Add support for non-root deployments #1270

adisbladis · 2020-03-29T19:18:27Z

This adds a new deployment configuration attribute (targetUser).
To inherit the username from the local user issuing the deployment
set:

deployment.targetUser = null;

Setting this to a string will deploy as that user. This option
defaults to "root".

We assume the following for non-root deploys:

Passwordless sudo (no TTY allocation possible)

I'm using the following NixOS configuration

security.pam.services.sudo.sshAgentAuth = true;
security.pam.enableSSHAgentAuth = true;

For this use-case I've introduced:

deployment.sshOptions = [ "-A" ];

The deployment user is trusted by the Nix daemon

nix.trustedUsers = [ "adisbladis" ];

This is required because of nix-copy-closure.

Closes #730

nixops/ssh_util.py

nixos-discourse · 2020-04-01T16:38:39Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/tweag-nix-dev-update/6525/1

nixops/backends/__init__.py

nix/options.nix

nixops/ssh_util.py

grahamc · 2020-04-15T18:30:45Z

I'm thinking we should make two things more configurable, and less "baked-in":

make the escalation command (currently always sudo) configurable as a list of arguments to put before the command being run
make it possible to specify additional options to SSH, so we don't need to explicitly add support for forwarded agents, or other things like GSSAPI.

adisbladis · 2020-04-16T13:01:03Z

make the escalation command (currently always sudo) configurable as a list of arguments to put before the command being run

Done! The option is in deployment.privilegeEscalationCommand (which defaults to using sudo -H).

make it possible to specify additional options to SSH, so we don't need to explicitly add support for forwarded agents, or other things like GSSAPI.

This is now called deployment.sshOptions.

nix/options.nix

grahamc · 2020-04-16T15:20:42Z

nixops/backends/__init__.py

@@ -137,6 +145,8 @@ def set_common_state(self, defn) -> None:
        if not self.has_fast_connection:
            self.ssh.enable_compression()

+        self.ssh.privilege_escalation_command_set(defn.privilege_escalation_command)


Should we put set_ first? What is more pythonic?

I don't know what's more pythonic. Personally I tend to like suffixing the operation so editor completion will suggest related operations.

The most Pythonic way would actually be not to use setters/getters at all but just mutate the attribute.

Let's leave it like this for now and reconsider in the future SSH/SSHMaster refactor you and me discussed.

chreekat

Hi! I made some comments/suggestions. None of them should be considered blockers; feel free to disregard or delay acting on them.

Thanks for chipping away at nixops!

nix/eval-machine-info.nix

nix/options.nix

grahamc · 2020-04-21T19:42:26Z

I gave this a go on a regular ol' server and it worked well. I then tried it on kif which sends some keys:

$ nixops deploy --deployment personal --include kif
building all machine configurations...
kif.........> copying closure...
personal> closures copied successfully
kif.........> uploading key ‘vault-login’...
kif.........> scp: /run/keys/.vault-login.tmp: Permission denied
kif.........> error: Traceback (most recent call last):
  File "/home/grahamc/projects/github.com/NixOS/nixops/nixops/deployment.py", line 920, in worker
    m.send_keys()
  File "/home/grahamc/projects/github.com/NixOS/nixops/nixops/backends/__init__.py", line 330, in send_keys
    self.upload_file(tmp, tmp_outfile)
  File "/home/grahamc/projects/github.com/NixOS/nixops/nixops/backends/__init__.py", line 478, in upload_file
    return self._logged_exec(cmdline)
  File "/home/grahamc/projects/github.com/NixOS/nixops/nixops/backends/__init__.py", line 413, in _logged_exec
    return nixops.util.logged_exec(command, self.logger, **kwargs)
  File "/home/grahamc/projects/github.com/NixOS/nixops/nixops/util.py", line 207, in logged_exec
    raise CommandFailed(err, res)
nixops.util.CommandFailed: command ‘['scp', '-P', '22', '-o', 'StrictHostKeyChecking=accept-new', '-i', '/run/user/1000/nixops-tmp04t91o0s/id_nixops-kif', '-oControlPath=/run/user/1000/nixops-ssh-tmp7jl7pc7v/master-socket', '/run/user/1000/nixops-tmp04t91o0s/key-kif', 'grahamc@10.5.3.16:/run/keys/.vault-login.tmp']’ failed on machine ‘kif’ (exit code 1)

I think we're going to need to go back to the drawing board a bit and plan this a bit more. In particular:

callers of run_command have the assumption they're root
upload_file does too

Leaving me with a couple questions:

Does this feature make uploading riskier by uploading files as the user and then moving them in to place via sudo?
What is the API guarantee we want to retain around run_command?

I'm sorry to drag this PR out.

This will allow us to pass options to openssh and escalate privileges (see NixOS#1270) more easily. Closes NixOS#1322

…e escalation command with --

This is so that we won't get inconsistencies between different subcommands like `nixops send-keys` (which doesn't eval) the deployment attributes. This change should be reverted at a later date when we have made these commands evaluate the configuration.

…chine Also extend `nixops mount` with full support for all SSH arguments.

cole-h

Also note that the headers aren't formatted correctly: https://github.com/NixOS/nixops/blob/a577be5eb5b82e1ef533c9348f61b3996c446988/doc/guides/deploy-without-root.rst

doc/guides/deploy-without-root.rst

Co-authored-by: Cole Helbling <cole.e.helbling@outlook.com>

adisbladis · 2020-05-05T11:35:27Z

🎉 🚀

nixos-discourse · 2020-05-11T19:21:13Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/tweag-nix-dev-update-3/7154/1

adisbladis changed the title ~~Add support for non-root deployments~~ WIP: Add support for non-root deployments Mar 29, 2020

adisbladis commented Mar 29, 2020

View reviewed changes

nixops/ssh_util.py Outdated Show resolved Hide resolved

adisbladis force-pushed the non-root-deploys branch from 3b5c6e5 to 10cc86e Compare March 29, 2020 19:26

adisbladis mentioned this pull request Mar 29, 2020

Allow nixops to use another user than root for SSHing #730

Closed

adisbladis changed the title ~~WIP: Add support for non-root deployments~~ Add support for non-root deployments Mar 29, 2020

adisbladis force-pushed the non-root-deploys branch 3 times, most recently from 7674ab1 to f14c152 Compare March 30, 2020 18:20

adisbladis force-pushed the non-root-deploys branch from 6822468 to 7196d19 Compare April 14, 2020 11:54

adisbladis mentioned this pull request Apr 15, 2020

Add SSH jump host support #1283

Merged

grahamc reviewed Apr 15, 2020

View reviewed changes

nixops/backends/__init__.py Show resolved Hide resolved

nixops/backends/__init__.py Outdated Show resolved Hide resolved

nix/options.nix Outdated Show resolved Hide resolved

nixops/ssh_util.py Outdated Show resolved Hide resolved

adisbladis force-pushed the non-root-deploys branch from 7196d19 to f91daf8 Compare April 16, 2020 12:51

grahamc reviewed Apr 16, 2020

View reviewed changes

nix/options.nix Outdated Show resolved Hide resolved

grahamc reviewed Apr 16, 2020

View reviewed changes

nix/options.nix Outdated Show resolved Hide resolved

grahamc reviewed Apr 16, 2020

View reviewed changes

adisbladis mentioned this pull request Apr 19, 2020

Make it possible to use Nixops without automatic SSH key provisioning #1247

Merged

chreekat reviewed Apr 19, 2020

View reviewed changes

nix/eval-machine-info.nix Outdated Show resolved Hide resolved

nix/options.nix Outdated Show resolved Hide resolved

nix/options.nix Outdated Show resolved Hide resolved

nix/options.nix Outdated Show resolved Hide resolved

adisbladis force-pushed the non-root-deploys branch 2 times, most recently from 6cad1f0 to 9586880 Compare April 20, 2020 07:09

grahamc added this to the 2.0 milestone Apr 20, 2020

grahamc added this to In progress in kanban Apr 23, 2020

grahamc moved this from In progress to To do in kanban Apr 23, 2020

adisbladis force-pushed the non-root-deploys branch 2 times, most recently from c94af80 to 9210af6 Compare April 23, 2020 17:47

adisbladis mentioned this pull request Apr 24, 2020

Use rsync instead of scp #1322

Closed

adisbladis added a commit to adisbladis/nixops that referenced this pull request Apr 24, 2020

Use rsync instead of scp for file copying

b626820

This will allow us to pass options to openssh and escalate privileges (see NixOS#1270) more easily. Closes NixOS#1322

adisbladis added 9 commits May 2, 2020 19:52

Add extra SSH options attribute to deployment

a4299c6

Make privilege escalation command configurable

0d9994b

targetUser option: Clarify what happens when option set to null

b025338

backends: Remove redundant ssh_user check

b230b2b

deployment.privilegeEscalationCommand: Add note about ending privileg…

7ad4abf

…e escalation command with --

ssh_util.get_target: user is non-optional, remove None check

9d458f8

script_defs: Get ssh user from machine in parse_machine

76d5396

script_defs: Get machine directly from parse_machine

f116003

adisbladis force-pushed the non-root-deploys branch from 1851d54 to e3937f9 Compare May 4, 2020 17:15

adisbladis added 2 commits May 4, 2020 19:51

script_defs: Parse path for nixops mount directly using the passed ma…

59dd268

…chine Also extend `nixops mount` with full support for all SSH arguments.

backends: Add privilege_escalation_command to state

03663db

adisbladis force-pushed the non-root-deploys branch from e3937f9 to 03663db Compare May 4, 2020 18:51

cole-h suggested changes May 4, 2020

View reviewed changes

doc/guides/deploy-without-root.rst Outdated Show resolved Hide resolved

doc/guides/deploy-without-root.rst Outdated Show resolved Hide resolved

doc/guides/deploy-without-root.rst Show resolved Hide resolved

adisbladis force-pushed the non-root-deploys branch from e862347 to c2d9d73 Compare May 4, 2020 19:33

cole-h suggested changes May 4, 2020

View reviewed changes

adisbladis force-pushed the non-root-deploys branch 2 times, most recently from f655a38 to 9f32108 Compare May 4, 2020 21:01

cole-h suggested changes May 4, 2020

View reviewed changes

doc/guides/deploy-without-root.rst Show resolved Hide resolved

doc/guides/deploy-without-root.rst Show resolved Hide resolved

doc/guides/deploy-without-root.rst Show resolved Hide resolved

adisbladis force-pushed the non-root-deploys branch from 91d19d3 to 7d9e7d2 Compare May 4, 2020 21:04

cole-h reviewed May 4, 2020

View reviewed changes

doc/guides/deploy-without-root.rst Outdated Show resolved Hide resolved

grahamc and others added 2 commits May 4, 2020 22:06

docs: non-root deployments

ed18159

Co-authored-by: Cole Helbling <cole.e.helbling@outlook.com>

nixops ssh,mount: document the interaction with targetUser

8818250

Co-authored-by: Cole Helbling <cole.e.helbling@outlook.com>

adisbladis force-pushed the non-root-deploys branch from 254b40f to 8818250 Compare May 4, 2020 21:06

grahamc merged commit d12bac6 into NixOS:master May 5, 2020

kanban automation moved this from To do to Done May 5, 2020

cprussin mentioned this pull request Feb 1, 2021

Don't generate root keypair if user ssh is used #1433

Closed

septem9er mentioned this pull request May 16, 2023

SSH ForwardAgent not working with colmena zhaofengli/colmena#154

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for non-root deployments #1270

Add support for non-root deployments #1270

adisbladis commented Mar 29, 2020 •

edited

nixos-discourse commented Apr 1, 2020

grahamc commented Apr 15, 2020

adisbladis commented Apr 16, 2020

grahamc Apr 16, 2020

adisbladis Apr 20, 2020

adisbladis Apr 20, 2020

adisbladis Apr 20, 2020

chreekat left a comment

grahamc commented Apr 21, 2020

cole-h left a comment

adisbladis commented May 5, 2020

nixos-discourse commented May 11, 2020

Add support for non-root deployments #1270

Add support for non-root deployments #1270

Conversation

adisbladis commented Mar 29, 2020 • edited

We assume the following for non-root deploys:

nixos-discourse commented Apr 1, 2020

grahamc commented Apr 15, 2020

adisbladis commented Apr 16, 2020

grahamc Apr 16, 2020

Choose a reason for hiding this comment

adisbladis Apr 20, 2020

Choose a reason for hiding this comment

adisbladis Apr 20, 2020

Choose a reason for hiding this comment

adisbladis Apr 20, 2020

Choose a reason for hiding this comment

chreekat left a comment

Choose a reason for hiding this comment

grahamc commented Apr 21, 2020

cole-h left a comment

Choose a reason for hiding this comment

adisbladis commented May 5, 2020

nixos-discourse commented May 11, 2020

adisbladis commented Mar 29, 2020 •

edited