SSH Tunnel Access - python

Good Day
I work for an ISP and we basically manage all our switches and routers via the CLI from a Jumpbox.
I would like to automate some of my work on these devices by writing Python scripts, etc.
However, this Jumpbox (Linux), is quite old and the Python version is old. I cannot add Ansible, Netmiko, etc. Plus I'm not an Admin for that box so can't upgrade it.
My question is, if I set up my own Linux VM with all the required tools, how would I be able to access these routers and switches from my local Linux VM?
I tried setting up a Local/Remote/Dynamic SSH Tunnel to the Jumpbox, but I always end up on the Jumpbox SSH session itself.

You can use the jumpbox as a bastion host. Copy your public keys to both hosts (the jumpbox and the devices) and in your inventory file use the ansible_ssh_common_args option to set it up, like this:
[switches]
switch-01 ansible_host=192.168.0.1 ansible_ssh_common_args='-o ProxyCommand="ssh -W %h:%p -q user#ip-bastion"'
Note: you must be running Ansible version 2.
Best regards.

Related

PyCharm remote debugging about double SSH

Using PyCharm remote debugging is one of my favorite choices when doing deep learning jobs on Server platform. But recently I face a problem is that I have to first use SSH to login the platform then I will need another SSH to access the computing node. I may have to do this using my shell.
ssh myname#myip
ssh mynode
python myfile.py
Thus, usually when I use PyCharm. I can only do as the following:
ssh myname#myip
python myfile.py
My question is: how I can use PyCharm to double my SSH operation?
Generally, I use MobaXterm as the intermediate jump tools.
Choose Tunneling toolbar, you will get a dialog like this 1st step
Click the gear in settings box,and then edit the local port forwarding like this 2nd step
The final step, adding remote interpreter in pycharm:
3.1. Choose ssh interpreter
3.2. The host should be localhost, and port is the one mapped to your own PC. Then enter your username and follow the dialog.
Here is the figure of 3rd step

PyCharm SSH tunneling via local ssh config (~/.ssh/config)

I use ssh deployment on servers via ssh tunnels,
and each of its has specific options and port forwarding placed in ~/.ssh/config.
PyCharm uses by default its own ssh client when using SFTP deploy.
So, it doesn't work with these deployment servers.
How I could force PyCharm to use my default system ssh client or force to use options from ~/.ssh/config file.
Thanks.
PS: PyCharm version is 3.0.1
Provided PyCharm can be made to use port different than 22 (don't know that), you actually have two workarounds:
Simple workaround
Use port forwarding on localhost:
http://www.debian-administration.org/article/449/SSH_dynamic_port_forwarding_with_SOCKS
..and either use -F specific_config for each tunnel, or use -o to specify relevant options (that you normally have in ~/.ssh/config on ssh commandline) directly. Of course, you have to tell PyCharm to connect to localhost:forwarded_port.
Fancy/sophisticated workaround
Use dynamic port forwarding + tsocks, again described in:
http://www.debian-administration.org/article/449/SSH_dynamic_port_forwarding_with_SOCKS

Paramiko Script for SSH and VNC

I am trying to write a script to use when connecting remotely to various computers in my office. We also use VNC to allow us to see the user desktops. I have been trying to find a script that would allow me to do this, but I have had no luck. Right now, we use the SSH command in Terminal (we all use Macs), which looks like the following:
ssh "hostname" -L 5901:127.0.0.1:5900
This then requires RSA fingerprint and user password. Username is never requested as it is the same as the user profile on the computer. 5901 can also be 5902, 5903, etc, depending on which display port is specified in our VNC client.
I would ultimately like to created a script that would prompt for hostname and display port, assuming username and password can be stored permanently in the script. If not, we would need prompts for those as well. Is this even possible?
I while ago had a similar use case so I put together this script:
http://code.activestate.com/recipes/576810-copy-files-over-ssh-using-paramiko/
To tunnel VNC over SSH you would need to forward port 5900 for connecting to the real xorg instance, e.g. via x11vnc, or port 5901 to connect to the first virtual xorg (e.g. via vncserver), 5902 to connect to the second xorg, etc.
I am not aware of paramiko being able to forward ports but there seems to be a pure Python module that does just that https://gist.github.com/1399529

VPS setup with fabric

Is fabric suitable for a new VPS setup like Linode or SliceHost?
The setup is explained in this slicehost article
The required actions are basically:
changing root password
creating a new user and group
add the group to the list of sudoers
set hostname
generate local ssh keys and upload securely the public key
set iptables
If fabric is not the tool, is there a better tool for this?
Thanks
Fabric would work very well for these tasks. Essentially anything you do over SSH can be automated with Fabric. It also allows you to upload and download files.
You would probably generate your local keys by invoking shell commands locally; but everything else is in fabric's domain.

