I'm trying to use the ssh agent module in jenkins to log in as me onto a remote machine... and run some lxc commands.
I don't get any errors logging in but ... depending on the commands that I run, I'm either getting different results or permission denied errors.
This pastebin will show you the output I'm getting from Jenkins
http://pastebin.com/VxPHYzf9
In example 1, i'm trying to run an lxc command but it fails.
In example 2, i run rc-status, expecting to see a list of running containers but I get something entirely different.
What I've tried so far:
When I manually ssh into the lxc host as user "johndoe" I am able to run both commands no problem.
I also have "watched" a log file on lxc that shows the ssh finger print who's logging in... and I can see that when jenkins does the build, it's logging in as "johndoe".
I've created a "jenkins" user / ssh key pair and also tried using that. I get the same results.
The last test I tried which is not shown in the pastebin is just to run "ls -lah" on the tmp folder of the lxc host where I know I have some bash files.
When i change the build to run these commands:
whoami
ssh -AtT root#10.111.11.11
ls -lah /tmp/*.sh
I get these results which again, are completely wrong:
+ whoami
jenkins
+ ssh -AtT root#10.111.11.11
********************************* ATTENTION **********************************
* Unauthorized access prohibited. Activity is logged. *
******************************************************************************
15:13:25 up 23 days, 19:33, 0 users, load average: 0.11, 0.07, 0.11
+ ls -lah /tmp/hudson3065491328414451721.sh
-rw-r--r-- 1 jenkins jenkins 52 Jun 10 11:13 /tmp/hudson3065491328414451721.sh
[ssh-agent] Stopped.
Finished: SUCCESS
I have at least 3 sh files ... and I don't know what the hudson*.sh file is.
Ultimately, I need Jenkins to be able to log into the lxc host and run a bunch of commands as a part of my build.
Any help would be appreciated.
I'm also going to try to get the build to ssh into a different machine to see if I get different results.
I figured it out.
It looks like my mistake was putting all my shell commands for the remote server on separate lines.
So for example,in the build "Execute Shell" text box i had something like this:
ssh -A root#10.1.1.1
whoami
ls -lah /tmp/*.sh
What it was doing was logging into the remote server, and then running the other two commands on my LOCAL jenkins server.
So I changed the shell commands to look like this:
ssh- A root#10.1.1.1 'ls -lah'
and now it's working.
Related
I make custom bash script to monitor ssh failed logins - which locally runs ok - on nagios server and remote hosts.
root#xxx:/usr/local/nagios/libexec# ./check_bruteforce_ssh.sh -c 20 -w 50
OK - no constant bruteforce attack
But on nagios page - shows Unable to read output
I make so changes in configs to verify form https://support.nagios.com/kb/article/nrpe-nrpe-unable-to-read-output-620.html what's going wrong and I cannot find out where is the problem.
Script runs via nrpe which run on all machine
root#test:/usr/local/nagios/libexec# ./check_nrpe -H test1
NRPE v3.2.1
When I tested script via nrpe I've got problem with
NRPE: Command 'check_bruteforce_ssh' not defined
which is defined in nrpe.cfg
command[check_bruteforce_attack]=/usr/local/nagios/libexec/check_bruteforce_attack.sh -w 20 -c 50
All permissions for user nagios is added - in sudoers etc.
Where can I find the solution or somedoby got similar problem?
You have an error in your definition.
Replace check_bruteforce_attack in nrpe.cfg with check_bruteforce_ssh and it will work ;-)
I've created a jenkins server, and I am trying to build a .net core 2.0.0 project on the server. I've been able to successfully pull from source control and store source files in the workspace. However, I'm running into an issue with running the dotnet build command. This is what I'm getting.
/usr/share/dotnet/sdk/2.0.0/Microsoft.Common.CurrentVersion.targets(4116,5):
error MSB3021: Unable to copy file
"obj/Debug/netcoreapp2.0/ubuntu.16.04-x64/Musify.pdb" to
"bin/Debug/netcoreapp2.0/ubuntu.16.04-x64/Musify.pdb". Access to the
path is denied. [/var/lib/jenkins/workspace/Musify/Musify.csproj]
now, I've given read write and execute permissions to every file and directory in /usr/share/dotnet/sdk/2.0.0/, and I've given read write and execute to every file and directory in my workspace (/var/lib/jenkins/workspace/Musify). I also believe my jenkins user is part of the sudo group.
The weird thing I am experiencing, is that I am able to, as root, run dotnet build in my workspace directory (/var/lib/jenkins/workspace/Musify), and the project builds. I cannot however, get the same results under the jenkins user (who should be part of the sudo group). My question is, how can I verify that Jenkins is using the jenkins system user, and that this user has the correct permissions to run this command. I am hosting jenkins on an ubuntu 16.04 x64 server.
