forked from linux/documentation
116 lines
3.8 KiB
Markdown
116 lines
3.8 KiB
Markdown
# SSH Gateways
|
|
|
|
The purpose of the ssh gateways is to give temporary access to protected networks and resources. Users are only supposed to use __ssh__ to connect to and from the gateways.
|
|
|
|
The access to the gateway is controlled by special ActiveDirectory groups. The membership of the groups are managed by the responsible of the protected network the gateway gives access to. In case of a beamline this is the beamline scientist.
|
|
|
|
Connecting to a gateway:
|
|
|
|
```bash
|
|
ssh <gateway-name>-gw
|
|
```
|
|
|
|
To avoid having to type your password to connect to the gateway you can upload your ssh public key to it. This can be done by:
|
|
|
|
```bash
|
|
ssh-copy-id <gateway-name>-gw
|
|
```
|
|
|
|
Afterwards you should be able to login to the gateway without a password.
|
|
|
|
|
|
Establishing an SSH connection through the gateway to a machine inside the protected network:
|
|
|
|
```bash
|
|
ssh -J <gateway-name>-gw <name-of-the-machine-you-want-to-connect>
|
|
```
|
|
|
|
|
|
If you need to connect/tunnel to/through specific ssh gateways frequently, you can add following configuration to your `~/.ssh/config` file. This will give you a persistent connection to the gateway that can be (re)used for multiple connections. (it the gateway requires MFS, this way you only have to authenticate once with)
|
|
|
|
```
|
|
Host GATEWAY
|
|
HostName whatever-gw.psi.ch
|
|
ControlMaster auto
|
|
ControlPath ~/.ssh/mux-%r@%h:%p
|
|
ControlPersist 8h
|
|
```
|
|
(Replace GATEWAY, and whatever-gw.psi.ch with proper values)
|
|
|
|
Afterwards you can use
|
|
|
|
```bash
|
|
ssh -J GATEWAY <your-machine>
|
|
```
|
|
|
|
to establish the connection.
|
|
|
|
!!! note
|
|
Be aware, if you are switching networks this persistent connection might get screwed up. In that case you have to find the connection via `ps -ef` and kill it with the `kill` command.
|
|
|
|
|
|
## Request Gateway Access
|
|
|
|
Access to a Gateway can be requested via Service Now with the following workflow:
|
|
|
|
Open Service Now and https://psi.service-now.com/psisp and browse to the __Request Gateway Access__ Workflow as follows:
|
|
|
|
|
|
|
|
|
|
Alternatively you can search for "Gateway" in the search field.
|
|
|
|
|
|
|
|
Afterwards specify the user and the Gateway you request access for:
|
|
|
|
|
|
Once the request is submitted the responsible person for the Gateway Access List will be informed and requested for approval. Once the Approval is given the user will be automatically added to the necessary AD group.
|
|
|
|
## Remove Gateway Access
|
|
|
|
Use the ServiceNow request: "Request Removal From Linux Group"
|
|
https://psi.service-now.com/psisp?id=psi_new_sc_cat_item&sys_id=f1a86bb71b094e90d6a82f4aab4bcb87
|
|
|
|
## Using SSH Gateways with Windows
|
|
|
|
1. Open Command Prompt
|
|
Run CMD: Press Windows Key + R, type cmd, and press Enter.
|
|
|
|
Alternatively, search for "Command Prompt" (“Eingabeaufforderung” in German) in the search bar and select it.
|
|
|
|
|
|
2. Connecting to a Gateway
|
|
|
|
```bash
|
|
ssh <username>@<gateway-name>-gw
|
|
```
|
|
|
|
3. Establish an SSH connection through the gateway to a machine inside the protected network
|
|
|
|
```bash
|
|
ssh -J <username>@<gateway-name>-gw <username>@<name-of-the-machine-you-want-to-connect>
|
|
```
|
|
|
|
### Optional: Save the Connection in a Batch File
|
|
|
|
Saving the Connection in a Batch Script let’s you re-use the command. This way you won’t have to retype it every time you use the same connection again.
|
|
|
|
Open Notepad:
|
|
|
|
- Press Windows Key + R, type `notepad`, and press `Enter`.
|
|
- Type the SSH command, for example:
|
|
```bash
|
|
ssh -J <username>@<gateway-name>-gw <username>@<name-of-the-machine-you-want-to-connect>
|
|
```
|
|
- Save the File as a Batch File: Click on File > Save As.
|
|
- Set the file name, e.g., connect-to-gateway.bat.
|
|
- Choose "Save as type": Select All Files.
|
|
- Ensure the file extension is .bat (e.g., connect-to-gateway.bat).
|
|
- Save the file in a convenient location, such as your Desktop.
|
|
|
|
|
|
Run the Batch File:
|
|
|
|
- Double-click the .bat file to execute the SSH command.
|