Feature #17015

Add ability to get private keys or use existing key pairs when provisioning on EC2

Added by Ondřej Pražák 10 months ago. Updated 8 months ago.

Status:Closed
Priority:Normal
Assigned To:Shlomi Zadok
Category:Compute resources - EC2
Target version:Team Marek Iteration 7
Difficulty: Bugzilla link:1333604
Found in release: Pull request:https://github.com/theforeman/foreman/pull/4024
Story points-
Velocity based estimate-
Release1.15.0Release relationshipAuto

Description

Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=1333604
Description of problem:

After configuring AWS EC2 as a compute resource and provisioning a virtual machine, the user cannot SSH onto the virtual machine because foreman has generated an SSH key pair itself used to provision the machine.

The user should be able to view and download these keys through the Foreman web gui (as a minimum).
They should also be able to use existing pairs already configured in AWS or should be given the option to generate their own.

This entails a potential security risk as it is not obvious if a keypair is generated per virtual machine OR per compute resource.

Here is the work around to get the key to SSH to the machine:

1) Run the command hammer compute-resources list

2) Take note of the compute-resource (can vary depending on how many you have or have had, the number increments even after they have been deleted).

3) Now run su to the postgres user, CD to tmp and run the following command:

echo 'select secret from key_pairs where compute_resource_id = <Compute Resource ID>;' |  psql -d foreman  -t | sed -e 's/^[ \t]*//'| sed 's/+$//' | sed "s/[[:blank:]]*$//" > /tmp/<Key Pair Name>.pem
  • Where the Compute Resource ID and Key Pair Name have been replaced.
  • You can verify the integrity of key using this command: openssl rsa -in <Key Pair Name>
    If the key is not displayed, or it asks you for a pass phrase, there is an issue with the key.

4) You should have a pem file which can now be used to log into your EC2 machine. Depending on your AMI, try the following command:

ssh -i <Key Pair Name>.pem ec2-user@<EC2 VM Hostname or IP>

For regular RHEL AMI, the initial user is ec2-user, it may be different depending on the AMI used.

Steps to Reproduce:
1. Setup AWS Compute Resource and users, provision a VM.
2. > Try to connect to the machine via SSH, not possible without key.
3. Run work around to get key, but it should be easier!

Actual results:

Key pairs are not visible to user unless they run database queries.

Expected results:

User should be able to get their key pair easily.


Related issues

Related to Foreman - Feature #8319: ec2 compute sould be able to use existing ssh keys New 11/07/2014
Related to Foreman - Feature #17841: expose key_pair info via API Ready For Testing 12/25/2016
Related to Foreman - Bug #19631: ActiveRecord::RecordNotSaved when deleting compute resour... Closed 05/23/2017

Associated revisions

Revision 59e7136a
Added by Shlomi Zadok 8 months ago

Fixes #17015 - Adds Key pairs controller

History

#1 Updated by Ondřej Pražák 10 months ago

  • Subject changed from AWS Compute Resource Enhancement: Add ability to get private keys or use existing key pairs when provisioning on EC2 to AWS Compute Resource Enhancement: Add ability to get private keys or use existing key pairs when provisioning on EC2
  • Target version set to Team Marek backlog

#2 Updated by Ondřej Pražák 10 months ago

  • Related to Feature #8319: ec2 compute sould be able to use existing ssh keys added

#3 Updated by Dominic Cleal 10 months ago

  • Subject changed from AWS Compute Resource Enhancement: Add ability to get private keys or use existing key pairs when provisioning on EC2 to Add ability to get private keys or use existing key pairs when provisioning on EC2
  • Description updated (diff)

Very hard to read with code formatting!

#4 Updated by Shlomi Zadok 10 months ago

  • Assigned To set to Shlomi Zadok
  • Target version changed from Team Marek backlog to Team Marek Iteration 5

#5 Updated by Marek Hulán 9 months ago

  • Target version changed from Team Marek Iteration 5 to Team Marek Iteration 6

#6 Updated by The Foreman Bot 9 months ago

  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/foreman/pull/4024 added

#7 Updated by Marek Hulán 9 months ago

  • Target version changed from Team Marek Iteration 6 to Team Marek Iteration 7

#8 Updated by Ohad Levy 8 months ago

#9 Updated by Shlomi Zadok 8 months ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100

#10 Updated by Dominic Cleal 8 months ago

  • Release set to 1.15.0

#11 Updated by Dominic Cleal 3 months ago

  • Related to Bug #19631: ActiveRecord::RecordNotSaved when deleting compute resources with key pairs added

Also available in: Atom PDF