-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Debuggable scanner VM #51
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great addition, we need to be able to debug the scanner instances, I've got a couple of comments.
@@ -34,6 +34,7 @@ const ( | |||
JobResultsPollingInterval = "JOB_RESULT_POLLING_INTERVAL" | |||
DeleteJobPolicy = "DELETE_JOB_POLICY" | |||
ScannerContainerImage = "SCANNER_CONTAINER_IMAGE" | |||
ScannerKeyPairName = "SCANNER_KEY_PAIR_NAME" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this should be in the AWS specific configuration not the top level one
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
why? key-pair is only an AWS term?
Groups: nil, // use default for now | ||
SubnetId: &c.awsConfig.SubnetID, | ||
}, | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we can avoid this if we use the VMClarity host as a bastion:
ssh -J ubuntu@<vmclarity-server-public-ip> ubuntu@<vmclarity-scanner-private-ip>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Tested it by just attaching the key-pair to the scanner vm and open ssh port but got an error
$ ssh -i ~/Portshift/vmclarity/idan-key-pair.pem -J ubuntu@ec2-13-40-25-155.eu-west-2.compute.amazonaws.com ubuntu@10.0.0.189
Warning: Permanently added 'ec2-13-40-25-155.eu-west-2.compute.amazonaws.com' (ED25519) to the list of known hosts.
ubuntu@ec2-13-40-25-155.eu-west-2.compute.amazonaws.com: Permission denied (publickey).
kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535
TBH I don't think it is bad for debug purpose to open the scanner cli vm publicly to SSH - it is only SSH
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Was idan-key-pair.pem
the same key you used for both the VMClarity server and the debug scanner? IIRC if you need different keys then you have to use either the ssh args flag or use ~/.ssh/config to configure it.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It was the same key. I'm assuming the reason is that the connection over the private ip is not working.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ah yeah, we need to fix that, then perhaps we can drop this
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
so you want to wait with this PR?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
i think we can land this as is, and then follow up with a cleanup once we fix the private network, we've got other things we need to fix for the private network stuff too so that should be fine
No description provided.