debitoor / ssh-private-key-buildpack Goto Github PK

SSH private key configuration

Shell 100.00%

ssh-private-key-buildpack's Introduction

ssh-private-key-buildpack

A Heroku buildpack for setting the ssh private key as part of the application build. It's meant to be used as part of a setup using multiple buildpacks, so other buildpacks can authenticate with hosts using ssh keys, for instance to install dependencies from private git repositories.

Example usage

Configure Multiple Buildpacks

Option 1: Heroku CLI or Dashboard

Add the buildpack to your Heroku app either using the CLI or the Heroku dashboard. The ssh-private-key-buildpack needs to run before any buildpack trying to get ssh access. In the following example, it runs before the heroku/go buildpack.

$ heroku buildpacks:set --index 1 https://github.com/debitoor/ssh-private-key-buildpack.git
$ heroku buildpacks:add heroku/go

Option 2: Use `heroku-buildpack-multi`

Instead of setting the buildpacks directly with Heroku they can also be configured using a .buildpacks in combination with heroku-buildpack-multi.

$ heroku buildpacks:set https://github.com/heroku/heroku-buildpack-multi.git

The same example given for the CLI use would have the following .buildpacks file.

$ cat .buildpacks
https://github.com/debitoor/ssh-private-key-buildpack.git
https://github.com/heroku/heroku-buildpack-go

Configure SSH Key

Set the private key environment variable SSH_KEY of your Heroku app (note that the key needs to be base64 encoded).

$ heroku config:set SSH_KEY=$(cat path/to/your/keys/id_rsa | base64)

By default the buildback adds Github to known_hosts. However you can configure your app to allow custom hosts, too. All that's needed is the set SSH_HOSTS for you app to a comma-separated list of hosts, e.g. [email protected],example.com

$ heroku config:set SSH_HOSTS="[email protected],example.com"

ssh-private-key-buildpack's People

Contributors

Stargazers

Watchers

Forkers

bjeanes mikechau murcho sky-uk brentmaxwell fortyau substrakt 2pax-hq jacobdr copperleaftech aheissenberger alliancesoftware jchappell82 applauseoss itsme3d anewbigging alejofernandez wilmveel ninobaldo pagerinc ablida alrik11es jantrienes platogo joshnesbitt thomasfedb citrininfo syzygypl dragonsmith kevincolten jussikinnula bestit feedbackfruits tmedford moneymeets zyv andre-hh dronebase biz-tek-dev bytegain danielsluz scalingo solargis dabolus pickware moneytoken sofware abuhtoyarov martyzz1 bdswiss doolin electblake dendomenko omargallob jessamynsmith shreyas123 olegivaniv wearemodron classpert nyddle sidartaoliveira doooby gordilsandwillis peque philiplehmann livelink olarra leiyong21c shqear93 formfunfunction shadow443 studitemps grrinchas moisesguimaraes rushcut baskin rtakasu fedegratti tilast sathvikks enedrio tesorio nicko170 smidwap isabella232 portersupport tolgacura wojcirej

ssh-private-key-buildpack's Issues

Does not work for bitbucket

Adding bitbucket.org to SSH_HOSTS has no effect; it uses github.com regardless.

Invalid assignment of SSH_KEY variable

Hi guys,

when running the set SSH_KEY command

heroku config:set SSH_KEY=(cat id_rsa7_heroku | base64)

I got the following error

'xyz is invalid. Must be in the format FOO=bar.'

I changed the command to

heroku config:set SSH_KEY="(cat id_rsa7_heroku | base64)"

which worked for me. Can you confirm and adjust the documentation?

Kind regards

Michael

Unable to successfully add SSH

Trying to use your package to add bitbucket to the list of known host and get the error

Warning: Permanently added 'github.com,192.30.253.113' (RSA) to the list of known hosts.
remote: Permission denied (publicly).

Better alternative?

It seems like this project has been abandoned.

Is there a better alternative now?

Note: still trying to avoid adding a Github password / user token to package.json and checking that in.

Don't print SSH private key

I appreciate the prompt telling me that my key was successfully added, but printing it to the screen doesn't seem like the most secure feature.

Add a Free Software/open source license to the project

Please add a Free Software/open source license to your project, so others may use the buildpack legally in countries with copyright laws. All existing contributors should agree on a license for others to be able to rely on it as being binding and intended.

The Free Software Foundation has a guide to choose a license: https://www.gnu.org/licenses/license-recommendations.en.html
GitHub has a website that can help you choose a license for your project: https://choosealicense.com/

Add host keys to known_hosts file

Right now, the current implementation uses StrictHostKeyChecking=no to prevent interactive warning messages about unknown keys / authenticity from preventing the build process. However, this is not ideal, as we should try to check the validity of the host's public key during SSH connection setup (e.g. during calls to npm install git+ssh:...).

We should close this issue with a PR that uses one of the approaches outlined here to facilitate better security.

failed to build dependencies

Sorry i am still in learning, How to fix this.
this failure message comes out after i add buildpacks nodejs.

Build Log

-----> SSH private key app detected
-----> Running SSH private key setup
       Warning: Permanently added 'github.com,192.30.253.112' (RSA) to the list of known hosts.
       Permission denied (publickey).
-----> Node.js app detected
-----> Creating runtime environment
       
       NPM_CONFIG_LOGLEVEL=error
       NPM_CONFIG_PRODUCTION=true
       NODE_VERBOSE=false
       NODE_ENV=production
       NODE_MODULES_CACHE=true
-----> Installing binaries
       engines.node (package.json):  8.4.0
       engines.npm (package.json):   5.3.0
       
       Resolving node version 8.4.0...
       Downloading and installing node 8.4.0...
       npm 5.3.0 already installed with node
-----> Restoring cache
       Skipping cache restore (new-signature)
-----> Building dependencies
       Installing node modules (package.json)
       npm ERR! Error while executing:
       npm ERR! /usr/bin/git ls-remote -h -t ssh://[email protected]/#/#.git
       npm ERR!
       npm ERR! Warning: Permanently added the RSA host key for IP address '192.30.253.113' to the list of known hosts.
       npm ERR! Permission denied (publickey).
       npm ERR! fatal: Could not read from remote repository.
       npm ERR!
       npm ERR! Please make sure you have the correct access rights
       npm ERR! and the repository exists.
       npm ERR!
       npm ERR! exited with error code: 128
       
       npm ERR! A complete log of this run can be found in:
       npm ERR!     /app/.npm/_logs/2017-09-07T16_06_48_844Z-debug.log
-----> Build failed
       
       We're sorry this build is failing! You can troubleshoot common issues here:
       https://devcenter.heroku.com/articles/troubleshooting-node-deploys
       
       If you're stuck, please submit a ticket so we can help:
       https://help.heroku.com/
       
       Love,
       Heroku
       
 !     Push rejected, failed to compile Node.js app.
 !     Push failed