Accessing Autobuilders - Revision history

MichaelHalstead: Update to remove typhoon directions.

2024-11-11T20:37:25Z

Update to remove typhoon directions.

← Older revision		Revision as of 20:37, 11 November 2024
Line 12:		Line 12:
	Edit ~/.ssh/config on your local machine and add:		Edit ~/.ssh/config on your local machine and add:

	Host ~~access.yoctoproject.org~~ access-vk.yoctoproject.org		Host access-vk.yoctoproject.org
	# Make sure your username matches your account on the autobuilder		# Make sure your username matches your account on the autobuilder
	#User [username]		#User [username]
Line 21:		Line 21:
	# If your system uses 'ncat', rather than 'netcat', use these options to enable a SOCKS proxy		# If your system uses 'ncat', rather than 'netcat', use these options to enable a SOCKS proxy
	# ProxyCommand nc --proxy-type socks5 --proxy [proxyserver.address.company.com:1080] %h %p		# ProxyCommand nc --proxy-type socks5 --proxy [proxyserver.address.company.com:1080] %h %p

	# ~~Typhoon workers are on~~ a ~~private network~~. ~~Proxy through~~ the bastion.		# Valkyrie proxy through a bastion to simplify key management.
	Host -ty-.~~yocto~~.io -~~arm-.yocto.io perf~~-*.yocto.io		# SSH host keys should be verified automatically via DNS for the bastion
	ProxyJump access.yoctoproject.org		# If you don't have native IPv6 you must proxy through access-vk.yoctoproject.org.
	~~# Correct username and key repeated from above.~~		Host -vk-.yocto.io
			ProxyJump access-vk.yoctoproject.org
	#User [username]		#User [username]
	#IdentityFile /home/[username]/.ssh/id_rsa		#IdentityFile /home/[username]/.ssh/id_rsa
Line 33:		Line 34:
	# Don't bother saving hostkeys we don't check		# Don't bother saving hostkeys we don't check
	UserKnownHostsFile /dev/null		UserKnownHostsFile /dev/null

	~~# Valkyrie proxy through a bastion to simplify key management.~~
	~~# SSH host keys should be verified automatically via DNS~~
	~~# If you don't have native IPv6 you must proxy through access-vk.yoctoproject.org.~~
	~~Host -vk-.yocto.io~~
	~~ProxyJump access-vk.yoctoproject.org~~
	~~StrictHostKeyChecking no~~

	===Verify Fingerprints===		===Verify Fingerprints===
	Now actually ssh to access.yoctoproject.org and verify that the fingerprint you receive matches a fingerprint below.		Now actually ssh to access.yoctoproject.org and verify that the fingerprint you receive matches a fingerprint below.

	~~access.yocto.io~~
	~~256 SHA256:d3eQ8azExpEKfcJExpUSpgw9D7gZgVDZ6gl4Bt5r6cQ (ED25519)~~
	~~256 SHA256:jKW/rkm3+bNdtJ5CepVyHsxnbY8T78hk7lLwB0or0uA (ECDSA)~~
	~~2048 SHA256:Qpvu4aUBox4eaYTeneRx5zMjwKTsZrJnn5VS9N5w+Fo (RSA)~~

	access-vk.yoctoproject.org		access-vk.yoctoproject.org
Line 54:		Line 43:
	===Connect!===		===Connect!===
	Now that you've added access.yoctoproject.org to your known hosts you don't need to worry about fingerprints anymore. Time to connect to a builder. Run:		Now that you've added access.yoctoproject.org to your known hosts you don't need to worry about fingerprints anymore. Time to connect to a builder. Run:
	ssh ~~centos8~~-ty-1.yocto.io		ssh debian12-vk-1.yocto.io

	If all worked correctly you are now logged in. Build workers are [https://autobuilder.yoctoproject.org/typhoon/#/workers listed on the controller]. Append .yocto.io to the name to ssh.		If all worked correctly you are now logged in. Build workers are [https://autobuilder.yoctoproject.org/typhoon/#/workers listed on the controller]. Append .yocto.io to the name to ssh.

