SSH access

Managing ssh access

yarn environment:init script automatically handles this configuration you, check https://github.com/opencrvs/documentation/blob/master/v2.0.0/setup/3.-installation/3.3-set-up-a-server-hosted-environment/4.3.1-create-a-github-environment

SSH Access is configured at inventory file (infrastructure/server-setup/inventory/<environment>.yml)

Configuration file has special section users, following options are available:

• name: OS login user name

• ssh_keys: List of public ssh keys for user, all keys are added to ~/.ssh/authorized_keys

• state: Enable or disable remote access for the user. Allowed values are:

  • present: user is allowed to login

  • absent: user account is disabled

• role:

  • operator: grant read only access to OS and full access to kubernetes cluster

  • admin: grant full access to OS and kubernetes cluster

Here is example of configuration file for user bob:

# users: Add as many users as you wish
users:
# Configuration example
- name: bob
  ssh_keys:
    - "ssh-ed25519 AAA...Q [email protected]"
    - "ssh-ed25519 AAA...Q [email protected]"
  state: present
  # Allowed states:
  # - present: user is allowed to login
  # - absent: user account is disabled

  role: admin
  # Allowed roles:
  # - operator: grant read only access to OS and full access to kubernetes cluster
  # - admin: grant full access to OS and kubernetes cluster

2FA SSH Access

Now that your servers are provisioned you can SSH in using either the IP address or the domain, plus your username as it is configured in inventory files. The first time you do so you will be required to set up 2FA for your server administrators.

You must have the Google Authenticator app on your mobile phone. You can download this from the Google Play Store or Apple App Store.

Scan the QR code to add the server as an option in Google Authenticator, then enter the 6-digit 2FA code that is generated to access the server.

For all the initial set-up questions that are asked, accept defaults by typing "y"

QR Code for Google Authenticator

Accept defaults

You will also notice that root SSH access is now disabled as a security posture.

Removing SSH Access for a user

If a server administrator needs to be removed from having SSH access to a server, these are the steps you need to take:

1. In the inventory file for the server, find the user block for the user you wish to remove and set the value state to absent: [TODO: fix screenshot]

state: absent

1. Commit the updated inventory file to Git

2. Run the Provision action for the environment with just the "users" task selected. It is quicker and less intensive than selecting "all"

Running the users task updates all users on the server. If a user is marked as absent, they will be deactivated

1. Now the user will no longer have SSH access to the server

2. You can delete their block entirely from inventory files and commit the file to Git if you wish.