Infrastructure » sepia

adam kraitman wrote:

Hey Aishwarya, Are these new/additional or replacement credentials ?

Thanks,

Adam

Hey Adam, these are new credentials because I have received a new laptop.

Regards,
Aishwarya

Hi Aishwarya Mathuria,

You should have access to the Sepia lab now. Please verify you're able to connect to the vpn and ssh amathuri@teuthology.front.sepia.ceph.com using the private key matching the pubkey you provided.

Be sure to check out the following links for final workstation setup steps:
https://wiki.sepia.ceph.com/doku.php?id=vpnaccess#vpn_client_access
https://wiki.sepia.ceph.com/doku.php?id=testnodeaccess#ssh_config

Most developers choose to schedule runs from the shared teuthology VM. For information on that, see http://docs.ceph.com/teuthology/docs/intro_testers.html

Thanks

adam kraitman wrote:

Hi Aishwarya Mathuria,

You should have access to the Sepia lab now. Please verify you're able to connect to the vpn and ssh amathuri@teuthology.front.sepia.ceph.com using the private key matching the pubkey you provided.

Be sure to check out the following links for final workstation setup steps:
https://wiki.sepia.ceph.com/doku.php?id=vpnaccess#vpn_client_access
https://wiki.sepia.ceph.com/doku.php?id=testnodeaccess#ssh_config

Most developers choose to schedule runs from the shared teuthology VM. For information on that, see http://docs.ceph.com/teuthology/docs/intro_testers.html

Thanks

Hi Adam,

I am able to connect to the VPN however ssh into teuthology is not working. I have followed the steps in the ssh config page you have mentioned as well.
Should I wait for sometime and try again?

Thanks

Which error you see when you try to ssh ?
And also paste the output of:
sudo systemctl status openvpn@sepia
sudo systemctl status openvpn-client@sepia

adam kraitman wrote:

Which error you see when you try to ssh ?
And also paste the output of:
sudo systemctl status openvpn@sepia
sudo systemctl status openvpn-client@sepia

The connection just times out.

Output:

[amathuri@localhost ~]$ sudo systemctl status openvpn-client@sepia
● openvpn-client@sepia.service - OpenVPN tunnel for sepia
Loaded: loaded (/usr/lib/systemd/system/openvpn-client@.service; enabled; vendor preset: disabled)
Active: inactive (dead) since Fri 2021-03-05 16:38:05 IST; 2 days ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Main PID: 125551 (code=exited, status=0/SUCCESS)
Status: "Pre-connection initialization successful"
CPU: 24ms

Mar 05 16:38:02 localhost.localdomain openvpn¹²⁵⁵⁵¹: VERIFY KU OK
Mar 05 16:38:02 localhost.localdomain openvpn¹²⁵⁵⁵¹: Validating certificate extended key usage
Mar 05 16:38:02 localhost.localdomain openvpn¹²⁵⁵⁵¹: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mar 05 16:38:02 localhost.localdomain openvpn¹²⁵⁵⁵¹: VERIFY EKU OK
Mar 05 16:38:02 localhost.localdomain openvpn¹²⁵⁵⁵¹: VERIFY OK: depth=0, O=Redhat, CN=openvpn-sepia
Mar 05 16:38:04 localhost.localdomain openvpn¹²⁵⁵⁵¹: Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2432 bit RSA
Mar 05 16:38:04 localhost.localdomain openvpn¹²⁵⁵⁵¹: [openvpn-sepia] Peer Connection Initiated with [AF_INET]8.43.84.129:1194
Mar 05 16:38:05 localhost.localdomain openvpn¹²⁵⁵⁵¹: AUTH: Received control message: AUTH_FAILED
Mar 05 16:38:05 localhost.localdomain openvpn¹²⁵⁵⁵¹: SIGTERM[soft,auth-failure] received, process exiting
Mar 05 16:38:05 localhost.localdomain systemd¹: openvpn-client@sepia.service: Succeeded.

Hey Aishwarya,
If you re-run the new-client script, It's unfortunately not idempotent so if you re-ran it and still have the output, we'll need the new string it printed. If you don't have the output, please re-run it again and send the new string.

adam kraitman wrote:

Hey Aishwarya,
If you re-run the new-client script, It's unfortunately not idempotent so if you re-ran it and still have the output, we'll need the new string it printed. If you don't have the output, please re-run it again and send the new string.

