#bastion - March 2019 | Slack Archive

bastionArchived

54 messages

Discuss cloudposse/bastion

March 2019

Apr 2019

erikover 7 years ago

@Erik Osterman (Cloud Posse) has joined the channel

erikover 7 years ago

set the channel description: Discuss cloudposse/bastion

hairyhendersonover 7 years ago

@hairyhenderson has joined the channel

hairyhendersonover 7 years ago

w00t

Erik Osterman (Cloud Posse)over 7 years ago

What’s your challenge?

hairyhendersonover 7 years ago

so I’m having a lot less trouble than I was 😉

hairyhendersonover 7 years ago

the helm chart is… rusty 😉

Erik Osterman (Cloud Posse)over 7 years ago

Haha yes

Erik Osterman (Cloud Posse)over 7 years ago

We are using teleport with our customers now

hairyhendersonover 7 years ago

oh really! 🤔

Erik Osterman (Cloud Posse)over 7 years ago

But we maybe able to address/fix problems in bastion

hairyhendersonover 7 years ago

I’d looked at that, but bastion seems so much simpler 😉

Andriy Knysh (Cloud Posse)over 7 years ago

@Andriy Knysh (Cloud Posse) has joined the channel

Erik Osterman (Cloud Posse)over 7 years ago

Yes teleport is much more complicated, but also more feature rich

Erik Osterman (Cloud Posse)over 7 years ago

Bastion is quite simple by comparison

Erik Osterman (Cloud Posse)over 7 years ago

How far did you get and what’s the current problem?

hairyhendersonover 7 years ago

sec - got pulled into a call 😬

Erik Osterman (Cloud Posse)over 7 years ago

No worries! Just post back here when you are free. I will also be jumping on a call shortly.

hairyhendersonover 7 years ago

ok so… the initial problem was I was constantly getting Connection closed by authenticating user hairyhenderson 127.0.0.1 port 49698 [preauth] errors, and I couldn’t see github-authorized-keys being called, but it turns out the commented-out env vars in the values.yaml aren’t all the default values - specifically SSH_AUTHORIZED_KEYS_COMMAND: "/usr/bin/github-authorized-keys" is super-important to uncomment 😂

hairyhendersonover 7 years ago

I’ll probably issue a PR with a bunch of updates once I’m through the learning curve 😉

Erik Osterman (Cloud Posse)over 7 years ago

Certainly - we'll get that approved quickly

Erik Osterman (Cloud Posse)over 7 years ago

ping me here, if you're blocked

Erik Osterman (Cloud Posse)over 7 years ago(edited)

the helm chart was a bit complicated as I recall due to the need for initializing a shared volume in /etc/ and running github-authorized-keys as a sidecar

erikover 7 years ago

set the channel topic: https://github.com/cloudposse/bastion

Gonzalo Peciover 7 years ago

@Gonzalo Peci has joined the channel

tamskyover 7 years ago

@tamsky has joined the channel

Anmolover 7 years ago

@Anmol has joined the channel

Juan Cruz Diazover 7 years ago

@Juan Cruz Diaz has joined the channel

Leo Starcevicover 7 years ago

@Leo Starcevic has joined the channel

Leo Starcevicover 7 years ago(edited)

Hey guys!! Awesome work with the bastion container, but I have one issue, when building the image myself it won't run, I get


Initializing ssh-audit
- Enabling SSH Audit Logs
Password: chsh: PAM: Authentication token manipulation error
FATAL: Failed to initializeInitializing ssh-audit
- Enabling SSH Audit Logs
Password: chsh: PAM: Authentication token manipulation error
FATAL: Failed to initialize

Using the image from docker hub works fine though, any idea what could be wrong?

Erik Osterman (Cloud Posse)over 7 years ago

Hrmmm... not sure off the top of my head

Erik Osterman (Cloud Posse)over 7 years ago

Seems to be passwd related which is why the chsh error is emitted

Erik Osterman (Cloud Posse)over 7 years ago

Where are you running the container?

Leo Starcevicover 7 years ago(edited)

aws, but I tried locally on my ubuntu machine as well, same error

Erik Osterman (Cloud Posse)over 7 years ago

How are you invoking it?

Erik Osterman (Cloud Posse)over 7 years ago

When you use our version, how are you referencing the image? With a release tag or latest?

Leo Starcevicover 7 years ago


docker run -p 1234:22 -d --name bastion \
     -e MFA_PROVIDER=google-authenticator \
     -v ~/.ssh/authorized_keys:/root/.ssh/authorized_keys \
     bastion

Leo Starcevicover 7 years ago

bastion is the one I built, cloudposse/bastion works fine though

Erik Osterman (Cloud Posse)over 7 years ago

Can you confirm it still works if you pin to the latest release?

Leo Starcevicover 7 years ago

what do you mean? that is the latest?!

Erik Osterman (Cloud Posse)over 7 years ago

My concern is “latest” might be stale or something... maybe Travis didn’t tag latest

Leo Starcevicover 7 years ago(edited)

ah ok, so cloudposse/bastion:0.4.4-228 ?

Erik Osterman (Cloud Posse)over 7 years ago

Though I think without the -228

Erik Osterman (Cloud Posse)over 7 years ago

It’s been a while since I looked at Travis for that project

Leo Starcevicover 7 years ago(edited)

0.4.4 from docker hub works fine as well

Erik Osterman (Cloud Posse)over 7 years ago

Ok very odd indeed

Erik Osterman (Cloud Posse)over 7 years ago

I am afk, but will test when I get to the office

Leo Starcevicover 7 years ago

could it be something gets a later version when I run the docker build today, 0.4.4 was built like a month ago

Leo Starcevicover 7 years ago

thanks, no rush! 🙂

Erik Osterman (Cloud Posse)over 7 years ago

Possibly - we try to pin most things down to a version

Erik Osterman (Cloud Posse)over 7 years ago

But not down to the package level

Mike Nockover 7 years ago

@Mike Nock has joined the channel

xluffyover 7 years ago

@xluffy has joined the channel

Tim Maloneover 7 years ago

@Tim Malone has joined the channel

No earlier messagesBrowse by date April 2019