Creating an SSH Endpoint

Click the Create button to create a new Endpoint, or select an existing Endpoint by clicking on the desired row. Enter the required fields as defined in the table below.

See Endpoint Defaults to setup default values for new Endpoints to save time.

Field Name

Required

Description

Field Name

Required

Description

Endpoint Name

Yes

The name of the Endpoint.

Description

No

An optional description for the Endpoint.

Active

Yes

Whether or not the endpoint is active in the system. Defaults to "Yes".

Connection Type

Yes

The connection type used for connection to the Endpoint.

Supports:

  • localhost

  • SSH

    • When using Windows, this is supported on Windows Server 2019+ where native OpenSSH is available.

  • SSH (Cygwin)

  • HTTPS

Operating System

Yes

Unix or Windows

Address

Yes

The DNS name or IP address of the Endpoint.

Port

Yes

The SSH port of the Endpoint (typically port 22).

Base Directory

Yes

A working directory on the Endpoint used by FlexDeploy. ~ is not supported here. See Permissions information below for details on how to create this folder automatically (Recommended).

For example, /app/flexdeploy.

If you have two FlexDeploy installations that may connect to same Endpoint, you must use unique folders for both FlexDeploy Servers. In most cases, separate FlexDeploy is installed to perform testing of FlexDeploy patches, which may connect to same Endpoint, in which case you can use different folder like /app/flexdeploytest and /app/flexdeploy.

Working directory under /var/tmp or /tmp folder is not recommended as administrators generally have cron jobs to purge files based on age and that will cause issues when plugin files are deleted. For example, Error: Could not find or load main class flexagon.fd.core.plugin.ExternalPluginServer will be encountered when plugin lib files are deleted.

Permissions

  • Base directory must be owned by Username or Run as (if using privilege escalation) and it's group.

  • Ideal option is to point base directory where Username or Run as (if using privilege escalation) has access to create sub-folder. In such case, FlexDeploy will automatically create folder with necessary permissions.

  • Permissions required are 755. Keep in mind that FlexDeploy may temporarily change permissions specifically when using Run as option.

  • When using Run as, Base Directory is owned by Run as and there is subfolder name scratch which is owned by Username. The scratch directory is used to stage files transferred by Username, and then copied to other directories for use by the Run as User. It’s not important to understand this detail, and is only provided since you may notice ownership differences on the scratch directory.

JDK Home

Yes

The JDK Home directory on the Endpoint. For example, /usr. FlexDeploy will look for /bin/java under specified JDK Home folder. Not required if the Endpoint is a Docker Host. Often a JRE will suffice, unless you are compiling java code with it.

As of 7.0.0.7, this can contain $ and ~. Any variables referenced must be setup by the .bashrc file. The endpoint source script will not have been executed prior to setting the Java Home variables.

Source Script 

No

An optional script executed right before plugins are executed on the endpoint. Script can source some other environment script as well. Script should be Unix shell or Windows bat commands depending on type of Endpoint. If using Windows Cygwin SSH then script should be written as Unix shell.

Some usages of this script include sourcing an environment file (. $HOME/mfile.env)  or exporting a variable (export FLEXAGON_FD_PLUGIN_JAVA_ARGS="-Xmx1024m -Djava.io.tmpdir=/var/tmp"). Variables exported here will become available to plugin executions on this endpoint.

Max Concurrent Executions

No

Sets a limit on the number of concurrent executions on this endpoint. If not specified, the default of 5 will be used.

Transfer Protocol

Yes

Protocol/Tool to use to transfer files from FlexDeploy host to endpoint and vice-versa.

Options available are:

  • SCP (default)

  • rsync

To use the rsync option, FlexDeploy should be running on a UNIX machine, the endpoint can be UNIX or Windows (Cygwin) and rsync needs to be installed on BOTH, FlexDeploy host and endpoint and expect needs to be installed on the FlexDeploy host.

Authentication Type

Yes

Mechanism to use for authentication.  The Password, Private Key File, and Passphrase are displayed based on selected type.

Supports:

  • Username and Password

  • Username and SSH Key

  • Username and SSH Key with Passphrase

Username

Yes

The user account on the Endpoint to connect with. All executions via this endpoint will run as this user.

Password

No

The password for the Username. Either password or Private Key File is required.

Private Key File

No

Fully-qualified path of the SSH private key file on FlexDeploy server. Either Private Key File or Password is required. ~ is not supported here.

Passphrase

No

An optional passphrase used when the private key was generated. Only valid if a Private Key File is specified.