UPDATE:
At the command line on your jenkins host run
ps -ef | grep jenkins
the first column will give you the USERID and it should be, as you say, jenkins
Then if you can login as jenkins to the host where the jenkins server is running run the following ....
groups
this will list out the groups that jenkins is a part of
If you want to fix the dotnet build issue take following actions:
Set DOTNET_CLI_HOME environment variable on the docker to a common
path like /tmp on the container. This path is used by the dotnet
to create necessary files to build the project. Check
Dotnet build permission denied in Docker container running Jenkins
Use -o or another accessible path to create the artifacts in the desired directory. e.g. dotnet build -o /tmp/dotnet/build/
microsoftisnotthatbad.sln
Re the jenkins user problem, run whoami in the container. If you get whoami: cannot find name for user ID blahblah it means the user is not found in the passwd file. There are 2 answers under Docker Plugin for Jenkins Pipeline - No user exists for uid 1005, if item 1 did not work, try the second:
Mount the host passwd to the container.
If the jenkins user is logged using an identity provider like LDAP on the Jenkins server or the slave server your job is using, the passwd file of the host will not have the jenkins user. Check the other answer on that post.
I am having a problem keeping SSH running on the Windows Subsystem for Linux. It seems that if a shell is not open and running bash, all processes in the subsystem are killed. Is there a way to stop this?
I have tried to create a service using nssm but have not be able to get it working. Now I am attempting to start a shell and then just send it to the background but I haven't quite figured out how.
You have to keep at least one bash console open in order for background tasks to keep running: As soon as you close your last open bash console, WSL tears-down all running processes.
And, yes, we're working on improving this scenario in the future ;)
Update 2018-02-06
In recent Windows 10 Insider builds, we added the ability to keep daemons and services running in the background, even if you close all your Linux consoles!
One remaining limitation with this scenario is that you do have to manually start your services (e.g. $ sudo service ssh start in Ubuntu), though we are investigating how we might be able to allow you to configure which daemons/services auto-start when you login to your machine. Updates to follow.
To maintain WSL processes, I place this file in C:\Users\USERNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wsl.vbs
set ws=wscript.createobject("wscript.shell")
ws.run "C:\Windows\System32\bash.exe -c 'sudo /etc/rc.local'",0
In /etc/rc.local I kick off some services and finally "sleep" to keep the whole thing running:
/usr/sbin/sshd
/usr/sbin/cron
#block on this line to keep WSL running
sleep 365d
In /etc/sudoers.d I added a 'rc-local' file to allow the above commands without a sudo password prompt:
username * = (root) NOPASSWD: /etc/rc.local
username * = (root) NOPASSWD: /usr/sbin/cron
username * = (root) NOPASSWD: /usr/sbin/sshd
This worked well on 1607 but after the update to 1704 I can no longer connect to wsl via ssh.
Once you have cron running you can use 'sudo crontab -e -u username' to define cron jobs with #reboot to launch at login.
Just read through this thread earlier today and used it to get sshd running without having a wsl console open.
I am on Windows 10 Version 1803 and using Ubuntu 16.04.5 LTS in WSL.
I needed to make a few changes to get it working. Many thanks to google search and communities like this.
I modified /etc/rc.local as such:
mkdir /var/run/sshd
/usr/sbin/sshd
#/usr/sbin/cron
I needed to add the directory for sshd or I would get an error "Missing privilege separation directory /var/run/sshd
I commented out cron because I was getting similar errors and haven't had the time or need yet to fix it.
I also changed the sudoers entries a little bit in order to get them to work:
username ALL = ....
Hope this is useful to someone.
John Butler
I have downloaded the sandbox from hortonworks (Centos OS), then tried to follow the tutorial. It seems like the ambari-admin-password-reset command is not there and missing. I tried also to login with putty, the console asked me to change the password so I did.
now it seems like the command is there, but I have different passwords for the console and one for the putty for the same user.
I have tried to look for the reason why for the same user 'root' I have 2 different passwords (one for the virtual box console and one for the putty) that I can login with. I see different commands on each box. more than that when I share folder I can only see it on the virtual box console but not on the putty console) which is really frustrating.
How can I enforce that what I would see from putty would be the same as what I see from the virtual box console.
I think it somehow related to TTY but I am not sure.
EDIT:
running commands from the virtual box machine output:
grep "^passwd" /etc/nsswitch.conf
OUT: passwd: files sss
grep root /etc/passwd
OUT: rppt"x"0"0"root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin
getent passwd root
OUT: root:x:0:0:root:/root:/bin/bash
EDIT:
I think this is all about docker containers. It seems like the machine 2222 port is the ssh port for the hdp 2.5 container and not for the hosting machine.
Now I get another problem. when running
docker exec sandbox ls
it is getting stuck. any help ?
Thanks for helpers
So now I had the time to analyze the sandbox vm, and write it up for other users.
As you stated correctly in your edit of the question, its the docker container setup of the sandbox, which confuses with two separate root users:
via ssh root#127.0.0.1 -p 2222 you get into the docker container called "sandbox". This is a CentOS release 6.8 (Final), containing all the HDP services, especially the ambari service. The configuration enforces a password change at first login for the root user. Inside this VM you can also execute the ambari-admin-password-reset and set there a password for the ambari admin.
via console access you reach the docker host running a Centos 7.2, here you can login with the default root password for the VM as found in the HDP docs.
