Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make az network bastion tunnel suitable for use with OpenSSH's ProxyCommand #27999

Open
em- opened this issue Dec 11, 2023 · 3 comments
Open
Assignees
Labels
Auto-Assign Auto assign by bot customer-reported Issues that are reported by GitHub users external to the Azure organization. Network - Bastion Network az network vnet/lb/nic/dns/etc... question The issue doesn't require a change to the product in order to be resolved. Most issues start as that Service Attention This issue is responsible by Azure service team.

Comments

@em-
Copy link

em- commented Dec 11, 2023

Related command
az network bastion tunnel

Is your feature request related to a problem? Please describe.
The current az network bastion tunnel command listens on a local TCP ports and forward the traffic. However, the most common way to work with generic bastion hosts with OpenSSH is to use the ProxyCommand directive, which uses stdin/stdout to tunnel the traffic to be forwarded.

The lack of this ability causes people to do weird things to make it suitable, see for instance this gist that ends up calling nc to provide the stdin/stdout interface: https://gist.github.com/akisys/23e7f0d4d98154b3067a6a6914dcb483

Describe the solution you'd like
Add a --stdin option (or whatever better name) that is mutually exclusive with --port and can be used in the OpenSSH client config like this:

ProxyCommand=az network bastion tunnel --name MyBastionHost --resource-group MyResourceGroup --target-ip-address %h --resource-port %p --stdin

Describe alternatives you've considered
Something like https://gist.github.com/akisys/23e7f0d4d98154b3067a6a6914dcb483 but it is really unnecessary.

Additional context
Being able to use ProxyCommand would make the usage from Ansible more straighforward.

@microsoft-github-policy-service microsoft-github-policy-service bot added customer-reported Issues that are reported by GitHub users external to the Azure organization. Network az network vnet/lb/nic/dns/etc... labels Dec 11, 2023
@microsoft-github-policy-service microsoft-github-policy-service bot added Auto-Assign Auto assign by bot Azure CLI Team The command of the issue is owned by Azure CLI team question The issue doesn't require a change to the product in order to be resolved. Most issues start as that Service Attention This issue is responsible by Azure service team. Network - Bastion labels Dec 11, 2023
@yonzhan
Copy link
Collaborator

yonzhan commented Dec 11, 2023

Thank you for opening this issue, we will look into it.

@yonzhan yonzhan removed the Azure CLI Team The command of the issue is owned by Azure CLI team label Dec 11, 2023
@stellaraccident
Copy link

stellaraccident commented Jan 18, 2024

This is a really important feature for native ssh tool integration. I've worked with other providers who have this kind of thing and it lets you set up very transparent access policies.

Having used the bastion cli, it would really benefit from being developed with a view towards integration. This stuff has been done a certain way for a very long time and should integrate better.

@diogocp
Copy link

diogocp commented Jan 27, 2024

Dupe: Azure/azure-cli-extensions#5807

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Auto-Assign Auto assign by bot customer-reported Issues that are reported by GitHub users external to the Azure organization. Network - Bastion Network az network vnet/lb/nic/dns/etc... question The issue doesn't require a change to the product in order to be resolved. Most issues start as that Service Attention This issue is responsible by Azure service team.
Projects
None yet
Development

No branches or pull requests

5 participants