LazySSH – A jump-host SSH server that starts machines on-demand

[todsacerdoti]

https://github.com/stephank/lazyssh

[lenova]

If you're on AWS, you can create a private SSH host without needing to open any ports to the internet, using AWS Systems Manager:

- Create an EC2 instance in a private subnet, and assign the AmazonSSMManagedInstanceCore IAM role to it

- Install the AWS CLI tools on your desktop

- Add a function to your .bash_profile like this:

  function jumphost() {
  JUMP_ID=$(aws ec2 describe-instances --filter "Name=tag:Name,Values=my-jumphost-name" --query "Reservations[].Instances[].InstanceId[]")
     echo "Starting jumphost..."
     aws ec2 start-instances --instance-ids $JUMP_ID
     sleep 30
     aws ssm start-session --target $JUMP_ID
  }

Then just run "jumphost" from your terminal and boom, SSH'ed in via the magic of SSM.

Bonus points: add a cronjob to your jumphost to shutdown every X hours in case you forget ;-)

[mdaniel → lenova]

I've gotten a lot of mileage out of Sigil (https://github.com/danmx/sigil#readme ) which supports starting sessions via Name tag, instance-id, or private-dns-name in order to save one the need to use awscli in a lot of cases; it also supports the handy `sigil ls` to show the connected instances, since trying to start an SSM connection with an instance whose agent is offline produces a dumb error message with start-session

---

as an aside: `function name()` is redundant; the `function name {` syntax is a bashism, `name() {` is the posix syntax

and you may find `aws ec2 wait instance-running` handy instead of the sleep: https://docs.aws.amazon.com/cli/latest/reference/ec2/wait/in...

[markfive → lenova]

Systems Manager also supports Port Forwarding: https://aws.amazon.com/blogs/aws/new-port-forwarding-using-a...

[kosinus → lenova]

Oh, that's interesting! Didn't know AWS had that ability. Maybe then there are also some SDK functions I don't know about? I wonder why Packer doesn't go this route.

Super tiny downside to your approach: you'll be paying for storage of that instance while shut down, I guess. But that's probably peanuts.

[gtsteve → kosinus]

I was about to comment that I looked into this a while back and they thought it would be too complicated to implement... but it seems that it was actually implemented [0] earlier this year. I haven't tried it out but that seems quite promising to me.

[0] https://github.com/hashicorp/packer/pull/9082

[kosinus]

Author here, thanks for submitting!

I submitted this elsewhere myself, and added a little extra blurb, so I'll just quote it here:

> This is very much a ‘release early’ type thing. I’ve mostly been testing with it, and not yet seriously using it.

> Besides the cases mentioned in the readme, I also want to use this to automate on-demand Nix builders, because Nix only understands SSH for remote builders. Locally I run Mac, and I sometimes need to do a Nix build for Linux. Similarly at work, we have a build server that I want to do ARM builds on, so I can eventually deploy on t4g.* EC2 instances.

> Any way, hope this is useful to others.

[noinsight]

Interesting that this creates virtual machines...

I've been thinking of the same thing for a while now but I was thinking of utilizing containers instead of virtual machines.

It would be sweet to have a jump box that creates an isolated container for every user that logs in. The container could just be torn down on logoff.

[momothereal → noinsight]

I did something like this[1] for a CTF I hosted. It spins up a pod in Kubernetes with a predefined set of images based on the username. e.g. `ssh TeamCode:CHALLENGE_NAME@ssh.coop-ctf.ca` would spin up the container for that team with the image for the challenge.

Since the container could be used by multiple team members, I had an external scripts to tear down after 30min of inactivity.

[1] https://github.com/coop-ctf/ssh-gateway

[kosinus → noinsight]

This did cross my mind! Specifically, just forwarding to something other than TCP. Doesn't sound impossible if we change interfaces a little bit.

Thinking, we can make dialing the provider responsibility. I didn't want to block the goroutine there, but it could just spawn another temporary one for dialing.

Then the manager can be generic over ReadWriter, and optionally try if whatever it has is also Closer.

Beyond that, I think Docker talks gRPC?

P.S.: Note that I made this AGPL. If you planned on creating some sort of product out of this, best start fresh from the golang.org/x/crypto. Might even be simpler in the end, because I feel like a big part of lazyssh is management of resources, which in Docker is (probably) local, cheap and almost instant.

[kosinus → kosinus]

I wasn’t thinking this through. LazySSH is a jump host only right now, so the endpoint also needs to be SSH.

[nerpderp82 → kosinus]

If you run the dns, you could create endpoints based on the name

ssh foo@ubuntu20-16G-100G-8c.project-a

[kosinus → nerpderp82]

That’s the beauty of how jumphosts work, you get the input hostname verbatim. SSH leaves lookup to the server. :-)

I like this idea! I wonder how much of it is compatible with how LazySSH works right now. It’s not really on my list of things, though.

[1MachineElf]

Title should be changed to reflect that this is for _virtual_ machines:

>LazySSH is an SSH server that acts as a jump host only, and dynamically starts temporary virtual machines.

>If you find yourself briefly starting a virtual machine just to SSH into it and try something out, LazySSH is an attempt to automate that flow via just the ssh command. LazySSH starts the machine for you when you connect, and shuts it down (some time after) you disconnect.

I would love for a capability like this to be extended to physical machines. I have a dozen SuperMicro servers with IPMI interfaces, an HP server with fully licensed ILO, and a Dell server with a BMC. Being able to control when these go on/off would be very nice.

[kosinus → 1MachineElf]

It is VMs at the moment, that’s true, but perhaps only because it’s MVP functionality. If you can start/stop those from some Go code, it could work I think?

[lowleveldesign]

Some time ago I wrote sth similar for the Azure cloud, in case someone uses MS: https://github.com/lowleveldesign/azrdp.

[xaduha]

When I first read the title I thought it meant Wake-on-LAN or something.

[justinsaccount]

Reminds me a little of https://github.com/progrium/envy but for VMs instead of containers

[ngcc_hk → justinsaccount]

Interesting. Thought I remember something similar for digital ocean to start container ...

[secondcoming]

I never knew I needed this. I'll try get GCP working with it over the weekend (unless someone else gets there before me)

[kosinus → secondcoming]

That sounds great! I tried to structure and document interfaces the best I could, but I'm fairly new at Go. Hope it's all clear enough.

[secondcoming → kosinus]

Me too! no promises!

[jaequery]

Sounds like when cloud functions took a different turn

[xuki]

I used to run a dedicated vm just for this (jump host), now I just run Tailscale on all of my machines. I have nothing but good things to say about Tailscale, it just works.

[resoluteteeth → xuki]

This is a program that starts VMs on demand when you connect. I don't think that Tailscale can do that.

[renewiltord]

K8s users just launch an ssh client container with kubectl run. It's a really cool flow honestly.