-
Bug
-
Resolution: Done
-
Normal
-
6.12.1
-
2
-
False
-
-
False
-
CLOSED
-
rubygem-smart_proxy_remote_execution_ssh-0.11.3
-
500
-
Endeavour
-
-
-
Moderate
-
None
Description of problem:
Remote Execution jobs are failing when triggered actions goes through the jump host/bastion server.
Satellite ----> Jump Host/Bastion Server ---> Client
Even after configuring correct ssh parameters under ~foreman-proxy/.ssh/config REX jobs fails because the ProxyCommand=none is hard coded as per https://github.com/theforeman/smart_proxy_remote_execution_ssh/pull/89
Version-Release number of selected component (if applicable):
Satellite 6.12+
How reproducible:
100%
Steps to Reproduce:
1. Install Satellite 6.12
2. Register a client behind a NATed network (Ensure the only way to reach the host from Satellite is through a Jump Host)
3. Configure Jump Host configuration as below
- vi ~foreman-proxy/.ssh/config
Host bastion.example.com
StrictHostKeyChecking no
UserKnownHostsFile /dev/null
IdentityFile ~foreman-proxy/.ssh/id_rsa_foreman_proxy
Host * !bastion.example.com
StrictHostKeyChecking no
UserKnownHostsFile /dev/null
IdentityFile ~foreman-proxy/.ssh/id_rsa_foreman_proxy
ProxyJump root@bastion.example.com
4. Ensure foreman-proxy SSH pub keys are copied to both bastion and client
5. Execute a simple REX job which fails with below error
~~~
1: Error initializing command: RuntimeError - Failed to establish connection to remote host, exit code: 255
2: Exit status: EXCEPTION
~~~
Actual results:
REX job fails
Expected results:
REX job should succeed and ProxyCommand argument shouldn't be hard-coded
Additional info:
IMO, we need to revert this change https://github.com/theforeman/smart_proxy_remote_execution_ssh/pull/89
and this bug https://bugzilla.redhat.com/show_bug.cgi?id=2108637 can easily be addressed by just opening a documentation to include a switch `--no-ssh` argument with the ipa-client-install command.