Skip to content

ssh ForwardAgent #59

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
retr0h opened this issue Sep 29, 2011 · 4 comments · May be fixed by #206
Closed

ssh ForwardAgent #59

retr0h opened this issue Sep 29, 2011 · 4 comments · May be fixed by #206

Comments

@retr0h
Copy link

retr0h commented Sep 29, 2011

It appears littlechef doesn't respect ForwardAgent.

I have a chef cookbook which attempts to do a git checkout of a repository. Rather than having to generate a deploy key on the server, and adding that to github, you can enable ForwardAgent.

It seems this does not work. I can manually login to the server using ssh -A root@domain and git clone fine.
Setting ForwardAgent yes in my ~/.ssh/config doesn't have the same effect.

Any ideas?

@tobami
Copy link
Owner

tobami commented Sep 29, 2011

There is the possibility to introduce a hack in LittleChef to add ssh key forwarding, but it would be quite ugly. This needs to be solved upstream, in the fabric and paramiko libraries. There are already issues for that:
https://github.com/robey/paramiko/pull/21
fabric/fabric#72

I added a comment there so that they know we would also like to have that feature.

It seems only final testing needs to be done, so we'll keep track of the issues and when paramiko and fabric versions come out we can check it out

@retr0h
Copy link
Author

retr0h commented Sep 29, 2011

Thanks. Out of curiosity what would the hack be. The reason I ask. I have a chef-solo deployment of multiple apps, but it's integrated with vlad the deployer. I really like littlechef. However, I am blocked converting from vlad to littlechef until we can do forwarding.

I don't mind holding off on it, I just would hate to see it delayed for many months. Littlechef would actually solve a few problems I am currently facing in my existing setup.

@tobami
Copy link
Owner

tobami commented Sep 30, 2011

The hack is explained here: http://lincolnloop.com/blog/2009/sep/22/easy-fabric-deployment-part-1-gitmercurial-and-ssh/

Basically, instead of calling fabric's run command you would call:
local('ssh -A %s "%s"' % (env.host_string, mycommand))

How would you need to patch LittleChef?
The command that needs the ssh forwarding is the one that calls chef-solo (since that is the one which will do the git checkout from the cookbook). That means you would need to change this line:
https://github.com/tobami/littlechef/blob/master/littlechef/chef.py#L292

so that instead of
output = sudo('chef-solo -l {0} -j /etc/chef/node.json'.format(env.loglevel))
it becomes:

cmd = 'sudo chef-solo -l {0} -j /etc/chef/node.json'.format(env.loglevel)
output = local('ssh -A %s "%s"' % (env.host_string, cmd))

Just try it out and tell us how it goes!

@tobami
Copy link
Owner

tobami commented Mar 12, 2012

This has been fixed upstream in fabric 1.3.5/1.4.0

This means we can implement support in LittleChef by passing -A to Fabric, as documented here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants