-
Notifications
You must be signed in to change notification settings - Fork 90
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Detect windows also with ssh transport #416
Detect windows also with ssh transport #416
Conversation
3b0e8e6
to
b3cdb9a
Compare
Stefan, I tried this and all of the checks came back as failed even though they should have been passing. While Inspec is sending the commands over the SSH tunnel I don't believe that they are formatted correctly. I believe Inspec is treating the commands as the running connection is raw Windows and not a WinRM pipe. The commands that go across the SSH tunnel still have to be formatted for WinRM. Packer Sending calls over the WinRM Communicator:
Inspec Attempting to get WinRM Service Status over Packer SSH connection.
If you use the Ansible provisioner for Packer you will see that Ansible sends over the powershell command with a EncodedCommand option that is base64 encoded. Ansible using Packer SSH for WinRM Calls:
|
Thanks @e-mow yes that‘s what I just found out, too. I‘ve only tested „red“ tests and not „green“ ones. |
@e-mow some tests work, others do not seem to get passed through the Packer communicator. This control file # encoding: utf-8
# copyright: 2018, The Authors
title 'Chocolatey package manager'
# you can also use plain tests
control "Chocolatey" do
title 'Chocolatey installed'
describe file('C:\ProgramData\chocolatey\bin\choco.exe') do
it { should be_file }
end
describe command('choco --version') do
its(:stdout) { should match /0.10.11/ }
its(:exit_status) { should eq 0 }
end
end gives me two passed test and one failing test
I'll try to understand the codebase a little more, but I'm also not a regular Ruby developer. |
@e-mow After long digging through the code I found a command wrapper and enhanced it for remote Windows connections. Can you try it with the second commit in this PR? I now can check services and files and commands are now run in a powershell.
Feedback from maintainers are more than welcome if this approach has a chance to get merged. |
fd3a90b
to
35ccea5
Compare
@StefanScherer I tried the changes and they are working for Windows. I ran a Linux test as well to make sure nothing was broken there with these changes and the Linux run ran fine as well. Thanks for adding this! |
35ccea5
to
32803b1
Compare
TravisCI failure is a fluke, restarting... |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks great, and is very clear code!
That said, it would be best if we could get some tests on this. See for example test/unit/transports/ssh_test.rb (we should show that when the detected platform is Windows, SSH transport will still initialize).
I was also alarmed to find we have no integration tests for windows; I opened #419 to cover that, but I don't expect you to do that.
Thanks again!
Thanks @clintoncwolfe What I found out today is that the Microsoft OpenSSH server behaves a little bit different and instead of just testing |
@clintoncwolfe I pushed a first unit test for command_wrapper I'll test the other Windows scenario with Microsoft OpenSSH that uses cmd.exe session so "cmd /c ver" check didn't work and update the detection code to try "cmd /c ver" and as fallback "ver" as well. I'll try that in a Vagrantfile. I can share that if you like. |
Hey @StefanScherer, thanks for your work on this - don't worry about an integration test (one talking to a real Windows VM). Please post any thoughts / Vagrantfiles you have for that on #419, we'd love to explore ideas. I'll look over the unit tests and see if we can move this ahead. |
I have added commit 06147ed to add a second check for Windows. This is needed with Microsoft OpenSSH as it defaults to the cmd.exe and for some reason But after looking closed with a test with ssh directly I found out this:
Wait, what? Command
What? This works, hm. So it seems that the command is somehow quoted in the OpenSSH server on Windows. Adding a space at the end also fixes this issue. So changing the def detect_windows
res = @backend.run_command('cmd /c ver ')
return false if res.exit_status != 0 or res.stdout.empty? @clintoncwolfe so should I revert the last commit and just add the space after |
This failure has been fixed on master (version string comparison has now been relaxed to a regexp check). So as far as I'm concerned, the appveyor failures can be ignored. Probably also fixable via a rebase. |
78e69f5
to
8c8bf97
Compare
Thanks @zenspider for the heads-up. I've rebased. AppVeyor is now green. There seems to be some flaky tests that caused one of the Travis tests go to red. Can anybody re-trigger Travis, please? |
Opened a ticket PowerShell/Win32-OpenSSH#1373 why we see a problem with |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you. Minor request.
Signed-off-by: Stefan Scherer <[email protected]>
8c8bf97
to
ea8d8ef
Compare
@clintoncwolfe @zenspider I've changed the PR to use |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A long road to .exe
- thanks for staying with this! Great work @StefanScherer !
