terraform

Commit Graph

Author	SHA1	Message	Date
James Bardin	bd28b996db	Merge pull request #20449 from hashicorp/jbardin/ssh-keepalive fix test that diverged between 2 merges	7 years ago
James Bardin	830a00b6b8	fix test that diverged between 2 merges	7 years ago
James Bardin	929231a2e9	Merge pull request #20437 from hashicorp/jbardin/ssh-keepalive add ssh keepalive messages to communicator	7 years ago
Sherod Taylor	c456d9608b	updated ssh authentication and testing for ssh	7 years ago
James Bardin	b5384100a6	add ssh keepalive messages to communicator Long running remote-exec commands with no output may be cutoff during execution. Enable ssh keepalives for all ssh connections.	7 years ago
James Bardin	6cac02df14	print scp error before exiting on error code See if there is any additional stderr output before exiting, since it can be helpful in addition to the error status.	7 years ago
James Bardin	f68a1a9c76	remove ssh private key contents from errors A misformatted private key may fail to parse correctly, but might still contain sensitive data. Don't display the private key in any error messages.	7 years ago
James Bardin	abfb43555a	connect communicator during Start Match the tested behavior, and that of the ssh implementation, where the communicator automatically connects when starting a command. Remove unused import from legacy dependency handling.	8 years ago
James Bardin	3c30f04e0e	fix ssh logging Ensure correct formatting and add a log level to all output.	8 years ago
James Bardin	943972cd8f	retry ssh authentication failures Most of the time an ssh authentication failure would be non-recoverable, but some host images can start the ssh service before it is properly configured, or before user authentication data is available. Log ssh authentication errors and allow the provisioner to retry until the connection timeout.	8 years ago
James Bardin	3fbdee0777	clean up remote.Cmd api Combine the ExitStatus and Err values from remote.Cmd into an error returned by Wait, better matching the behavior of the os/exec package. Non-zero exit codes are returned from Wait as a remote.ExitError. Communicator related errors are returned directly. Clean up all the error handling in the provisioners using a communicator. Also remove the extra copyOutput synchronization that was copied from package to package.	8 years ago
James Bardin	2d7dc605a0	get communicator errors from a remote.Cmd The remote.Cmd struct could not convey any transport related error to the caller, meaning that interrupted commands would show that they succeeded. Change Cmd.SetExited to accept an exit status, as well as an error to store for the caller. Make the status and error fields internal, require serialized access through the getter methods. Users of remote.Cmd should not check both Cmd.Err() and Cmd.ExitStatus() until after Wait returns. Require communicators to call Cmd.Init before executing the command. This will indicate incorrect usage of the remote.Cmd by causing a panic in SetExitStatus.	8 years ago
James Bardin	e41b29d096	Merge pull request #17354 from hashicorp/jbardin/known_hosts Verify host keys in ssh connections	8 years ago
James Bardin	c1b35ad69b	have the ssh communicator return fatal errors This will let the retry loop abort when there are errors which aren't going to ever be corrected.	8 years ago
James Bardin	bdfa97dbdb	add tests for signed host certs This checks that we can verify host certificates signed by a CA	8 years ago
James Bardin	1e7fd1c4ea	add test for host key validation This tests basic known_hosts validation for the ssh communicator.	8 years ago
James Bardin	1a68fdb4f6	add support for ssh host key checking Add `host_key` and `bastion_host_key` fields to the ssh communicator config for strict host key checking. Both fields expect the contents of an openssh formated public key. This key can either be the remote host's public key, or the public key of the CA which signed the remote host certificate. Support for signed certificates is limited, because the provisioner usually connects to a remote host by ip address rather than hostname, so the certificate would need to be signed appropriately. Connecting via a hostname needs to currently be done through a secondary provisioner, like one attached to a null_resource.	8 years ago
James Bardin	daf05e65e0	test identity file parsing	8 years ago
