Help:Accessing Cloud VPS instances: Difference between revisions

Browse history interactively

← Older edit Newer edit →

Content deleted Content added

VisualWikitext

Inline

Revision as of 22:45, 8 June 2022

Overview

This page explains how to gain access to Cloud VPS using SSH.

What you'll need

Required accounts

Account Type	Description	Where to sign up
Wikimedia account	Wikimedia single user login (SUL) account allows you to log into general wikis like Wikipedia, MediaWiki, and MetaWiki	Create Wikimedia account
Wikimedia developer account	Wikimedia developer account allows you to log into Wikitech, Phabricator, Gerrit and other developer tools.	Create Wikimedia developer account

Set up and upload SSH keys

Be a member of a Cloud VPS project

In order to SSH into instances of a particular Cloud VPS project, you must be a member of that project. In order to SSH even into a bastion, you need to be a member of at least one project (then the project-bastion LDAP group will be added automatically). Request a new Cloud VPS project, or ask someone to add you to their existing project.

SSH Recommendations

Linux or macOS

Natively support SSH. You should be able to SSH from the terminal.

Windows 10

Windows 10 (Spring 2018 Creators update or higher) has a built in SSH client.
- If the OpenSSH client is not already enabled, you can do this by following Settings -> Apps & features -> Optional features -> Add a feature. Scroll down and enable the SSH Client.
- Access the SSH client via Windows Powershell using the ssh directive.
- To use an SSH agent, you will need to enable it.
  - Type into your search bar services.msc and open the Services program
  - Find OpenSSH Authentication Agent and set that service to "Automatic" and start it if it is disabled.

Older versions of Windows

It is recommended that you run the most current version of Windows. However, if you choose to run an older version, you will need an SSH client. PuTTY / KiTTY is often recommended.

Accessing Cloud VPS instances

Setup

You'll need to proxy through a machine that is visible to the Internet and recognizes Cloud VPS (bastion) instances.

How should you proxy?
Your role	Use
A member of Wikimedia SRE Team	`restricted.bastion.wmcloud.org`
Everyone else (including volunteers and Wikimedia Foundation staff)	`primary.bastion.wmcloud.org` `bastion.wmcloud.org` (alias)

The Toolforge Cloud VPS project has its own bastions and does not require any proxy to access them.

The ProxyJump directive is frequently used at WMF:

$ ssh -J <your-shell-name>@bastion.wmcloud.org <your-shell-name>@<your-instance>.<your-project>.eqiad1.wikimedia.cloud

To save time, you can configure your $HOME/.ssh/config file to instruct SSH to use bastion.wmcloud.org as a jump host when connecting to wikimedia.cloud instances:

Host *.wmflabs.org *.wmcloud.org *.toolforge.org
  User <your-shell-name>

Host *.wmflabs *.wikimedia.cloud
  User <your-shell-name>
  ProxyJump bastion.wmcloud.org:22

Logging in

Run the following from your local computer, substituting the instance and project names as appropriate:

ssh your-instance.your-project.eqiad1.wikimedia.cloud

SSH fingerprints

See Help:SSH Fingerprints for host key fingerprints which can be used to validate the authenticity of keys offered by hosts when attempting to connect for the first time or if the key has changed due to a full reimaging of the server. It is good practice to verify the SSH fingerprint of the bastions you use in order to reduce the likelihood of a MITM attack.

File managers

You can connect to your Cloud VPS instance through the bastion via SSH with a file manager. There are a number of Open Source options listed below.

Note: The following options are maintained by third parties. Please see the technical documentation or ReadMe on the software's website to determine the best method of connection.

Options

Windows

PuTTY

Linux

Mac

SSHFS

Troubleshooting

In general, adding SSH option -v, -vv, or -vvv may help identify possible issues.

Into Bastion

Permission denied (publickey)

Make sure you have uploaded the correct SSH key to your preferences
Use lowercase letters for your username
Your SSH user name is your instance shell account name name (see User Profile > Basic Information in your Wikitech account's Preferences page). It is not necessarily the same as your account's username

Connection closed by remote host

Make sure you have uploaded the correct SSH key to your preferences
If you have access to other SSH servers, can you connect to them? If not, then there may be an issue with your SSH client.
If you use Windows, is Pageant (PuTTY authentication agent) set up with correct keys and running?

Blocking connection on OS X with no error message

If you are running OS X and your SSH connection blocks without any error message (while pinging the server works), try unset SSH_AUTH_SOCK, and then SSH again. This will unset the socket to ssh-agent.

Into your-instance

Permission denied (publickey)

Make sure the instance build has completed.
Search in the console output for “Finished puppet run”, BEGIN SSH HOST KEY FINGERPRINTS, and BEGIN SSH HOST KEY KEYS.

Communication and support

Support and administration of the WMCS resources is provided by the Wikimedia Foundation Cloud Services team and Wikimedia movement volunteers. Please reach out with questions and join the conversation:

Discuss and receive general support

Chat in real time in the IRC channel #wikimedia-cloud ^connect or the bridged Telegram group
Discuss via email after you have subscribed to the cloud@ mailing list

Stay aware of critical changes and plans

Subscribe to the cloud-announce@ mailing list (all messages are also mirrored to the cloud@ list)
Read the News wiki page

Track work tasks and report bugs

Use a subproject of the #Cloud-Services Phabricator project to track confirmed bug reports and feature requests about the Cloud Services infrastructure itself

Read stories and WMCS blog posts

Read the Cloud Services Blog (for the broader Wikimedia movement, see the Wikimedia Technical Blog)

@@ Line 19: / Line 19: @@
 === Set up and upload SSH keys ===
-# [[Generate_an_SSH_Key|Set up a public SSH key]]
+# [[Generate an SSH Key]]
 # [[Special:Preferences#mw-prefsection-openstack|Upload your public SSH key to Wikitech]]
 # [https://gerrit.wikimedia.org Upload your public SSH key Gerrit]