execute ssh and sudo su - user commands in bastion server

[urosdigital]

Hello,

Due to security reasons i can connect to remote server using the following approach:

connect to host1 using personal user and password
execute ssh packagename on host1
execute sudo su - user after ssh command is being executed
--
personaluser@host1
ssh packagename
sudo su - user

host1 is the entry point into system architecture
packagename is alias for specific IP address which need to be targeted (this is in order not to worry if target host is on primary or standby node)
user is technical/application user who can execute commands and has elevated privileges, note i do not need password when executing this command directly in cli

It this possible to be achieved using parallelSSH?

I tried the following but script is hanging, i guess i need to start pty or shell in order to maintain connection...

from pssh.clients import SSHClient

host = 'host1'
user = 'personal_user'
password = 'personal_password'
bastion = 'nost2' # real hostname of the host which is accessed when using ssh packagename (alias)
commands = ['whoami', 'sudo su - user']

client = SSHClient(
             host, user=user, password=password,
             proxy_host=bastion,
             proxy_user=user,
             proxy_password=password
             )

for command in commands:
    host_out = client.run_command(command)
    if host_out.exit_code:
        print(host_out.exit_code)
    print()
    print('\n'.join(host_out.stdout))
    print()

if client:
    client.disconnect()

Also tried this script:

from pssh.clients import SSHClient

host = 'host1'
user = 'personal_user'
password = 'personal_password'
commands = ['whoami', 'hostname', 'ssh packagename']
client = SSHClient(host, user=user, password=password)

for command in commands:
    host_out = client.run_command(command)
    if host_out.exit_code:
        print(host_out.exit_code)
    print()
    print('\n'.join(host_out.stdout))
    print()

if client:
    client.disconnect()

Output:

personal_user
host1

than script hangs

BR,
Uros

[pkittenis]

Thanks for the interest.

See documentation on using proxy hosts. Proxy host, jump server, bastion are all the same thing.

Proxy Hosts and Tunneling

This is used in cases where the client does not have direct access to the target host(s) and has to authenticate via an intermediary proxy, also called a bastion host.

[urosdigital]

Thanks for your reply @pkittenis The thing is, i thought i have two jump servers instead of just one. Our package has its own IP address and this mislead me when creating a script. Problem solved by using our proxy/bastion server with personal user/pass for proxy and targeting the IP of the package directly, using technical user/pass:

commands = ['whoami', 'hostname', 'df .']

client = SSHClient(
             HOST, user=USER,
             password = PASSWARD,
             proxy_host=PROXY_HOST,
             proxy_user=PROXY_USER,
             proxy_password = PROXY_PASSWARD,
             proxy_port=22,
             )

for command in commands:
    HOST_out = client.run_command(command)
    if HOST_out.exit_code:
        print(HOST_out.exit_code)
    print()
    print('\n'.join(HOST_out.stdout))
    print()

if client:
    client.disconnect()