Uploaded image for project: 'Satellite'
  1. Satellite
  2. SAT-18399

REX jobs through jump hosts are failing as ProxyCommand=none is hard coded

XMLWordPrintable

    • Moderate
    • None

      Description of problem:
      Remote Execution jobs are failing when triggered actions goes through the jump host/bastion server.

      Satellite ----> Jump Host/Bastion Server ---> Client

      Even after configuring correct ssh parameters under ~foreman-proxy/.ssh/config REX jobs fails because the ProxyCommand=none is hard coded as per https://github.com/theforeman/smart_proxy_remote_execution_ssh/pull/89

      Version-Release number of selected component (if applicable):
      Satellite 6.12+

      How reproducible:
      100%

      Steps to Reproduce:
      1. Install Satellite 6.12
      2. Register a client behind a NATed network (Ensure the only way to reach the host from Satellite is through a Jump Host)
      3. Configure Jump Host configuration as below

      1. vi ~foreman-proxy/.ssh/config
        Host bastion.example.com
        StrictHostKeyChecking no
        UserKnownHostsFile /dev/null
        IdentityFile ~foreman-proxy/.ssh/id_rsa_foreman_proxy

      Host * !bastion.example.com
      StrictHostKeyChecking no
      UserKnownHostsFile /dev/null
      IdentityFile ~foreman-proxy/.ssh/id_rsa_foreman_proxy
      ProxyJump root@bastion.example.com

      4. Ensure foreman-proxy SSH pub keys are copied to both bastion and client
      5. Execute a simple REX job which fails with below error

      ~~~
      1: Error initializing command: RuntimeError - Failed to establish connection to remote host, exit code: 255
      2: Exit status: EXCEPTION
      ~~~

      Actual results:
      REX job fails

      Expected results:
      REX job should succeed and ProxyCommand argument shouldn't be hard-coded

      Additional info:
      IMO, we need to revert this change https://github.com/theforeman/smart_proxy_remote_execution_ssh/pull/89

      and this bug https://bugzilla.redhat.com/show_bug.cgi?id=2108637 can easily be addressed by just opening a documentation to include a switch `--no-ssh` argument with the ipa-client-install command.

              rhn-support-alazik Adam Lazik
              rhn-support-nshaik Nagoor Shaik
              Peter Ondrejka Peter Ondrejka
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: