0

I am looking at ways to mitigate the potential for using scp commands within GCE VMs that are running CentOS 8.

Current setup is a bastion VM being able to SSH into a secondary VM (instance-1). I have not been able to SSH back from the secondary VM into the bastion VM after establishing the first SSH connection and I am assuming this is due to not having a SSH keypair in the opposite direction (someone correct me if I am wrong there). Error when running ssh <BASTION_IP> is Permission denied (publickey,gssapi-keyex,gssapi-with-mic)

I am attempting to SCP from instance-1 to the bastion and that does not work either with an error of Permission denied (publickey,gssapi-keyex,gssapi-with-mic). This is due to the SSH keypair not being present correct?

Is there a way to work around this? I want to see what potential approaches can be used for running SCP commands from instance-1 to the bastion. Would any form of TCP forwarding or establishing a different SSH tunnel allow for files to be transferred out

Edit for additional details.

Instance-1 only has a private IP. Both VMs are in two separate GCP projects with a VPC peering between networks.

No NAT gateway or other proxies to allow instance-1 to have external internet access.

Bastion does not have a public key for a private key in instance-1

Edit for additional questions.

With the bastion establishing an SSH tunnel to instance-1 is there anyway to be in instance-1 and somehow get a file out of instance-1 to the Bastion?

Does SCP not work if there is not a public key from instance-1's SSH keypair on the Bastion?

3
  • 1
    1) Does instance-1 have Internet access or does it only have a private IP address? Does your VPC have a NAT Gateway or other proxy? Those would allow instance-1 to access the Internet directly. 2) Unless the Bastion has the public key for the private key that instance-1 is using, you will not be able to connect to the bastion host. I am not sure what you mean by workaround - the systems are either secure or they are not. Aug 12, 2021 at 18:51
  • 1) Instance-1 only has a private IP. Both VMs are in two separate GCP projects with a VPC peering between networks. 2) No NAT gateway or other proxies to allow instance-1 to have external internet access. 3) Bastion does not have a public key for a private key in instance-1. 4) So even with the bastion establishing an SSH tunnel to instance-1 is there anyway to be in instance-1 and somehow get a file out of instance-1 to the Bastion? 5). SCP does not work in this case due to the Bastion not having the public key from the private key that would be located in instance-1, if there was one?
    – rk92
    Aug 12, 2021 at 19:29
  • 1
    Please edit your question with those details. The user can log in to the Bastion host and create a reverse SSH tunnel. The user can log in to instance-1 and connect back to that tunnel without SSH keys which would allow Internet access. Aug 12, 2021 at 19:33

1 Answer 1

0

I would suggest sftp command. First connect to Bastion Server via normal SSH. From the Bastion server, start an SFTP session

$ sftp -i /PATH/TO/SSH/KEY user@remote-vm-ip

Once you are inside, you can move around the file system using cd command (cd for remote while lcd for local) Use the ls command to list files (ls for remote while lcd for local) Want to download a file, simply use get command (get file.txtfor example) Want to upload files, simply use put command (put file.txt for example)

You can also automate the process with sftp or scp commands, as long you have access from one machine to the other, and also know where the source file is located on the filesystem.

Reference:

https://www.ibm.com/support/pages/using-sftp-script-rsa-authentication

https://docs.oracle.com/cd/E36784_01/html/E36870/sftp-1.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .