Specification for SSH-key configuration utils #142

GowthamShanmugam · 2017-02-20T16:39:25Z

tendrl-bug-id: #141

Signed-off-by: GowthamShanmugam gshanmug@redhat.com

GowthamShanmugam · 2017-02-20T16:39:44Z

@shtripat @nnDarshan @nthomas-redhat @brainfunked @r0h4n please review

brainfunked · 2017-02-21T05:50:04Z

specs/ssh_configuration.adoc

+    name: jsmith
+    generate_ssh_key: yes
+    ssh_key_bits: 2048
+    ssh_key_file: .ssh/id_rsa


The key file should be named specifically for tendrl. Don't rely on the defaults.

@brainfunked ok

brainfunked · 2017-02-21T06:36:49Z

specs/ssh_configuration.adoc

+```
+* Create a new a function is utils to find ssh daemon status and port number
+```
+- Port number is identifiable using cat /var/run/sshd.pid, run the command


Nope. systemctl show sshd.service. Grab the value of MainPID.

@brainfunked ok i will check this

brainfunked · 2017-02-21T06:37:22Z

specs/ssh_configuration.adoc

+    p.name() # to print service name
+    p.connections()
+  sample output:
+      [pconn(fd=3, family=10, type=1, laddr=('::1', 22), raddr=('::1', 54960), status='LISTEN')]


This bit is good.

@brainfunked ok

brainfunked · 2017-02-21T06:38:49Z

specs/ssh_configuration.adoc

+  sample output:
+      [pconn(fd=3, family=10, type=1, laddr=('::1', 22), raddr=('::1', 54960), status='LISTEN')]
+- Parse the output and return the port number
+- Checkout the status in output if is listen then return result like port is open


Err? Listening on the port isn't the same as the port being open. Port being open means that the firewall configuration is proper. However, that's not in the scope of this specification, so for now, just report that the service is running and listening on a specific port.

@brainfunked i understand clearly

brainfunked · 2017-02-21T06:45:08Z

specs/ssh_configuration.adoc

+   a mandatory parameter, while the user name should be optional. User name
+   should default to root.
+3. Check if the SSH daemon is running and get it's port number.
+4. Check if the SSH incoming port is open.


Not possible unless we support firewall configuration parsing. For now, we can only report on what port the sshd process listens on. Ensure that the port number and pid is returned from the method that checks for the running daemon.

@brainfunked ok

brainfunked · 2017-02-21T06:45:18Z

specs/ssh_configuration.adoc

+
+== Proposed change
+
+SSH public-key configuration have four major process:


This is not supposed to be an all-in-one method. Each of the following steps is supposed to be a separate utility method that always works locally on a specific node. Each of these methods must execute ansible in local mode. The entire workflow will need to be tied together with flows, which are not part of this specification.

@brainfunked i understand

brainfunked · 2017-02-21T06:45:52Z

specs/ssh_configuration.adoc

+
+== Implementation
+
+* Create ansible module in commons utils to generate SSH with user. If user is present


Write down each of the methods being added and their inputs and outputs.

@brainfunked ok

mkudlej · 2017-02-21T17:10:03Z

@GowthamShanmugam Do I understand it right that Tendrl will create ssh key on node with Etcd and then distribute it to storage nodes? How will be key distributed to storage nodes?

GowthamShanmugam · 2017-02-21T18:05:12Z

@mkudlej By creating new job, ssh-key is copied to particular nodes, we have to create flow and atoms for that job later. But those are out of this scope, this spec is only for utils to create and copy the ssh-keys on local node.

GowthamShanmugam · 2017-02-22T09:04:41Z

@brainfunked @shtripat @nthomas-redhat @r0h4n @nnDarshan please review

GowthamShanmugam · 2017-02-27T05:56:29Z

@shtripat @brainfunked @nnDarshan @r0h4n please review

shtripat · 2017-02-27T06:02:50Z

specs/ssh_configuration.adoc

@@ -0,0 +1,271 @@
+= SSH configuration utilities for provisioning cluster
+
+SSH public-key utilities are used to authenticate cluster nodes with


Somehow this description is not very correct I feel. This utility is more to do with helping tendrl to setup a password less ssh between the provisioning node and other cluster nodes.

@shtripat ok will change it

shtripat · 2017-02-27T17:38:01Z

specs/ssh_configuration.adoc

+    (default path is "(homedir)+/.ssh/authorized_keys")
+    path: "Alternate path to the authorized_keys file" (optional)
+```
+* Create a new a function is utils to find ssh daemon status and port number.


@shtripat i will correct it

shtripat · 2017-02-27T17:38:38Z

specs/ssh_configuration.adoc

+
+== Implementation
+
+* Create a new utility class called GenerateSSH in commons with filename generate_ssh_utils.py.


Class name could be SSHUtil may be

@shtripat all the functionality is different utility so i have named utility based on its functionality, so SSHUtil not correct i feel

shtripat · 2017-02-27T17:40:55Z

specs/ssh_configuration.adoc

+
+      return status and portnumber from this
+```
+* There is one more utility for identifying port is open or not. It will not part of this


Do we need separate classes for each functionality? Can there be one class with more generic name and have individual functions to do the job?

