mirror of
https://github.com/ovh/the-bastion.git
synced 2024-12-29 19:50:50 +08:00
78 lines
2.6 KiB
ReStructuredText
78 lines
2.6 KiB
ReStructuredText
====================
|
|
Sandbox using Docker
|
|
====================
|
|
|
|
This is a good way to test The Bastion within seconds, but :ref:`read the FAQ <faq_docker>`
|
|
if you're serious about using containerization in production.
|
|
|
|
The sandbox image is available for the following architectures: ``linux/386``, ``linux/amd64``, ``linux/arm/v6``,
|
|
``linux/arm/v7``, ``linux/arm64``, ``linux/ppc64le``, ``linux/s390x``.
|
|
|
|
- Let's run the docker image:
|
|
|
|
.. code-block:: shell
|
|
|
|
docker run -d -p 22 --name bastiontest ovhcom/the-bastion:sandbox
|
|
|
|
- Or, if you prefer building the docker image yourself, you can: use the two commands below.
|
|
Of course, if you already typed the ``docker run`` command above, you can skip the following commands:
|
|
|
|
.. code-block:: shell
|
|
|
|
docker build -f docker/Dockerfile.debian10 -t bastion:debian10 .
|
|
docker run -d -p 22 --name bastiontest bastion:debian10
|
|
|
|
- Configure the first administrator account (get your public SSH key ready)
|
|
|
|
.. code-block:: shell
|
|
|
|
docker exec -it bastiontest /opt/bastion/bin/admin/setup-first-admin-account.sh poweruser auto
|
|
|
|
- We're now up and running with the default configuration!
|
|
Let's setup a handy bastion alias, and test the ``info`` command:
|
|
|
|
.. code-block:: shell
|
|
|
|
PORT=$(docker port bastiontest | cut -d: -f2)
|
|
alias bastion="ssh poweruser@127.0.0.1 -tp $PORT -- "
|
|
bastion --osh info
|
|
|
|
- It should greet you as being a bastion admin, which means you have access to all commands.
|
|
Let's enter interactive mode:
|
|
|
|
.. code-block:: shell
|
|
|
|
bastion -i
|
|
|
|
- This is useful to call several ``--osh`` plugins in a row. Now we can ask for help to see all plugins:
|
|
|
|
.. code-block:: shell
|
|
|
|
$> help
|
|
|
|
- If you have a remote machine you want to try to connect to through the bastion, fetch your egress key:
|
|
|
|
.. code-block:: shell
|
|
|
|
$> selfListEgressKeys
|
|
|
|
- Copy this public key to the remote machine's ``authorized_keys`` under the ``.ssh/`` folder
|
|
of the account you want to connect to, then:
|
|
|
|
.. code-block:: shell
|
|
|
|
$> selfAddPersonalAccess --host <remote_host> --user <remote_account_name> --port-any
|
|
$> ssh <remote_account_name>@<remote_host>
|
|
|
|
- Note that you can connect directly without using interactive mode, with:
|
|
|
|
.. code-block:: shell
|
|
|
|
bastion <remote_account_name>@<remote_machine_host_or_ip>
|
|
|
|
That's it! You can head over to the **USAGE** section on the left menu for more information.
|
|
Be sure to check the help of the bastion with ``bastion --help``,
|
|
along with the help of each osh plugin with ``bastion --osh command --help``.
|
|
|
|
Also don't forget to customize your ``bastion.conf`` file,
|
|
which can be found in ``/etc/bastion/bastion.conf`` (for Linux).
|