Privilege Escalation Type

No

An optional type of privilege escalation to use after establishing connection to the endpoint.

Supports:

  • sudo

  • pbrun

  • other

Privilege Escalation Syntax

No

An optional syntax which wraps all commands to be executed on the endpoint. You can use property replacement syntax i.e. $${{RUN_AS_USER_NAME}}, with this input and the variable will be replaced with the appropriate value at runtime. The following variables are available:

  • ${{USER_NAME}} - Username value on this endpoint

  • ${{RUN_AS_USER_NAME}} - Run as (user) value on this endpoint

  • ${{COMMAND}} - The command to be executed on this endpoint

  • ${{ENDPOINT_ADDRESS}} - Endpoint Address value on this endpoint

Important notes:

  • Privilege Escalation Syntax must contain ${{COMMAND}} at a minimum.

  • When Privilege Escalation Type is changed the Privilege Escalation Syntax will default to sudo -u ${{RUN_AS_USER_NAME}} bash -c '${{COMMAND}}'" for sudo type and pbrun -f ${{ENDPOINT_ADDRESS}} -u ${{RUN_AS_USER_NAME}} bash -c '${{COMMAND}}'" for pbrun type. The other type has no default value. Use other to define a custom privilege escalation.

  • To remove privilege escalation, first clear Run as (User) then clear Privilege Escalation Type. Host option (--host/-h) is not supported with any value except ${{ENDPOINT_ADDRESS}}

Run as (user)

No

An optional user to run as after establishing connection to the endpoint when working with Unix OS. For example, flexdeploy


See below for necessary setup information for type of Privilege Escalation Type:

sudo:

  • Add sudoers rule, such that Username can sudo to Run as (user) without prompting for a password.

  • something like initialLoginUser ALL=(RunAsUser) NOPASSWD: ALL

    • For example: flexdeploy ALL=(oracle) NOPASSWD: ALL

  • Test by executing the following from FlexDeploy server terminal, connected as Username: “sudo -u <Run as (user)> bash -c whoami”.  Output should be the name of the Run as (user) without prompting for a password.

  • After completing endpoint configuration, click “Test Connection” on the Endpoint.

pbrun:

  • IP address or hostname with domain is required for the Address of your endpoint, as this is used for the host argument in the pbrun command. runhost and submithost will always be the endpoint’s Address

  • The Username on the endpoint becomes the user in pbrun and Run as (user) becomes the requestuser in pbrun. Policies should be configured accordingly.

Optionally, click the Test Connection button to validate that the FlexDeploy server can connect to the configured Endpoint.

Click the Save button to save the changes to the Endpoint. To discard the changes click on the Cancel button.

To inactivate an endpoint click the Active link on the desired Endpoint, and it will toggle to Inactive. This will hide that Endpoint after leaving the screen, until the Active checkbox is unchecked. To reactivate an Endpoint, click the Inactive link and it will toggle back to Active. This endpoint is now active in the system again and ready for use.

SSH Authentication

FlexDeploy utilizes SSH to connect to its configured Endpoints using Password authentication or SSH public-private keys.

FlexDeploy also supports using privilege escalation with sudo or pbrun for UNIX. See Privilege Escalation and Run as (user) details above.

Supported Algorithms for SSH

Flexagon focuses its testing with RSA keys for SSH, since their use is more prevalent by our customers. We therefore recommend using RSA.

Password Authentication

In this case you must provide a Username and Password to perform authentication.

Unix Example

Windows Example

Unix Example

Windows Example

 

 

MacOS endpoints are supported using Unix Connection Type.

Public-Private Key Authentication

In this case you must use public-private key pair to perform the authentication (password in not required in this case).  The private key is kept secretly on the FlexDeploy server by setting the permissions such that only the FlexDeploy server can read it. The public key is copied to endpoint. While authentication is based on the private key, the key itself is never transferred through the network during authentication. You must provide the Username on Endpoint where public key was copied, and an optional Passphrase (an optional password assigned to the private key at generation time).