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @StefanScherer
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you so much for figuring this out!
Thanks, I'm happy to see the release 2.1.0. Now waiting for the next InSpec release 😄 |
Hi,
My packer file looks like this:
|
Hello, I am also having the same issue for AWS. Are there any workarounds? Windows 2016 ADO build server creating a Windows 2019 AWS template.
2020-02-11T22:07:29.2922093Z amazon-ebs: C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/train-core-3.2.14/lib/train/platforms/detect/scanner.rb:41:in `scan': Sorry, we are unable to detect your platform (Train::PlatformDetectionFailed)
2020-02-11T22:07:29.2932280Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/train-core-3.2.14/lib/train/platforms/detect.rb:9:in `scan'
2020-02-11T22:07:29.2944376Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/train-core-3.2.14/lib/train/plugins/base_connection.rb:120:in `platform'
2020-02-11T22:07:29.2952002Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/train-core-3.2.14/lib/train/extras/command_wrapper.rb:189:in `load'
2020-02-11T22:07:29.2961140Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/train-core-3.2.14/lib/train/transports/ssh_connection.rb:57:in `initialize'
2020-02-11T22:07:29.2961884Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/train-core-3.2.14/lib/train/transports/ssh.rb:240:in `new'
2020-02-11T22:07:29.2975358Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/train-core-3.2.14/lib/train/transports/ssh.rb:240:in `create_new_connection'
2020-02-11T22:07:29.3011341Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/train-core-3.2.14/lib/train/transports/ssh.rb:82:in `connection'
2020-02-11T22:07:29.3175466Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/inspec-core-4.18.85/lib/inspec/backend.rb:38:in `create'
2020-02-11T22:07:29.3185016Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/inspec-core-4.18.85/lib/inspec/runner.rb:86:in `configure_transport'
2020-02-11T22:07:29.3191486Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/inspec-core-4.18.85/lib/inspec/runner.rb:78:in `initialize'
2020-02-11T22:07:29.3196098Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/inspec-core-4.18.85/lib/inspec/cli.rb:286:in `new'
2020-02-11T22:07:29.3200403Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/inspec-core-4.18.85/lib/inspec/cli.rb:286:in `exec'
2020-02-11T22:07:29.3208428Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/thor-0.20.3/lib/thor/command.rb:27:in `run'
2020-02-11T22:07:29.3215933Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/thor-0.20.3/lib/thor/invocation.rb:126:in `invoke_command'
2020-02-11T22:07:29.3219981Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/thor-0.20.3/lib/thor.rb:387:in `dispatch'
2020-02-11T22:07:29.3223878Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/thor-0.20.3/lib/thor/base.rb:466:in `start'
2020-02-11T22:07:29.3224444Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/inspec-core-4.18.85/lib/inspec/base_cli.rb:35:in `start'
2020-02-11T22:07:29.3232126Z amazon-ebs: from C:/opscode/inspec/embedded/lib/ruby/gems/2.6.0/gems/inspec-bin-4.18.85/bin/inspec:11:in `'
2020-02-11T22:07:29.3232948Z amazon-ebs: from C:/opscode/inspec/bin/inspec:205:in `load'
2020-02-11T22:07:29.3244925Z amazon-ebs: from C:/opscode/inspec/bin/inspec:205:in `'
2020-02-11T22:07:29.3278660Z 2020/02/11 22:07:29 packer.exe plugin: shutting down the SSH proxy
2020-02-11T22:07:29.3283343Z 2020/02/11 22:07:29 [INFO] (telemetry) ending inspec
|
I found out that Packer 1.3.5 comes with the Inspec provisioner built-in. This is awesome. I immediately tried it for a Packer build for a Windows VM. And here I struggled a little bit as the detection for Windows only checks if the winrm transport is used.
I run the Packer build on a non-Windows machine (macOS in my case) and so the other detections doesn't see that the target is a Windows machine.
I've opened hashicorp/packer#7364 to raise awareness in the Packer repo, but I also tried to find out what the root cause is.
Here is my take how to improve the detection. I know that now the first SSH command to any Linux machine will be
cmd /c ver
instead ofuname -s
.Maybe somebody else can find a better "Linux first, but don't forget Windows" approach as I don't know the codebase.
With that change I can run Inspec tests in the Windows VM from my MBP. 🎉
The command would be the command created by the packer Inspec provisioner to talk to a temporary local SSH agent that forwards all commands to the Packer WinRM communicator. For Inspec it is a SSH connection and the Packer provisioner does the rest.