MichaelHalstead: /* Configure ssh */

2024-09-27T00:15:59Z

Configure ssh

← Older revision		Revision as of 00:15, 27 September 2024
Line 36:		Line 36:
	# Valkyrie proxy through a bastion to simplify key management.		# Valkyrie proxy through a bastion to simplify key management.
	# SSH host keys should be verified automatically via DNS		# SSH host keys should be verified automatically via DNS
	# If you don't have native IPv6 you must proxy through ~~a dual~~-~~stack worker~~.		# If you don't have native IPv6 you must proxy through access-vk.yoctoproject.org.
	Host -vk-.yocto.io		Host -vk-.yocto.io
	ProxyJump access-vk.yoctoproject.org		ProxyJump access-vk.yoctoproject.org

MichaelHalstead: /* Configure ssh */

2024-09-23T18:06:36Z

Configure ssh

← Older revision		Revision as of 18:06, 23 September 2024
Line 23:		Line 23:

	# Typhoon workers are on a private network. Proxy through the bastion.		# Typhoon workers are on a private network. Proxy through the bastion.
	Host -ty-.yocto.io -arm-.yocto.io		Host -ty-.yocto.io -arm-.yocto.io perf-*.yocto.io
	ProxyJump access.yoctoproject.org		ProxyJump access.yoctoproject.org
	# Correct username and key repeated from above.		# Correct username and key repeated from above.

MichaelHalstead at 17:11, 23 September 2024

2024-09-23T17:11:12Z

← Older revision		Revision as of 17:11, 23 September 2024
Line 35:		Line 35:

	# Valkyrie proxy through a bastion to simplify key management.		# Valkyrie proxy through a bastion to simplify key management.
			# SSH host keys should be verified automatically via DNS
	# If you don't have native IPv6 you must proxy through a dual-stack worker.		# If you don't have native IPv6 you must proxy through a dual-stack worker.
	Host -vk-.yocto.io		Host -vk-.yocto.io
Line 47:		Line 48:
	256 SHA256:jKW/rkm3+bNdtJ5CepVyHsxnbY8T78hk7lLwB0or0uA (ECDSA)		256 SHA256:jKW/rkm3+bNdtJ5CepVyHsxnbY8T78hk7lLwB0or0uA (ECDSA)
	2048 SHA256:Qpvu4aUBox4eaYTeneRx5zMjwKTsZrJnn5VS9N5w+Fo (RSA)		2048 SHA256:Qpvu4aUBox4eaYTeneRx5zMjwKTsZrJnn5VS9N5w+Fo (RSA)

			access-vk.yoctoproject.org
			ED25519 key fingerprint is SHA256:eDGzlYP3G+io9ylXmE6HMwtLMJ3eV82DveBnbM2mgJo.

	===Connect!===		===Connect!===

MichaelHalstead: /* Configure ssh */

2024-09-23T17:03:16Z

Configure ssh

← Older revision		Revision as of 17:03, 23 September 2024
Line 12:		Line 12:
	Edit ~/.ssh/config on your local machine and add:		Edit ~/.ssh/config on your local machine and add:

	~~# For Valkyrie~~		Host access.yoctoproject.org access-vk.yoctoproject.org
	~~# If you don't have native IPv6 proxy through a dual-stack worker~~
	Host ~~-vk-arm*~~.~~yocto~~.io
	~~ProxyJump debian12~~-vk~~-2.yocto.io~~

	~~Host access~~.yoctoproject.org
	# Make sure your username matches your account on the autobuilder		# Make sure your username matches your account on the autobuilder
	#User [username]		#User [username]
Line 26:		Line 21:
	# If your system uses 'ncat', rather than 'netcat', use these options to enable a SOCKS proxy		# If your system uses 'ncat', rather than 'netcat', use these options to enable a SOCKS proxy
	# ProxyCommand nc --proxy-type socks5 --proxy [proxyserver.address.company.com:1080] %h %p		# ProxyCommand nc --proxy-type socks5 --proxy [proxyserver.address.company.com:1080] %h %p