Coming to your sub-question with the hanging docker exec, it seems to be a bug in that specific docker version. If you google that, you will find issues discussing this or similar problems with docker.
So I thought that it would be a good idea to just update the host via yum update. However this turned out to be a difficult path.
yum tried to update the kernel, but complained that there is not enough space on the boot partion.
So I moved the boot partion to the root partition:
edit /etc/fsab and comment out the boot entry
unmount /boot
mv /boot
cp -a /boot.org /boot
grub2-mkconfig -o /boot/grub2/grub.cfg
grub2-install /dev/sda
reboot
After that I have found out that the docker configuration is broken and docker does not start anymore. In the logs it complained about
"Error starting daemon: error initializing graphdriver:
\"/var/lib/docker\" contains other graphdrivers: devicemapper; Please
cleanup or explicitly choose storage driver (-s )"
So I edited /etc/systemd/system/multi-user.target.wants/docker.service and changed the ExecStart setting to:
ExecStart=/usr/bin/dockerd --storage-driver=overlay
After a service docker start and a docker start sandbox. The container worked again and I could could login to the container and after a ambari-server restart everything worked again.
And now - with the new docker version 1.12.2, docker exec sandbox ls works again.
So to sum up the docker exec command has a bug in that specific version of the sandbox, but you should think twice if you want to upgrade your sandbox.
I ran into the same issue.
The HDP 2.5 sandbox runs all of its components in a docker container, but commands like docker exec -it sandbox /bin/bash or docker attach sandbox got stuck.
When I ran a simple ps aux, I found several /usr/bin/docker-proxy commands which looked like :
/usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 60000 -container-ip 172.17.0.2 -container-port 60000
They probably forward the HTTP ports of the various UIs of HDP components.
I could ssh into the container ip (here 172.17.0.2) using root/hadoop to authenticate. From there, I could use all "missing" commands like ambari-admin-password-reset.
$ ssh root#172.17.0.2
... # change password
$ ambari-admin-password-reset
NB: I am new to docker, so there's probably a better way to deal with this.
I'd like to post here the instructions for 3.0.1 here.
I followed the instructions of installing hortonworks version 3.0.1 here: https://youtu.be/5TJMudSNn9c
After running the docker container, go to your browser and enter "localhost:4200", that will take you to the in browser terminal of the container, that hosts ambari. Enter "root" for login and "hadoop" for password, change the root password, and then enter "ambari-admin-password-reset" in order to reset ambari password.
In order to be able to use sandbox-hdp.hortonworks.com, you need to add the line "127.0.0.1 sandbox-hdp.hortonworks.com" at the end of the /private/etc/hosts file on your mac.
Incorrect Pass
Then right corner click on power button >> power off drop down >> Restart >> when it boots up then press Esc key to get into recovery menu
Restart
select advance option and hit enter
Advance Option
Select Recovery mode hit enter
Select Root
Root enter
Command
mount -rw -o remount/
ls /home
change pass command
passwd username
user as yours
last step
enter pass two times by pressing enter
enter image description here
Hopefully you changed password (:
I am new to Jenkins, starting now.
I see the following errors here.
Building in workspace /var/lib/jenkins/workspace/GIF_DECODER
[GIF_DECODER] $ /bin/bash /tmp/hudson3370393570271110742.sh
/tmp/hudson3370393570271110742.sh: line 2: cd: /home/joshis1/Data/E-Drive/Blog/Ready_to_post/Ubuntu/GIF_Decoder_LINUX: Permission denied
/var/lib/jenkins/workspace/GIF_DECODER
I have given the build commands as the following. This is under execute shell.
#!/bin/bash
cd /home/joshis1/Data/E-Drive/Blog/Ready_to_post/Ubuntu/GIF_Decoder_LINUX
pwd
make clean
make everything
I am not understanding what is the issue here? Looks to be a permission year. I have jenkins in sudoers list. I don't why it looks for /var/lib/jenkins/workspace/GIF_Decoder.
I see the jenkins page under - http://:8080/job/GIF_DECODER/configure
How can I setup the hostname so that instead of localhost I have some meaningful name? Please help. Also, what is the best document/video to start with Jenkins for linux users? How to debug Jenkins issue seen? How can I instantiate a build by sending an email?
I am not understanding what is the issue here?
It's a permission error. It looks like your jenkins user does not have permissions for /home/joshis1/Data/E-Drive/Blog/Ready_to_post/Ubuntu/GIF_Decoder_LINUX
How can I setup the hostname so that instead of localhost I have some meaningful name?
Try the hostname of your server in the URL. e.g. http://myserver:8080/job/GIF_DECODER/configure
Also, what is the best document/video to start with Jenkins for linux users?
I expect that you have a basic understanding of how linux works. This is important on how to configure your jenkins and write the necessary build steps. The most basic information you will find on http://jenkins-ci.org and basic installation https://wiki.jenkins-ci.org/display/JENKINS/Installing+Jenkins
How to debug Jenkins issue seen?
That depends ...
... on the issue. If you have build problems check the console output of the job first. In addition, Jenkins writes its logfiles into the jenkins home directory.
How can I instantiate a build by sending an email?
Check out the mail commander plugin