James Bardin	8c8847e1cf	sort ssh agent signers by requested id It's becoming more common for users to have many ssh keys loaded into an agent, and with the default max auth attempts of an openssh server at 6, one often needs to specify which id to use in order to avoid a `too many authentication failures` error. Add a connection field called `agent_identity` which will function similarly to the ssh_config IdentityFile when used in conjunction with an ssh agent. This uses `agent_identity` rather than `identity_file` to specify that the file is not used directly for authentication, rather it's used to choose which identity returned from the agent to authenticate with first. This feature tries a number of different methods to match the agent identity. First the provisioner attempts to read the id file and extract the public key. If that isn't available, we look for a .pub authorized key file. Either of these will result in a public key that can be matched directly against the agent keys. Finally we fall back to matching the comment string exactly, and the id as a suffix. The only result of using the agent_identity is the reordering of the public keys used for authentication, and if there is no exact match the client will still attempt remaining keys until there is an error.	8 years ago
Adam Shannon	c9c2823f62	communicator/ssh: add what error details we can for the user ssh.Waitmsg's String() method provides output which can include the process status, signal, and message	9 years ago
Wang Guoliang	383b0c176c	optimization:use bytes.Equal instead of bytes.Compare	9 years ago
James Bardin	e6f58f5817	Add upload tests These are skipped without the SSH_UPLOAD_TEST flag, since they require connecting to a running ssh server on localhost as the current user, and one creates a very large file.	9 years ago
James Bardin	e1f06e5d0f	Skip upload copy if we know the length If the source length is known, we can skip copying the file.	9 years ago
Mitchell Hashimoto	b486354a9c	communicator/ssh: Disconnect() should also kill the actual connection	9 years ago
Mitchell Hashimoto	4b1d9cfd7d	communicator/ssh: don't share rand object to guarantee unique values Fixes #10463 I'm really surprised this flew under the radar for years... By having unique PRNGs, the SSH communicator could and would generate identical ScriptPaths and two provisioners running in parallel could overwrite each other and execute the same script. This would happen because they're both seeded by the current time which could potentially be identical if done in parallel... Instead, we share the rand now so that the sequence is guaranteed unique. As an extra measure of robustness, we also multiple by the PID so that we're also protected against two processes at the same time.	9 years ago
James Bardin	8174037a2b	Remove deprecated key_file and bastion_key_file These were deprecated in the 0.6.x series. Their functionality was broken in a recent release which whould have removed them as well.	9 years ago
Sander van Harmelen	968472a63e	Support recreating clients and configuring Chef Vaults (#8577 ) Fixes #3605 and adds the functionality suggested in PR #7440. This PR is using a different appraoch that (IMHO) feels cleaner and (even more important) adds support for Windows at the same time.	10 years ago
Kristinn Örn Sigurðsson	bc5518f993	provisioners: Allow provisioning over IPv6	10 years ago
Paul Hinze	2f237eca44	communicator/ssh: correct test typo Copy pasta!!	10 years ago
Paul Hinze	96c20f0dd7	communicator/{ssh,winrm}: seed random script paths Without a seed, the "random" script path locations for the remote-exec provisioner were actually deterministic! Every rand.Int31() would return the same pseudorandom chain starting w/ the numbers: 1298498081, 2019727887, 1427131847, 939984059, ... So here we properly seed the communicators so the script paths are actually random, and multiple runs on a single remote host have much less chance of clobbering each other. Fixes #4186 Kudos to @DustinChaloupka for the correct hunch leading to this fix!	10 years ago
James Nugent	f2fef2556a	Fix import formatting across code base	10 years ago
Sander van Harmelen	c72342eefc	Add SSH agent support for Windows The Windows support is limited to the Pageant SSH authentication agent. This fixes #3423	10 years ago