How to make Django's devserver public ? Is it generally possible?

I'm currently trying out the Django framework and I would share/present/show some stuff I've made to my workmate/friends. I work in Ubuntu under Win7 via VMware. So my wish/desire is to send my current pub-IP with port (e.g http://123.123.123.123:8181/django-app/) to my friends so they could test it.
the Problem is - I use django's Dev server (python /path-to-django-app/manage.py runserver $IP:$PORT).
How do I make the devserver public?
EDIT:
Oh, there's something I forgot to mention. As I sad I use VMware with Ubuntu. I have a shellscript that returns me my current int-IP 192.168.xx.xx and saves it in a environment-variable ($CUR_IP)
So, each time I want to run django's devserver I simply execute
python /path-to-django-site/manage.py runserver $CUR_IP:8080
At this way I become an http-adress (e.g.http://192.168.40.145:8080/app-name/) which I CAN USE OUTSIDE my virtual machine. I could test it on my host (win7) machine. That's actually the reason why I asked the question. I thought there's a way to use the ext-IP and make runserver usable outside too
python manage.py runserver 0.0.0.0:8181
This will run development server that should listen on all IP's on port 8181.
Note that as of Jun 17, 2011 Django development server is threaded by default (ticket #1609).
From docs:
Note that the default IP address,
127.0.0.1, is not accessible from other machines on your network. To
make your development server viewable
to other machines on the network, use
its own IP address (e.g. 192.168.2.1)
or 0.0.0.0.
Assuming you have ruby installed, you just have to get localtunnel:
gem install localtunnel
then start your python development server with:
python manage.py runserver 0.0.0.0:8000
in another shell, start localtunnel:
localtunnel -k ~/.ssh/id_rsa.pub 8000
That will output an url to access your local server.
Port 8000 is now publicly accessible from http://xxxx.localtunnel.com
That's it.
192.168.*.* is a LAN-private address -- once you've done the proper VMWare (or other VM manager) and firewall incantations to make it accessible from the LAN, it still won't be accessible from outside the LAN, i.e., from the internet at large (a good thing too, because such development servers are not designed for security and scalability).
To make some port of a machine with a LAN-private IP visible to the internet at large, you need a router with a "virtual servers" ability (many routers, even cheap ones, offer it, but it's impossible to be specific about enabling it since each brand has its own idiosyncratic way). I would also recommend dyndns or other similar service to associate a stable DNS name to your always-varying public IP (unless you're splurging for a static IP from your connectivity provider, of course, but the latter option is becoming costlier all the time).
superuser.com or serverfault.com may provide better answers and details (once you give every single little detail of your configuration in a question) since the question has nothing much to do with software development and everything to do with server administration and configuration.
I had to add this line to settings.py in order to make it work (otherwise it shows an error when accessed from another computer)
ALLOWED_HOSTS = ['*']
then ran the server with:
python manage.py runserver 0.0.0.0:9595
Also, make sure that your firewall allows communication to the chosen port (9595 in this case)
Already answered but adding npm alternate of same localtunnel
sudo npm install -g localtunnel
lt --port 8000 --subdomain yash
If you are using Virtualbox, You need to change the network setting in VB from "NAT" to "Bridged Adaptor". Then restart the linux. Now if you run sudo ifconfig you are able to see your IP address like 192.168.*.* . The last step is runserver
python manage.py runserver 192.168.*.*:8000
Cheers!
You need to configure bridged networking in VMWare and also grant access to the target port in Ubuntu firewall.
Alternatively, you can use cotunnel, Just run cotunnel in your ubuntu (in VMware) change your tunnel port in cotunnel dashboard which port you are using in local side. It gives public url and you can share the url with your friends.
Your Django server can listen to 127.0.0.1 or 0.0.0.0 (I prefer 0.0.0.0) it does not matter for cotunnel.
Might I suggest trying something like pyngrok to programmatically manage an ngrok tunnel for you? Full disclosure, I am the developer of it. Django example here, but it's as easy as installing pyngrok:
pip install pyngrok
and using it:
from pyngrok import ngrok
# <NgrokTunnel: "http://<public_sub>.ngrok.io" -> "http://localhost:8000">
http_url = ngrok.connect(8000)
No messing with ports or firewalls or IP addresses, and now you can also inspect the traffic (which is useful since what you're doing here is ongoing development, not running a prod-ready server).

Categories