Articles I've written for customers on IT issues.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

110 lines
4.0 KiB

  1. \documentclass[11pt]{article}
  2. %Gummi|065|=)
  3. \title{\textbf{AutoSSH - a Reverse Proxy Alternative}}
  4. \usepackage{graphicx}
  5. \usepackage{caption }
  6. \author{Steak Electronics}
  7. \date{06/4/19}
  8. \begin{document}
  9. %\maketitle
  10. \textbf{AutoSSH - a Reverse Proxy Alternative}
  11. \vspace{0.2in}
  12. This document is best read printed out on paper.
  13. %\textbf{Todo}
  14. \section{Overview}
  15. I recently added another apache server to an existing infrastructure, and I wanted it to be accessible under a similar IP as another server. Due to the complexity of the website, it was not possible to simply do a reverse proxy without knowing the correct settings (e.g. X-Forwarded for). Instead, AutoSSH was used.
  16. \section{Work Log}
  17. Ok, I'm going to get right to the configs that I used. You want the tool, you don't need to know all the details.
  18. \subsection{Crontab}
  19. Here is the crontab script I used. I put this in /etc/crontab, so it has root after the times. I only use /etc/crontab, as it's easier to manage.
  20. \begin{verbatim}
  21. * * * * * root pgrep autossh > /dev/null || \
  22. /usr/local/bin/autosshzm/autosshzm.sh
  23. \end{verbatim}
  24. A few notes about this. Pgrep will search for autossh. If it doesn't find it, then it will try the next command. (|| is an OR). Put the bash script wherever you want.
  25. \subsection{Bash Script}
  26. This script is obviously what the crontab calls.
  27. \begin{verbatim}
  28. #!/bin/bash
  29. logger " /usr/local/bin/autosshzm script started."
  30. #source $HOME/.bash_profile #not needed.
  31. source $HOME/.keychain/$HOSTNAME-sh
  32. logger " /usr/local/bin/autosshzm sourced."
  33. autossh -L 0.0.0.0:2:localhost:80 -f user@ipaddress sleep 31536000
  34. &> /var/log/autosshzm/autosshzm.log
  35. #autossh -M 0 -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3"
  36. -L 0.0.0.0:2:localhost:80 user@ipaddress &>
  37. /var/log/autosshzm/autosshzm.log
  38. logger "auto ssh ran"
  39. \end{verbatim}
  40. Note that the second autossh does not work, as it's missing the sleep and the -f command. \footnote{Figuring this kind of stuff out can take about an hour.} In order for this to work, you'll also need the following commands:
  41. \begin{verbatim}
  42. apt-get install keychain autossh
  43. \end{verbatim}
  44. There were some more setup steps required for keychain...
  45. From stackexchange:
  46. \begin{verbatim}
  47. 25
  48. keychain
  49. solves this in a painless way. It's in the repos for Debian/Ubuntu:
  50. sudo apt-get install keychain
  51. and perhaps for many other distros (it looks like it originated
  52. from Gentoo).
  53. This program will start an ssh-agent if none is running, and
  54. provide shell scripts that can be sourced and connect the current
  55. shell to this particular ssh-agent.
  56. For bash, with a private key named id_rsa, add the following to
  57. your .profile:
  58. keychain --nogui id_rsa
  59. This will start an ssh-agent and add the id_rsa key on the first
  60. login after reboot. If the key is passphrase-protected, it will
  61. also ask for the passphrase. No need to use unprotected keys
  62. anymore! For subsequent logins, it will recognize the agent
  63. and not ask for a passphrase again.
  64. Also, add the following as a last line of your .bashrc:
  65. . ~/.keychain/$HOSTNAME-sh
  66. This will let the shell know where to reach the SSH agent managed
  67. by keychain. Make sure that .bashrc is sourced from .profile.
  68. However, it seems that cron jobs still don't see this. As a
  69. remedy, include the line above in the crontab, just before
  70. your actual command:
  71. * * * * * . ~/.keychain/$HOSTNAME-sh; your-actual-command
  72. \end{verbatim}
  73. The only thing that I needed to do here was
  74. keychain --nogui id\_rsa
  75. The rest of it (notes about crontab) was not required.
  76. \section{What Did NOT Work}
  77. Here's some things I tried that did not work.
  78. \begin{itemize}
  79. \item https://github.com/obfusk/autossh-init - This init script, didn't do much for me. Remember, I'm stuck with systemd in Ubuntu 19.04...\footnote{The scourge of deleting software history. Keep backwards compatibility at ALL COSTS, developers.}
  80. \item Reverse proxy with Apache - As I said, my website \footnote{Some people might call it a web application. I will not.} was too complex, and I didn't want to go down that rabbit hole.
  81. \item Starting AutoSSH in rc.local. Didn't work.
  82. \end{itemize}
  83. \end{document}