Paul Hinze	b6aed3fec3	communicator/ssh: fix typos travis didn't catch I think rebasing and splitting got me into a weird state. This should fix the build failures on master.	10 years ago
Paul Hinze	7ffa66d1a5	ssh: accept private key contents instead of path We've been moving away from config fields expecting file paths that Terraform will load, instead prefering fields that expect file contents, leaning on `file()` to do loading from a path. This helps with consistency and also flexibility - since this makes it easier to shift sensitive files into environment variables. Here we add a little helper package to manage the transitional period for these fields where we support both behaviors. Also included is the first of several fields being shifted over - SSH private keys in provisioner connection config. We're moving to new field names so the behavior is more intuitive, so instead of `key_file` it's `private_key` now. Additional field shifts will be included in follow up PRs so they can be reviewed and discussed individually.	10 years ago
Anthony Scalisi	198e1a5186	remove various typos	11 years ago
Paul Hinze	814d05b96e	communicator/ssh: missing newline on bastion host output	11 years ago
Paul Hinze	98891aef96	Merge pull request #2684 from hashicorp/f-print-bastion-host-details communicator/ssh: print ssh bastion host details to output	11 years ago
Paul Hinze	448a6a1b48	communicator/ssh: print ssh bastion host details to output	11 years ago
Paul Hinze	138018c896	communicator/ssh: agent forward failure is not fatal On connections where no second hop is made, there's no problem if the agent forwarding connection is denied, so we shouldn't treat that as a fatal error.	11 years ago
Paul Hinze	801aaf1eec	communicator/ssh: sort agent after static keyfile In the SSH client configuration, we had SSH Agent authentication listed before the static PrivateKey loaded from the `key_file` setting. Switching the default of the `agent` setting exposed the fact that the SSH agent overrides the `key_file` during the handshake. By listing the `key_file` first, we catch the provided key before any query goes out to the agent. Adds a key-based authentication SSH test to cover this new behavior. It fails without the reordering on any machine with an SSH agent running. Fixes #2614	11 years ago
Paul Hinze	a7cbbbd258	communicator/ssh: bastion host support * adds `bastion_` fields to `connection` which add configuration for a bastion host if `bastion_host` is set, connect to that host first, then jump through it to make the SSH connection to `host` * enables SSH Agent forwarding by default	11 years ago
Paul Hinze	44de0996c5	communicator/ssh: switch agent default to true This changes SSH Agent utilization from opt-in to opt-out, bringing Terraform in line with the behavior of Packer and the `ssh` command itself. But skip SSH agent connections if the SSH_AUTH_SOCK env var doesn't exist, whcih means there's no agent to connect to.	11 years ago
Sander van Harmelen	f146a31ded	Fixing #2033 by adding a small check on the input If the input begins with a shebang, we’ll leave it as is. If not we’ll add a default shebang…	11 years ago
Sander van Harmelen	a8dacede24	Improved some logging... I added a debug log line in the last commit, only to find out it’s now logging the same info twice. So removed the double entry and tweaked the existing once.	11 years ago
Sander van Harmelen	3881c81a66	Added the exit code as well...	11 years ago
Sander van Harmelen	48f4d499f9	Fixing a small vet warning introduced by PR #1796 While fixing the vet warning also tried to improve any feedback by showing the actual output/error instead of just the error code. While testing this I noticed only adding stderr output is not enough as not all error info is send to stderr, but sometimes also to stdout.	11 years ago
Luke Amdor	fbae7884eb	remote-exec (ssh): chmod'ing right path	11 years ago
Luke Amdor	11b4060fee	remote-exec (ssh): checking chmod command	11 years ago
Sander van Harmelen	41748003c0	Updated the PR according to the review comments * We now return an error when you set the script_path to C:\Windows\Temp explaining this is currently not supported * The fix in PR #1588 is converted to the updated setup in this PR including the unit tests Last thing to do is add a few tests for the WinRM communicator…	11 years ago
Sander van Harmelen	4a29c714e5	Adding support for WinRM	11 years ago

1 2

51 Commits (efc08de5d6876af140f5a6ddb254698eb243b2fc)