	# Typhoon workers are on a private network. Proxy through the bastion.		# Typhoon workers are on a private network. Proxy through the bastion.
	Host -ty-.yocto.io -arm-.yocto.io		Host -ty-.yocto.io -arm-.yocto.io
Line 38:		Line 33:
	# Don't bother saving hostkeys we don't check		# Don't bother saving hostkeys we don't check
	UserKnownHostsFile /dev/null		UserKnownHostsFile /dev/null

			# Valkyrie proxy through a bastion to simplify key management.
			# If you don't have native IPv6 you must proxy through a dual-stack worker.
			Host -vk-.yocto.io
			ProxyJump access-vk.yoctoproject.org
			StrictHostKeyChecking no

	===Verify Fingerprints===		===Verify Fingerprints===

MichaelHalstead: /* Configure ssh */

2024-09-23T16:45:54Z

Configure ssh

← Older revision		Revision as of 16:45, 23 September 2024
Line 11:		Line 11:
	===Configure ssh===		===Configure ssh===
	Edit ~/.ssh/config on your local machine and add:		Edit ~/.ssh/config on your local machine and add:

			# For Valkyrie
			# If you don't have native IPv6 proxy through a dual-stack worker
			Host -vk-arm*.yocto.io
			ProxyJump debian12-vk-2.yocto.io

	Host access.yoctoproject.org		Host access.yoctoproject.org
Line 22:		Line 27:
	# ProxyCommand nc --proxy-type socks5 --proxy [proxyserver.address.company.com:1080] %h %p		# ProxyCommand nc --proxy-type socks5 --proxy [proxyserver.address.company.com:1080] %h %p

	# *.yocto.io except for access is internal. Proxy through the bastion.		# Typhoon workers are on a private network. Proxy through the bastion.
	Host ~~!access~~.yocto.io *.yocto.io		Host -ty-.yocto.io -arm-.yocto.io
	ProxyJump access.yoctoproject.org		ProxyJump access.yoctoproject.org
	# Correct username and key repeated from above.		# Correct username and key repeated from above.

MichaelHalstead: Update to modern key lengths/types

2023-04-04T16:25:54Z

Update to modern key lengths/types

← Older revision		Revision as of 16:25, 4 April 2023
Line 3:		Line 3:

	===Generate keys===		===Generate keys===
	In order to access any of the autobuilders your ssh public keys must first be installed. The preferred ~~way to generate a~~ key is ~~type~~ RSA with ~~2048~~ bits ~~or greater~~. Please put your e-mail, the date of generation, and the host the key lives on in the comment. Please set a passphrase even if it's a simple one! Ideally your private key will never leave the host it is generated on - so if you have multiple machines please generate multiple keys. E-mail your '''public''' key named id_rsa.pub to ~~hostmaster~~@yoctoproject.org. Keep id_rsa(the private key) super safe. Please never share it with anyone or copy it onto the Internet. Don't e-mail it to yourself either.		In order to access any of the autobuilders your ssh public keys must first be installed. The preferred key type is ECC. RSA with 4096 bits is also acceptable. Please put your e-mail, the date of generation, and the host the key lives on in the comment. Please set a passphrase even if it's a simple one! Ideally your private key will never leave the host it is generated on - so if you have multiple machines please generate multiple keys. E-mail your '''public''' key named ~/.ssh/id_ed25519.pub or id_rsa.pub to helpdesk@yoctoproject.org. Keep id_ed25519 or id_rsa(the private key) super safe. Please never share it with anyone or copy it onto the Internet. Don't e-mail it to yourself either.

	ssh-keygen ~~-b 4096~~ -t ~~rsa~~ -C "~~your.email~~@~~company~~.com_2012-05-30_localhostname"		ssh-keygen -t ed25519 -C "your_email@example.com_2012-05-30_localhostname"

	Substitute your own e-mail and your computer's hostname in the command above. Setting these helps with troubleshooting in the future.		Substitute your own e-mail and your computer's hostname in the command above. Setting these helps with troubleshooting in the future.