@shtripat this is the requirement from @brainfunked he wants all the functionality should be a different utility

shtripat · 2017-02-27T17:41:39Z

specs/ssh_configuration.adoc

+* Sanity check for flow.
+* Check SSH-key is generated successfully or not
+* Check SSH-key is copied successfully
+* Check the user is created successfully


May be manual verification of connection to nodes using ssh which doesnt ask passwd.

@shtripat done

GowthamShanmugam · 2017-02-28T05:58:50Z

@shtripat @brainfunked @r0h4n please review

nnDarshan · 2017-02-28T07:07:17Z

specs/ssh_configuration.adoc

+}
+```
+* Create a new utility class called AuthorizedKey in commons with filename authorized_key_utils.py.
+* AuthorizedKey should be initialized with username(default root) and pair of keys(mandatory).


what are the pair of keys that you have mentioned ? can you please elaborate ?

@nnDarshan as we discussed i will change the sentence

nnDarshan · 2017-02-28T07:07:21Z

specs/ssh_configuration.adoc

+* Create a new utility class called GenerateSSH in commons with filename generate_ssh_utils.py.
+* GenerateSSH should take username and exec_path path as parameter to initialize object.
+* Default user is root.
+* Create a method called __run_module in GenerateSSH class to call ansible runner with


This run module should return public key back right ? so that, it can be used by the user to write to authorized keys file ?

@nnDarshan i will return the newly generated ssh key

nnDarshan · 2017-02-28T07:10:53Z

specs/ssh_configuration.adoc

+None
+
+== Developer impact
+None


Can you please add how a developer will be using these utils, By adding some code snippets

@nnDarshan sure i will add some sample code

GowthamShanmugam · 2017-02-28T09:19:04Z

@shtripat @brainfunked @r0h4n @nnDarshan review please

nnDarshan · 2017-02-28T09:24:11Z

Looks good to me.

tendrl-bug-id: Tendrl#141 Signed-off-by: GowthamShanmugam <gshanmug@redhat.com>

r0h4n · 2017-04-28T18:17:59Z

@GowthamShanmugam please confirm all action items are implemented

GowthamShanmugam · 2017-05-02T06:29:20Z

@r0h4n all of the actions are done, it contains three major actions

generate ssh-key
copy ssh key
sshd status

All three are done https://github.com/Tendrl/commons/tree/develop/tendrl/commons/utils/ssh.

brainfunked suggested changes Feb 21, 2017

View reviewed changes

GowthamShanmugam force-pushed the ssh_config branch 4 times, most recently from 37b9280 to ccead2b Compare February 22, 2017 09:03

GowthamShanmugam force-pushed the ssh_config branch from ccead2b to 1c3e13a Compare February 23, 2017 09:18

GowthamShanmugam force-pushed the ssh_config branch from 1c3e13a to dd39da4 Compare February 27, 2017 07:25

shtripat reviewed Feb 27, 2017

View reviewed changes

GowthamShanmugam force-pushed the ssh_config branch 2 times, most recently from b9d0e96 to 61d620f Compare February 28, 2017 05:57

nnDarshan reviewed Feb 28, 2017

View reviewed changes

GowthamShanmugam force-pushed the ssh_config branch from 61d620f to 6d73d60 Compare February 28, 2017 09:16

GowthamShanmugam mentioned this pull request Mar 2, 2017

SSH-key configuration utilities Tendrl/commons#176

Merged

GowthamShanmugam force-pushed the ssh_config branch 3 times, most recently from 6a6ba28 to d5a455c Compare March 2, 2017 08:18

Specification for SSH-key configuration utils

f365a67

tendrl-bug-id: Tendrl#141 Signed-off-by: GowthamShanmugam <gshanmug@redhat.com>

GowthamShanmugam force-pushed the ssh_config branch from d5a455c to f365a67 Compare March 6, 2017 09:00

r0h4n merged commit 16a68a9 into Tendrl:spec-141-ssh-utils Jul 21, 2017


		== Proposed change

		SSH public-key configuration have four major process:


		== Implementation

		* Create ansible module in commons utils to generate SSH with user. If user is present

		@@ -0,0 +1,271 @@
		= SSH configuration utilities for provisioning cluster

		SSH public-key utilities are used to authenticate cluster nodes with


		== Implementation

		* Create a new utility class called GenerateSSH in commons with filename generate_ssh_utils.py.

Specification for SSH-key configuration utils #142

Specification for SSH-key configuration utils #142

Conversation

GowthamShanmugam commented Feb 20, 2017 • edited Loading

GowthamShanmugam commented Feb 20, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mkudlej commented Feb 21, 2017

GowthamShanmugam commented Feb 21, 2017

GowthamShanmugam commented Feb 22, 2017

GowthamShanmugam commented Feb 27, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

GowthamShanmugam Feb 28, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

GowthamShanmugam commented Feb 28, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

GowthamShanmugam commented Feb 28, 2017

nnDarshan commented Feb 28, 2017

r0h4n commented Apr 28, 2017

GowthamShanmugam commented May 2, 2017

GowthamShanmugam commented Feb 20, 2017 •

edited

Loading

GowthamShanmugam Feb 28, 2017 •

edited

Loading