☰

Elastic beanstalk 访问私有 git repo

tag-icon • tag-icon ssh git node.js elastic-beanstalk
Elastic beanstalk 访问私有 git repo

我目前正在尝试使用 .ebextensions 命令将 ssh 密钥添加到我的 elastic beanstalk 实例。

我存储的密钥位于我的应用程序代码中，我尝试将它们复制到根 .ssh 文件夹，以便稍后在执行 git+ssh 克隆时可以访问它们

这是我的 .ebextensions 文件夹中的配置文件示例

packages:
  yum:
    git: []

container_commands:
    01-move-ssh-keys:
        command: "cp .ssh/* ~root/.ssh/; chmod 400 ~root/.ssh/tca_read_rsa; chmod 400 ~root/.ssh/tca_read_rsa.pub; chmod 644 ~root/.ssh/known_hosts;"
    02-add-ssh-keys:
        command: "ssh-add ~root/.ssh/tca_read_rsa"

问题是我在尝试克隆 repo 时收到错误

Host key verification failed.

我尝试了很多方法将主机添加到known_hosts文件中，但都没有成功！

执行克隆的命令是 npm install，因为 repo 指向节点模块

答案1

我将其添加到我的 ebextensions 中。这是我用来连接代码提交的。我需要指定用户并忽略主机密钥检查。希望这对任何路过的人有所帮助...

commands:
    add_ssh_config:
        command: printf "Host git-codecommit.*.amazonaws.com\r\n  StrictHostKeyChecking no\r\n  User <name-of-user>\r\n  IdentityFile ~/.ssh/<name-of-key>.pem" > /home/ec2-user/.ssh/config"

答案2

主机密钥验证意味着主机本身无法验证。当您首次使用 ssh 连接到主机时，ssh 会询问您以下问题。这就是主机密钥验证。

The authenticity of host 'blah.blah.blah (10.10.10.10)' can't be established.
RSA key fingerprint is a4:d9:a4:d9:a4:d9a4:d9:a4:d9a4:d9a4:d9a4:d9a4:d9a4:d9.
Are you sure you want to continue connecting (yes/no)?

为了安全地传递，您可以ssh-keyscan <repo-host>在本地使用并创建一个known_hosts包含输出的文件。

因此对于 GitHub 来说，这将是

$ ssh-keyscan github.com
# github.com:22 SSH-2.0-babeld-f43b814b
# github.com:22 SSH-2.0-babeld-f43b814b
# github.com:22 SSH-2.0-babeld-f43b814b
github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==

因此 ebextension 看起来像这样：

packages:
  yum:
    git: []

container_commands:
    01-move-ssh-keys:
        command: "cp .ssh/* ~root/.ssh/; chmod 400 ~root/.ssh/tca_read_rsa; chmod 400 ~root/.ssh/tca_read_rsa.pub; chmod 644 ~root/.ssh/known_hosts;"
    02-add-ssh-keys:
        command: "ssh-add ~root/.ssh/tca_read_rsa"
    03-add-known-hosts:
        command: "echo 'github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==' > ~root/.ssh/known_hosts"
    04-fix-perm:
        command: "chmod 400 ~root/.ssh/known_hosts"

相关内容