MichaelHalstead at 21:02, 25 March 2021

2021-03-25T21:02:38Z

← Older revision		Revision as of 21:02, 25 March 2021
Line 46:		Line 46:
	ssh centos8-ty-1.yocto.io		ssh centos8-ty-1.yocto.io

	If all worked correctly you are now logged in. Build workers are [~~listed on the controller](~~https://autobuilder.yoctoproject.org/typhoon/#/workers). Append .yocto.io to the name to ssh.		If all worked correctly you are now logged in. Build workers are [https://autobuilder.yoctoproject.org/typhoon/#/workers listed on the controller]. Append .yocto.io to the name to ssh.

	===Need to work on the build scripts?===		===Need to work on the build scripts?===

MichaelHalstead at 21:01, 25 March 2021

2021-03-25T21:01:16Z

← Older revision		Revision as of 21:01, 25 March 2021
Line 1:		Line 1:
	==Connecting to Autobuilders==		==Connecting to Autobuilders==
	We use an ssh jumphost called access.yoctoproject.org to connect to the autobuilders. Jumphosts enhance security by removing the threat of hijacked ssh-agents and limiting the services running on Internet exposed hosts.		We use an ssh jumphost called access.yoctoproject.org/access.yocto.io to connect to the autobuilders. Jumphosts enhance security by removing the threat of hijacked ssh-agents and limiting the services running on Internet exposed hosts.

	===Generate keys===		===Generate keys===
Line 10:		Line 10:

	===Configure ssh===		===Configure ssh===
	Edit ~/.ssh/config and add:		Edit ~/.ssh/config on your local machine and add:

	Host access.~~yocto~~.io		Host access.yoctoproject.org
	# Make sure your username matches your account on the autobuilder		# Make sure your username matches your account on the autobuilder
	#User [username]		#User [username]
	# Give the full path to the proper public key		# Give the full path to the proper public key if needed
	#IdentityFile /home/[username]/.ssh/id_rsa		#IdentityFile /home/[username]/.ssh/id_rsa
	# If your network requires you to use a SOCKS proxy enable it here		# If your network requires you to use a SOCKS proxy enable it here
Line 24:		Line 24:
	# *.yocto.io except for access is internal. Proxy through the bastion.		# *.yocto.io except for access is internal. Proxy through the bastion.
	Host !access.yocto.io *.yocto.io		Host !access.yocto.io *.yocto.io
	ProxyJump access.~~yocto~~.io		ProxyJump access.yoctoproject.org
	# Correct username and key repeated from above.		# Correct username and key repeated from above.
	#User [username]		#User [username]
Line 46:		Line 46:
	ssh centos8-ty-1.yocto.io		ssh centos8-ty-1.yocto.io

	If all worked correctly you are now logged ~~into autobuilder01~~.		If all worked correctly you are now logged in. Build workers are [listed on the controller](https://autobuilder.yoctoproject.org/typhoon/#/workers). Append .yocto.io to the name to ssh.

	===Need to work on the build scripts?===		===Need to work on the build scripts?===

MichaelHalstead: /* Configure ssh */

2021-03-25T20:55:36Z

Configure ssh

← Older revision		Revision as of 20:55, 25 March 2021
Line 33:		Line 33:
	# Don't bother saving hostkeys we don't check		# Don't bother saving hostkeys we don't check
	UserKnownHostsFile /dev/null		UserKnownHostsFile /dev/null


	~~VisualHostKey no~~
	~~StrictHostKeyChecking no~~
	~~UserKnownHostsFile /dev/null~~



	===Verify Fingerprints===		===Verify Fingerprints===