DEV/Chaining Git Over SSH

Accessing public repo from within DMZ machine

Problem:

Your development machine is a lab machine in DMZ. However you need to have access to some git code (gerrit.fd.io) that you cannot directly clone onto a lab-development machine. How to achieve it ?

A rudimentary solution:

Clone the code onto a machine (say laptop) that can access gerrit.fd.io and SCP it to the lab-development machine.

Issues:

• Once you have changes, you have to create a patch and patch the repo on your laptop before sending it out for review
• In the mean time if remote-repo is modified, you need to do a pull. Unfortunately, you cannot as your lab-development machine is in DMZ.

Solution:

The following solution description takes gerrit.fd.io as an example. One can extend it to any other code repo or even for multi-hop ssh.

• First you need a system from where you have access to gerrit.fd.io . If you do not already have a system with that property, you can create a VM on Aurora. For our documentation here, lets call it mystery and user name as arcane.
• Create a ssh-key pair using ssh-keygen. For details 'man ssh-keygen'. The below command generates two files multihop.rsa and multihop.rsa.pub. multihop.rsa.pub is public key and multihop.rsa is a private key in ~/.ssh directory. Details: Public Key Cryptography.

 ssh-keygen -C "SSH key for multi-hop for arcane" -f ~/.ssh/multihop.rsa -N ""
 
 -C: Comment
 -f: ouput filename
 -N: passphrase; using "" is fine.

• Login to mystery as arcane and append contents of multihop.rsa.pub to ~/.ssh/authorized_keys. By doing so, mystery will allow password less ssh login when corresponding private key is used, which you will specify in the next step on the lab-development machine from where you login.

• Edit ~/.ssh/config on the lab-development machine and add the following:

 Host mystery
   User arcane
   IdentityFile ~/.ssh/multihop.rsa
 
 # Should have port on the first line
 Host gerrit.fd.io
   ProxyCommand ssh -q mystery nc gerrit.fd.io 29418
   User <gerrit username>
   IdentityFile <gerrit identity private key>

How to get access to gerrit ?

Now you should be able to perform your favorite git operations.

 git clone ssh://gerrit.fd.io/vpp.git
 Cloning into 'vpp'...
 remote: Counting objects: 986, done
 remote: Finding sources: 100% (41/41)
 remote: Total 1655 (delta 0), reused 1626 (delta 0)
 Receiving objects: 100% (1655/1655), 2.66 MiB | 1.42 MiB/s, done.
 Resolving deltas: 100% (651/651), done.
 Checking connectivity... done.

There was no need to specify username and port on the command line as you have done so in ~/.ssh/config.