atlassian/scp-deploy
Asked by Klemenn:

How can I use proxycommand with atlassian/scp-deploy --\> to deploy through bastion host?

ProxyCommand ssh -W %h:%p user@jumpbox.example.com


Answers:
author: Halyna Berezovska
body: Hello, [@Klemenn](/t5/user/viewprofilepage/user-id/4145215)

I am debugging now our scp-deploy pipe which is refactored to new one and trying to understand your case.

So can you specify in more detail your case, that works for you?

What precisely you want to do?

Do you want to ssh through proxy (ONE host)?

cannot see why you have two different hosts in proxy command.

Regards, Galyna

comments: author: Klemenn
body: Hi,

well, our production application servers are not opened to the outside world, at least not SSH.

To connect to application servers via SSH we must first connect to our bastion host.

So, when we do SSH deploy (scp, rsync, it doesn't really matter) our command (scp, rsync) must first connect to bastion and then to application server.

A good read for this is here (not mine) :<https://www.davidbegin.com/using-scp-to-transfer-files-to-a-private-ec2-instance-through-a-bastion-host/>


author: Halyna Berezovska
body: [@Klemenn](/t5/user/viewprofilepage/user-id/4145215) thanks for explaining the case .

I have debugged your case on our new refactored pipe, it works.

I'll notify you about official release.

I left more details (It is unlikely to provide them here) in the ticket in jira you created

<https://getsupport.atlassian.com/browse/BBS-150719>

Tell here your feedback, please.

Cheers, Galyna


author: Halyna Berezovska
body: [@Klemenn](/t5/user/viewprofilepage/user-id/4145215) hello! We have released new version scp-deploy:1.0.0, please , if it is still actual for you, try this out with :

```
- step:  name: Your step name  script:  - PROXY_COMMAND="ProxyCommand=ssh <your_user_here>@<your_ip_or_host_here> nc <final_destination> 22"  - pipe: atlassian/scp-deploy:1.0.0    variables:      LOCAL_PATH: 'your_file'      REMOTE_PATH: 'your_path'      SERVER: '<your_final_server>'      USER: 'your_user'      EXTRA_ARGS: ['-o', $PROXY_COMMAND]      DEBUG: 'true'
```

You can remove debug variable if you're sure everything is all right , so you don't need to report it to us.

Looking forward to seeing your feedback!

Cheers, Galyna


author: Alexis Peters
body: This is actually working.  
Please add this to the official documentation/README


author: Klemenn
body: pipe: atlassian/scp-deploy:0.3.13  
variables:  
USER: deployer  
SERVER: webserver  
REMOTE_PATH: '/var/www/myapp/webdir'  
LOCAL_PATH: 'build/\*'  
EXTRA_ARGS: '-v -o ProxyCommand="ssh ubuntu@bastion.example.com nc 172.31.1.2 22"'  

Should the syntax be different?

comments: author: Halyna Berezovska
body: [@Klemenn](/t5/user/viewprofilepage/user-id/4145215) hello!

If you want to run specifically scp-deploy (scp-deploy should be easier),

try

```
EXTRA_ARGS: '-v -o ProxyCommand=\"ssh ubuntu@bastion.example.com nc 172.31.1.2 22\"'
```

or

```
EXTRA_ARGS: '-o ProxyCommand="ssh user@host"'
```

or if it does not work for you,

you can actually solve your case in more simple way putting this proxy command to ssh config:

```
echo "Host webserver        Hostname www42.cyberciti.biz        ProxyCommand ssh jumphost.nixcraft.com -W %h:%p" >> /root/ssh/config
```

in pipeline OR put config file in your repo and then copy it in pipeline to the right place.  
Your step will be like:

```
- cp ssh_config ~/.ssh/config
- pipe: atlassian/scp-deploy:0.3.13
  variables:
    USER: deployer
    SERVER: webserver
    REMOTE_PATH: '/var/www/myapp/webdir'
    LOCAL_PATH: 'build/*'
```

The point is that quotes inside quotes etc. may be not recognized properly by bash itself in pipeline infrastructure inside docker container and introducing multiple quotes escaping solutions would be too hard for a user, so we can propose workarounds for such complex command as e.g. ProxyCommand.

Also, we may think about ssh config supporting .

Looking forward to hearing your feedback, if my solutions do not work for you, we may think about supporting such ProxyCommand case in config sooner and you will be able to use the pipe.

Look at the examples of ssh config file here <https://www.cyberciti.biz/faq/linux-unix-ssh-proxycommand-passing-through-one-host-gateway-server/>

Regards, Galyna


author: Halyna Berezovska
body: [@Klemenn](/t5/user/viewprofilepage/user-id/4145215) you may have problems to put ssh config, and if you have , I think we may talk about supporting custom ssh config in the pipe.


author: Klemenn
body: Hi,

yes, the problem lies in complex escaping of quotes.

As for your first proposal - escaping doesn't work properly.

As for you second proposal (ssh user@host), there is no bastion host used here, so this is not really a solution.

As for the solution of creating the ssh_config file, yes, thats ok - for actions in the pipeline. But where in the 'atlassian/scp-deploy' pipe (container actually) does this file (ssh_config) actually gets copied into the 'atlassian/scp-deploy' container? The way I see it - it doesnt.

Regards, Klemen


Tags: atl-pipelines

bitbucket-pipelines

cloud

scp