Creating a Public-Private Key Pair

If you do not already have SSH keys generated for the host where FlexDeploy is installed, login (or switch user) as the user which FlexDeploy runs as, and run the following OpenSSH command.

ssh-keygen -t <rsa | dsa> ** where rsa or dsa is the encryption algorithm you wish to use. For example,

SSH keygen command examples

ssh-keygen -t rsa OR ssh-keygen -t dsa

Here is the sample output (with interactive prompts) using rsa encryption.

ssh-keygen -t rsa

Generating public/private rsa key pair. Enter file in which to save the key (/home/oracle/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/oracle/.ssh/id_rsa. Your public key has been saved in /home/oracle/.ssh/id_rsa.pub. The key fingerprint is: e4:dd:6d:88:e0:64:9c:3e:9d:f7:7d:6f:2e:56:dd:6b oracle@devlnx12 The key's randomart image is: +--[ RSA 2048]----+ | | | . . | | B | | B + + o | | S = + o o| | . . o .+| | ..+| | oE+| | ..+o| +-----------------+

It is typical to use the default file name and location to store the private key (which is in the .ssh subfolder of the user's home directory). You can optionally secure the private key file with a passphrase. It is an SSH requirement that the private key be readable only by its owner (e.g. oracle in the example above). So you must change the permissions accordingly (e.g. chmod 600 /home/oracle/.ssh/id_rsa). You will receive an error at connection time similar to the following if you omit this step.

Permissions 0777 for '/home/oracle/.ssh/id_rsa' are too open.

It is recommended that your private key files are NOT accessible by others otherwise private key will be ignored.

Uploading the Public Key

We must now copy the contents of the public key to each endpoint host. This step can be performed manually or using FlexDeploy UI. To save time and avoid errors, use Upload Public Key button on FlexDeploy UI for specific Endpoint.

In order to copy public key manually copy the contents of the public key file on the FlexDeploy server and append it to the end of the following file on the endpoint:

  • ~/.ssh/authorized_keys (Note that you will need to create this file if it does not already exist). You can scp public key file to endpoint and append it to authorized_keys file in .ssh folder of user's home folder. As explained above in Tip section, you must make sure that permissions are 700 for .ssh folder as well as user's HOME folder.

Sample contents of an authorized_keys file (containing two public keys):

authorized_keys sample
ssh-rsa AAAAB3NzaC1yc2EANAADAQABAAABAQC9GvGjUyL1towJF5uxp3jqeFcwaBm0GhqXaPrhWH/iX1H1lalPmwR3N791lR7oTONl6TZShLX2sq64rGL+HYF+W1RxjZqydcWDEJsz2MD525NisTuXI2HjVMYablXobDtv5sc12iM8hdh6nJXAlTHQ1wA4izRX2via5nWWtZUqBTyicpR1odQb4pcoTjPOsEPrwS7/sU51kLqR+y1G5AM307VhLBLumS3gB/kj+pBoIZEk2LwwuMeaRhywe9N2+M+hO7c1TijseACmr0DHN9ZvZhoBBgl7xBUFqxxOrMktst7arpxEvQXz4aUh+58smWSA4iMHXvzMc/xSXUp9eIov comment1 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwnP9Sahi0y1rypBq8i7MbV8QR21g+nC4AIrnSsoyh7T4DyjeScJS6SWzBLSNrv7bX+Lm7pUqMEOKwR68kk8SLcNOStPsyBoZJNeiE6R11rXOufN4aebc3aT4JW/qcb1nQwGnP9ubfGVAMEf3rvU0OBt18CAvNux2Gr8t1kpubZQyXtK9mvjcYPUgvUEQIwL+kShgRMQiqw6FOyUuE22jIqxnr0avALH32fB7B4p7DsfEC3M1+Yb9PptaUQpSkk0OyU3bQh3gCNojqOVMNZ+IJREyhh9TnlHf3/FVED29aC6DxB3bEERymXRSVFlV2dedlXjeTjsVdqurgD4CHF382Q== comment2

The public key can also be copied to the endpoint's authorized_keys file using the Upload Public Key button.

Validate that the derived name and location of the public key is correct, and enter the password for the Endpoint connection user (if not already provided on the Endpoint definition). Click the Upload button to upload the public key to the Endpoint.

Special Note for Oracle Java Cloud Service

The SSH connectivity for the Java Cloud Service is no different than when running on-premise. However, by default you will not know the password for the oracle user. You have two options for configuring endpoints on Java Cloud Service instances.

  1. Using PuTTy, connect to the Java Cloud Service instance VM using the opc user and the private key you generated when you created that instance. Sudo to root and change the oracle password. You can now use this password to configure the endpoint to connect using the oracle user.

  2. Manually copy the public key into the authorized_keys file within the .ssh folder of the oracle home (/u01/app/oracle/tools/paas/state/homes/oracle/.ssh/authorized_keys). You can also use the upload public key feature of FlexDeploy if you know the oracle password (e.g. by following the instructions in #1 above). Once the keys are in place you can configure the endpoint to reference the private key instead of the password.

 

The following macros are not currently supported in the footer:
  • style