Re:Tailscale ate my network (and I love it)
by paranoidrobot on Saturday July 02, 2022 @02:05AM
(#31956663)
Someone on Reddit posted a shell script[1] that does all the connection setup, key-sending, etc that's a useful base to work from.
[1] https://www.reddit.com/r/aws/comments/df6uip/ssm_tunnelling_...
Re:Tailscale ate my network (and I love it)
by CubsFan1060 on Saturday July 02, 2022 @07:57AM
(#31958299)
This may be of interest to you.
https://aws.amazon.com/about-aws/whats-new/2022/05/aws-syste...
Re:Tailscale ate my network (and I love it)
by jvolkman on Saturday July 02, 2022 @09:03AM
(#31958654)
It still requires the bastion host though, right? In which case I'd prefer to just use ssh since it's more familiar.
Also, intellij's built-in database tools support ssh tunneling, it 'just works' with the ProxyCommand method.
Re:Tailscale ate my network (and I love it)
by CubsFan1060 on Saturday July 02, 2022 @10:47AM
(#31959425)
Yeah, just removes the need for SSH and keys mostly.
Re:Tailscale ate my network (and I love it)
by moltar on Saturday July 02, 2022 @04:00AM
(#31957115)
Why do you need steps 2 and 3? I’m able to use SSM with agent without any SSH keys. Also proxying to RDS. Only AWS credentials are required.
`ssh aws-bastion` invokes a ProxyCommand that:
1) finds an actual bastion host by tag using ec2 describe-instances
2) generates a short-lived ssh key and adds it to the ssh agent
3) sends the temporary key to the bastion using ec2-instance-connect send-ssh-public-key
4) starts the SSM/ssh session using AWS-StartSSHSession
Since it's SSH, we can port forward, use multiplexing, etc. We use Google as the IdP, via AWS SSO. Bastions periodically sync users from a Google group.