org | ||
User <your-shell-name> | User <your-shell-name> | ||
Host *.wmflabs *.wikimedia.cloud | Host *.wmflabs *.wikimedia.cloud | ||
User <your-shell-name> | User <your-shell-name> | ||
ProxyJump bastion. | ProxyJump bastion.wmcloud.org:22 | ||
</syntaxhighlight> | </syntaxhighlight> | ||
With the above config you can use <code>ssh <your-instance>.<your-project>.eqiad1.wikimedia.cloud</code> to connect to an instance. | |||
<syntaxhighlight lang=" | If you can't or prefer to not alter SSH config files, you can also use the following command to specify the settings all in a longer ssh command: | ||
<syntaxhighlight lang="shell-session"> | |||
$ ssh -J <your-shell-name>@bastion.wmcloud.org <your-shell-name>@<your-instance>.<your-project>.eqiad1.wikimedia.cloud | |||
</syntaxhighlight> | </syntaxhighlight> | ||
=== Logging in === | |||
Run the following from your local computer, substituting the instance and project names as appropriate: | Run the following from your local computer, substituting the instance and project names as appropriate: | ||
ssh ''your-instance''.''your-project''.eqiad1.wikimedia.cloud | |||
==== SSH fingerprints ==== | |||
See [[Help:SSH Fingerprints]] for host key fingerprints which can be used to validate the authenticity of keys offered by hosts when attempting to connect for the first time or if the key has changed due to a full reimaging of the server. It is good practice to verify the SSH fingerprint of the bastions you use in order to reduce the likelihood of a [[:en:Man-in-the-middle_attack|MITM attack]]. | |||
== File managers == | == File managers == | ||
You can connect to your Cloud VPS instance through the bastion via SSH with a file manager. There are a number of Open Source options listed below. | You can connect to your Cloud VPS instance through the bastion via SSH with a file manager. There are a number of Open Source options listed below. | ||
''Note:''' The following options are maintained by third parties. Please see the technical documentation or ReadMe on the software's website to determine the best method of connection. | '''Note:''' The following options are maintained by third parties. Please see the technical documentation or ReadMe on the software's website to determine the best method of connection. | ||
=== Options === | === Options === | ||
Line 101: | Line 101: | ||
* Gnome: ([https://wiki.gnome.org/Apps/Files Files, formerly Nautilus]), | * Gnome: ([https://wiki.gnome.org/Apps/Files Files, formerly Nautilus]), | ||
* KDE: [https://kde.org/applications/system/org.kde.dolphin Dolphin], | * KDE: [https://kde.org/applications/system/org.kde.dolphin Dolphin], | ||
* FUSE: [https://github.com/libfuse/libfuse libfuse on | * FUSE: [https://github.com/libfuse/libfuse libfuse on GitHub] | ||
'''Mac''' | '''Mac''' | ||
Line 108: | Line 108: | ||
== Troubleshooting == | == Troubleshooting == | ||
In general, adding SSH option -v, -vv, or -vvv may help identify possible issues. | In general, adding SSH option -v, -vv, or -vvv may help identify possible issues. | ||
=== Into Bastion === | === Into Bastion === | ||
Line 116: | Line 114: | ||
# Make sure you have uploaded the correct SSH key to [[Special:Preferences#mw-prefsection-openstack|your preferences]] | # Make sure you have uploaded the correct SSH key to [[Special:Preferences#mw-prefsection-openstack|your preferences]] | ||
# Use lowercase letters for your username | # Use lowercase letters for your username | ||
# Your SSH user name is your '''instance shell account name''' name (see [[Special:Preferences|User Profile]] > Basic Information in your | # Your SSH user name is your '''instance shell account name''' name (see [[Special:Preferences|User Profile]] > Basic Information in your Wikitech account's Preferences page). It is not necessarily the same as your account's '''username''' | ||
===== Connection closed by remote host ===== | ===== Connection closed by remote host ===== |
Latest revision as of 22:02, 8 July 2022
Overview
This page explains how to gain access to Cloud VPS using SSH.
What you'll need
Required accounts
Account Type | Description | Where to sign up |
---|---|---|
Wikimedia account | Wikimedia single user login (SUL) account allows you to log into general wikis like Wikipedia, MediaWiki, and MetaWiki | Create Wikimedia account |
Wikimedia developer account | Wikimedia developer account allows you to log into Wikitech, Phabricator, Gerrit and other developer tools. | Create Wikimedia developer account |
Set up and upload SSH keys
Be a member of a Cloud VPS project
In order to SSH into instances of a particular Cloud VPS project, you must be a member of that project.
In order to SSH even into a bastion, you need to be a member of at least one project (then the project-bastion
LDAP group will be added automatically).
Request a new Cloud VPS project, or ask someone to add you to their existing project.
SSH Recommendations
Linux or macOS
- Natively support SSH. You should be able to SSH from the terminal.
Windows 10
- Windows 10 (Spring 2018 Creators update or higher) has a built in SSH client.
- If the OpenSSH client is not already enabled, you can do this by following
Settings
->Apps & features
->Optional features
->Add a feature
. Scroll down and enable the SSH Client. - Access the SSH client via Windows Powershell using the
ssh
directive. - To use an SSH agent, you will need to enable it.
- Type into your search bar
services.msc
and open the Services program - Find OpenSSH Authentication Agent and set that service to "Automatic" and start it if it is disabled.
- Type into your search bar
- If the OpenSSH client is not already enabled, you can do this by following
Older versions of Windows
It is recommended that you run the most current version of Windows. However, if you choose to run an older version, you will need an SSH client. PuTTY / KiTTY is often recommended.
Accessing Cloud VPS instances
Setup
![]() | Toolforge has its own bastions and does not require the below configuration. |
You'll need to proxy through a machine that is visible to the Internet and recognizes Cloud VPS (bastion) instances.
Your role | Use |
---|---|
A member of Wikimedia SRE Team | restricted.bastion.wmcloud.org
|
Everyone else (including volunteers and Wikimedia Foundation staff) | primary.bastion.wmcloud.org bastion.wmcloud.org (alias)
|
Configure your $HOME/.ssh/config
file to instruct SSH to use bastion.wmcloud.org
as a jump host when connecting to *.wikimedia.cloud
instances:
Host *.wmflabs.org *.wmcloud.org *.toolforge.org
User <your-shell-name>
Host *.wmflabs *.wikimedia.cloud
User <your-shell-name>
ProxyJump bastion.wmcloud.org:22
With the above config you can use ssh <your-instance>.<your-project>.eqiad1.wikimedia.cloud
to connect to an instance.
If you can't or prefer to not alter SSH config files, you can also use the following command to specify the settings all in a longer ssh command:
$ ssh -J <your-shell-name>@bastion.wmcloud.org <your-shell-name>@<your-instance>.<your-project>.eqiad1.wikimedia.cloud
Logging in
Run the following from your local computer, substituting the instance and project names as appropriate:
ssh your-instance.your-project.eqiad1.wikimedia.cloud
SSH fingerprints
See Help:SSH Fingerprints for host key fingerprints which can be used to validate the authenticity of keys offered by hosts when attempting to connect for the first time or if the key has changed due to a full reimaging of the server. It is good practice to verify the SSH fingerprint of the bastions you use in order to reduce the likelihood of a MITM attack.
File managers
You can connect to your Cloud VPS instance through the bastion via SSH with a file manager. There are a number of Open Source options listed below.
Note: The following options are maintained by third parties. Please see the technical documentation or ReadMe on the software's website to determine the best method of connection.
Options
Windows
Linux
- Gnome: (Files, formerly Nautilus),
- KDE: Dolphin,
- FUSE: libfuse on GitHub
Mac
Troubleshooting
In general, adding SSH option -v, -vv, or -vvv may help identify possible issues.
Into Bastion
Permission denied (publickey)
- Make sure you have uploaded the correct SSH key to your preferences
- Use lowercase letters for your username
- Your SSH user name is your instance shell account name name (see User Profile > Basic Information in your Wikitech account's Preferences page). It is not necessarily the same as your account's username
Connection closed by remote host
- Make sure you have uploaded the correct SSH key to your preferences
- If you have access to other SSH servers, can you connect to them? If not, then there may be an issue with your SSH client.
- If you use Windows, is Pageant (PuTTY authentication agent) set up with correct keys and running?
Blocking connection on OS X with no error message
If you are running OS X and your SSH connection blocks without any error message (while pinging the server works), try
unset SSH_AUTH_SOCK
, and then SSH again. This will unset the socket to ssh-agent.
Into your-instance
Permission denied (publickey)
- Make sure the instance build has completed.
- Search in the console output for “Finished puppet run”, BEGIN SSH HOST KEY FINGERPRINTS, and BEGIN SSH HOST KEY KEYS.
Communication and support
Support and administration of the WMCS resources is provided by the Wikimedia Foundation Cloud Services team and Wikimedia movement volunteers. Please reach out with questions and join the conversation:
- Chat in real time in the IRC channel #wikimedia-cloud connect, the bridged Telegram group, or the bridged Mattermost channel
- Discuss via email after you subscribed to the cloud@ mailing list