{"action":"created","issue":{"url":"https://api.github.com/repos/ployground/bsdploy/issues/38","labels_url":"https://api.github.com/repos/ployground/bsdploy/issues/38/labels{/name}","comments_url":"https://api.github.com/repos/ployground/bsdploy/issues/38/comments","events_url":"https://api.github.com/repos/ployground/bsdploy/issues/38/events","html_url":"https://github.com/ployground/bsdploy/issues/38","id":44969462,"number":38,"title":"[idea] Alternative way to ssh into jails by using jexec users on the host","user":{"login":"grembo","id":5884220,"avatar_url":"https://avatars.githubusercontent.com/u/5884220?v=3","gravatar_id":"","url":"https://api.github.com/users/grembo","html_url":"https://github.com/grembo","followers_url":"https://api.github.com/users/grembo/followers","following_url":"https://api.github.com/users/grembo/following{/other_user}","gists_url":"https://api.github.com/users/grembo/gists{/gist_id}","starred_url":"https://api.github.com/users/grembo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grembo/subscriptions","organizations_url":"https://api.github.com/users/grembo/orgs","repos_url":"https://api.github.com/users/grembo/repos","events_url":"https://api.github.com/users/grembo/events{/privacy}","received_events_url":"https://api.github.com/users/grembo/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ployground/bsdploy/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2014-10-06T10:38:38Z","updated_at":"2015-03-06T11:56:38Z","closed_at":null,"body":"Instead of launching sshd on every jail, allow sshing into various jails by using jexec. One approach to accomplish this is to add dedicated users on the host system (use either user name or gecos to define jail name).\r\n\r\nE.g.\r\n - host\r\n   + jail1\r\n   + jail2\r\n   + potentiallyverylongjailname\r\n\r\n`/etc/group` on *host*:\r\n```\r\njexec:*:2000:\r\n```\r\n`/usr/local/etc/sudoers` on *host*:\r\n```\r\n%jexec  ALL=(root) NOPASSWD: /usr/sbin/jexec\r\n```\r\n\r\n`/etc/master.passwd` on *host*:\r\n```\r\njail1:*:2001:2000::0:0:jail1:/home/jexec/jail1:/usr/local/bin/jexecsh\r\njail2:*:2002:2000::0:0:jail2:/home/jexec/jail2:/usr/local/bin/jexecsh\r\npotentiallyveryl:*:2003:2000::0:0:potentiallyverylongjailname:/home/jexec/potentiallyveryl:/usr/local/bin/jexecsh\r\n```\r\n\r\nThe following shell script could be used in the example above (/usr/local/bin/jexecsh):\r\n```sh\r\n#!/bin/sh\r\n\r\nJAILNAME=\"$USER\"\r\njls -j \"$USER\" >/dev/null 2>&1 || JAILNAME=`pw usershow \"$USER\" | cut -d ':' -f 8 | sed \"s/[^a-z0-9_]//g\"`\r\n\r\nif [ \"x$JAILNAME\" != \"x$USER\" ]; then\r\n        echo \"Jail \\\"$JAILNAME\\\" not found\" 2>&1\r\n        jls -j \"$JAILNAME\" >/dev/null 2>&1 || exit 1\r\nfi\r\n\r\nexec sudo jexec -n \"$JAILNAME\" sh \"$@\"\r\n```\r\n\r\nThis takes advantage of jail names being defined in FreeBSD 10 (my.jail.name turns into my_jail_name).\r\n\r\nInstead of using name/gecos, different mechanisms could be used to determine which jail to use to execute commands, including the users home directory (pwd) or storing it in a dedicated configuration file like ```$HOME/.jexec``` or simply adding dedicated commands to ```.ssh/authorized_keys```.\r\n\r\nOne could think of other mechanisms of multiplexing jexec calls for multiple jails over a single user (or various users for accountability). The advantage of the approach above is, that is allows for a relatively natural syntax when accessing the jail from the outside:\r\n\r\n```\r\nssh jail1@host\r\nssh jail2@host\r\n```\r\n\r\nYet another approach could be playing with *Match* rules in the host's ```/etc/ssh/sshd_config```.\r\n\r\nDiscuss ;)\r\n"},"comment":{"url":"https://api.github.com/repos/ployground/bsdploy/issues/comments/77548273","html_url":"https://github.com/ployground/bsdploy/issues/38#issuecomment-77548273","issue_url":"https://api.github.com/repos/ployground/bsdploy/issues/38","id":77548273,"user":{"login":"fschulze","id":60921,"avatar_url":"https://avatars.githubusercontent.com/u/60921?v=3","gravatar_id":"","url":"https://api.github.com/users/fschulze","html_url":"https://github.com/fschulze","followers_url":"https://api.github.com/users/fschulze/followers","following_url":"https://api.github.com/users/fschulze/following{/other_user}","gists_url":"https://api.github.com/users/fschulze/gists{/gist_id}","starred_url":"https://api.github.com/users/fschulze/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fschulze/subscriptions","organizations_url":"https://api.github.com/users/fschulze/orgs","repos_url":"https://api.github.com/users/fschulze/repos","events_url":"https://api.github.com/users/fschulze/events{/privacy}","received_events_url":"https://api.github.com/users/fschulze/received_events","type":"User","site_admin":false},"created_at":"2015-03-06T11:56:38Z","updated_at":"2015-03-06T11:56:38Z","body":"It would probably be quite hard to get working with Fabric, one would have to fiddle with env.shell somehow. Not impossible, but tricky to get right.\r\nFor Ansible we have a foot in the door via execnet, but it might require some fiddling in it's innards.\r\nFor ezjail and co I just added an ``Executor`` helper in ploy 1.2.0 which can be extended accordingly."}}