Repository: goauthentik/authentik

Issue:
Docker Outpost integration via SSH not working
**Describe your question/**
Authentik 2022.9.0.

Am I properly configuring the remote docker outpost deployment using ssh?

I am attempting to use the automatic docker outpost deployment on a remote machine from this doc:
https://goauthentik.io/docs/outposts/integrations/docker

I reviewed the code:
https://github.com/goauthentik/authentik/blob/main/authentik/outposts/docker_ssh.py
and
https://github.com/goauthentik/authentik/blob/main/authentik/outposts/controllers/docker.py

I'm seeing it do a pre-auth on the remote server when I review the /var/log/auth.log but it never actually tries to log in with a user.

I did add the public key generated per the doc to my users authorized_keys and it has the proper permissions on the remote host.

docker url: `ssh://my_user@server.domain.com`  I also tried `ssh://my_user@server.domain.com:22`

I have tried:
1) Generating the certs per the doc and importing them into Authentik's certificates and created the outpost and  without mapping them internally. This didnt work and I didnt see the certs in /authentik/.ssh/config
2) mapping the certs to /authentik/.ssh/config. The actual generated cert files authenik, authentik.pub and certificate.pem are in the /authentik/.ssh/config directory with permissions of 700. I confirmed the files are in place by docker execing into the container.
3) since I was using my own user in the docker ssh url, I tried removing that, creating an account on the remote server with a user of 'authentik' and the proper authorized_keys and it still did not work.

I have turned on debug logging in authentik to try to capture the ssh transaction but I'm unable to see where its even trying. If I grep for my hostname, my_user, etc then nothing is found. Where would I look to further diagnose this?


**Relevant infos**
Ubuntu 20.04 all around
public key auth ssh enabled on all machines, password ssh removed.

Thanks for your time.



Discussion:
`/authentik/.ssh/config` should be an SSH config file, not a directory. This is because the SSH Client used by the python docker SDK uses paramiko, but doesn't allow you to pass anything, so authentik writes that config to point to temporary key files

(Also all of this only happens on the worker, not the server)

For the actual logging in, I don't know, I would assume it just uses SSH Port-forwarding so it won't actually open a session
thanks for pointing me to the worker. I am seeing the /authentik/.ssh/config being created on the worker and pointing towards the private key in /dev/shm so that part appears to working.

now to see if I can capture the actual ssh session with what user it's using and why it's failing.


I solved this. Its a bug.

I had to map the ssh and vi binaries into the worker container so I could actually try a interactive ssh session.
I then edited /etc/passwrd to allow the authentik user an interactive shell and did a `su - authentik` within the worker container.
I then tried to ssh into my remote server as authentik and I got this:
```authentik@5e1294b5bed3:~$ ssh host.domain.com
The authenticity of host 'host.domain.com (10.10.10.8)' can't be established.
ECDSA key fingerprint is SHA256:4arMhcMfymZflaDdE5om5cuRLVbwWqttmJONoSDO0ZI.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'host.domain.com (10.10.10.8)' (ECDSA) to the list of known hosts.
Welcome to Ubuntu 20.04.5 LTS (GNU/Linux 5.19.11-xanmod1 x86_64)
```
Once I accepted that I was let right into the server without password so the generated keys works properly to let me in.

At this point I went back to Authentik and tried the docker outpost integration, it worked and when I tried to deploy an outpost on the remote host it worked.

So Authentik needs to somehow make it so the ssh doesnt get asked to accept the remote hosts fingerprint.


Resolving patch:
diff --git a/authentik/outposts/controllers/docker.py b/authentik/outposts/controllers/docker.py
--- a/authentik/outposts/controllers/docker.py
+++ b/authentik/outposts/controllers/docker.py
@@ -61,7 +61,9 @@ def __init__(self, connection: DockerServiceConnection):
                     tls=tls_config,
                 )
             except SSHException as exc:
-                raise ServiceConnectionInvalid from exc
+                if self.ssh:
+                    self.ssh.cleanup()
+                raise ServiceConnectionInvalid(exc) from exc
         # Ensure the client actually works
         self.containers.list()
 
diff --git a/authentik/outposts/controllers/kubernetes.py b/authentik/outposts/controllers/kubernetes.py
--- a/authentik/outposts/controllers/kubernetes.py
+++ b/authentik/outposts/controllers/kubernetes.py
@@ -38,7 +38,7 @@ def __init__(self, connection: KubernetesServiceConnection):
                 load_kube_config_from_dict(connection.kubeconfig, client_configuration=config)
             super().__init__(config)
         except ConfigException as exc:
-            raise ServiceConnectionInvalid from exc
+            raise ServiceConnectionInvalid(exc) from exc
 
     def fetch_state(self) -> OutpostServiceConnectionState:
         """Get version info"""
diff --git a/authentik/outposts/docker_ssh.py b/authentik/outposts/docker_ssh.py
--- a/authentik/outposts/docker_ssh.py
+++ b/authentik/outposts/docker_ssh.py
@@ -54,6 +54,8 @@ def write_config(self, key_path: str) -> bool:
                     self.header,
                     f"Host {self.host}\n",
                     f"    IdentityFile {key_path}\n",
+                    "   StrictHostKeyChecking No\n",
+                    "   UserKnownHostsFile /dev/null\n",
                     f"{FOOTER}\n",
                     "\n",
                 ]


Test patch: