Help:Accessing Cloud VPS instances

From Wikitech
Jump to navigation Jump to search

Overview

This page explains how to gain access to Cloud VPS using SSH.

What you'll need

Required accounts

Account Type Description Where to sign up
Wikimedia account Wikimedia single user login (SUL) account allows you to log into general wikis like Wikipedia, MediaWiki, and MetaWiki Create Wikimedia account
Wikimedia developer account Wikimedia developer account allows you to log into Wikitech, Phabricator, Gerrit and other developer tools. Create Wikimedia developer account

Set up and upload SSH keys

  1. Set up a public SSH key
  2. Upload your public SSH key to Wikitech
  3. Upload your public SSH key Gerrit

SSH Recommendations

Linux or Mac OS

  • Natively supports SSH. You should be able to SSH from the terminal.

Windows 10

  • Windows 10 (Spring 2018 Creators update or higher) has a built in SSH client.
    • If the OpenSSH client is not already enabled, you can do this by following Settings -> Apps & features -> Optional features -> Add a feature. Scroll down and enable the SSH Client.
    • Access the SSH client via Windows Powershell using the ssh directive.

Older versions of Windows

It is recommended that you run the most current version of Windows. However, if you choose to run an older version, you will need an SSH client. PuTTY / KiTTY is often recommended.

Accessing Cloud VPS instances

You'll need to proxy through a machine that is visible to the Internet and recognizes Cloud VPS (bastion) instances.

How should you proxy?
Your role Use
A general Cloud VPS Contributor primary.bastion.wmflabs.org
A member of Wikimedia Operations restricted.bastion.wmflabs.org

ProxyJump (recommended)

Use this directive if you are using OpenSSH version 7.3 or higher

$ ssh -J <your-shell-name>@primary.bastion.wmflabs.org <your-shell-name>@<your-instance>.<your-project>.eqiad.wmflabs

Set default configuration

To save time, you can configure the $HOME/.ssh/config file to instruct SSH to use primary.bastion.wmflabs.org as a jump host when connecting to wmflabs instances.

Host *.wmflabs
  User <your-shell-name>
  ProxyJump primary.bastion.wmflabs.org:22

Host primary.bastion.wmflabs.org
  User <your-shell-name>

ProxyCommand

Use this directive if you are using OpenSSH 7.2 or older

Host *.wmflabs
  ProxyCommand ssh -a -W %h:%p <your-shell-name>@primary.bastion.wmflabs.org
  User <your-shell-name>

Run the following from your local computer, substituting the instance and project names as appropriate:

ssh your-instance.your-project.eqiad.wmflabs

File managers

You can connect to your Cloud VPS instance through the bastion via SSH with a file manager. There are a number of Open Source options listed below.

Note:' The following options are maintained by third parties. Please see the technical documentation or ReadMe on the software's website to determine the best method of connection.

Options

Windows

Linux

Mac

Troubleshooting

In general, adding SSH option -v, -vv, or -vvv may help identify possible issues.

#when using ProxyCommand
ssh -v your-instance.your-project.eqiad.wmflabs

Into Bastion

Permission denied (publickey)
  1. Make sure you have uploaded the correct SSH key to your preferences
  2. Use lowercase letters for your username
  3. Your SSH user name is your instance shell account name name (see User Profile > Basic Information in your WikiTech account's Preferences page). It is not necessarily the same as your account's username
Connection closed by remote host
  • Make sure you have uploaded the correct SSH key to your preferences
  • If you have access to other SSH servers, can you connect to them? If not, then there may be an issue with your SSH client.
  • If you use Windows, is Pageant (PuTTY authentication agent) set up with correct keys and running?
Blocking connection on OS X with no error message

If you are running OS X and your SSH connection blocks without any error message (while pinging the server works), try unset SSH_AUTH_SOCK, and then SSH again. This will unset the socket to ssh-agent.

Into your-instance

Permission denied (publickey)
  • Make sure the instance build has completed.
  • Search in the console output for “Finished puppet run”, BEGIN SSH HOST KEY FINGERPRINTS, and BEGIN SSH HOST KEY KEYS.

Communication and support

We communicate and provide support through several primary channels. Please reach out with questions and to join the conversation.

Communicate with us
Connect Best for
Phabricator Workboard #Cloud-Services Task tracking and bug reporting
IRC Channel #wikimedia-cloud connect General discussion and support
Mailing List cloud@ Information about ongoing initiatives, general discussion and support
Announcement emails cloud-announce@ Information about critical changes (all messages mirrored to cloud@)
News wiki page News Information about major near-term plans
Blog Clouds & Unicorns Learning more details about some of our work