Hey Adam,
The VPN credentials I have mentioned here were obtained from running the command on the new laptop. Should I still re-run it?

Aishwarya Mathuria wrote:

adam kraitman wrote:

Hey Aishwarya,
If you re-run the new-client script, It's unfortunately not idempotent so if you re-ran it and still have the output, we'll need the new string it printed. If you don't have the output, please re-run it again and send the new string.

Hey Adam,
The VPN credentials I have mentioned here were obtained from running the command on the new laptop. Should I still re-run it?

Hey Adam,

I restarted the service and here is the output of systemctl status openvpn-client@sepia:

sudo systemctl status openvpn-client@sepia
● openvpn-client@sepia.service - OpenVPN tunnel for sepia
     Loaded: loaded (/usr/lib/systemd/system/openvpn-client@.service; enabled; vendor preset: disabled)
     Active: active (running) since Mon 2021-03-08 18:33:22 IST; 3s ago
       Docs: man:openvpn(8)
             https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
             https://community.openvpn.net/openvpn/wiki/HOWTO
   Main PID: 181925 (openvpn)
     Status: "Pre-connection initialization successful" 
      Tasks: 1 (limit: 38188)
     Memory: 2.3M
        CPU: 18ms
     CGroup: /system.slice/system-openvpn\x2dclient.slice/openvpn-client@sepia.service
             └─181925 /usr/sbin/openvpn --suppress-timestamps --nobind --config sepia.conf

Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: VERIFY OK: depth=1, O=Redhat, CN=openvpnca-sepia
Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: VERIFY KU OK
Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: Validating certificate extended key usage
Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: VERIFY EKU OK
Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: VERIFY OK: depth=0, O=Redhat, CN=openvpn-sepia
Mar 08 18:33:25 localhost.localdomain openvpn¹⁸¹⁹²⁵: Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2432 bit RSA
Mar 08 18:33:25 localhost.localdomain openvpn¹⁸¹⁹²⁵: [openvpn-sepia] Peer Connection Initiated with [AF_INET]8.43.84.129:1194

Aishwarya Mathuria wrote:

Aishwarya Mathuria wrote:

adam kraitman wrote:

Hey Aishwarya,
If you re-run the new-client script, It's unfortunately not idempotent so if you re-ran it and still have the output, we'll need the new string it printed. If you don't have the output, please re-run it again and send the new string.

Hey Adam,
The VPN credentials I have mentioned here were obtained from running the command on the new laptop. Should I still re-run it?

Hey Adam,

I restarted the service and here is the output of systemctl status openvpn-client@sepia:

sudo systemctl status openvpn-client@sepia
● openvpn-client@sepia.service - OpenVPN tunnel for sepia
Loaded: loaded (/usr/lib/systemd/system/openvpn-client@.service; enabled; vendor preset: disabled)
Active: active (running) since Mon 2021-03-08 18:33:22 IST; 3s ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Main PID: 181925 (openvpn)
Status: "Pre-connection initialization successful"
Tasks: 1 (limit: 38188)
Memory: 2.3M
CPU: 18ms
CGroup: /system.slice/system-openvpn\x2dclient.slice/openvpn-client@sepia.service
└─181925 /usr/sbin/openvpn --suppress-timestamps --nobind --config sepia.conf

Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: VERIFY OK: depth=1, O=Redhat, CN=openvpnca-sepia
Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: VERIFY KU OK
Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: Validating certificate extended key usage
Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: VERIFY EKU OK
Mar 08 18:33:23 localhost.localdomain openvpn¹⁸¹⁹²⁵: VERIFY OK: depth=0, O=Redhat, CN=openvpn-sepia
Mar 08 18:33:25 localhost.localdomain openvpn¹⁸¹⁹²⁵: Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2432 bit RSA
Mar 08 18:33:25 localhost.localdomain openvpn¹⁸¹⁹²⁵: [openvpn-sepia] Peer Connection Initiated with [AF_INET]8.43.84.129:1194

Once I run the systemctl enable openvpn-client@sepia command and then check the status I get the output I had pasted before.
In case this helps.

From looking at the gateway logs it seems that you are using the wrong hashed VPN credentials
openvpn: ERROR:auth-openvpn:auth-openvpn: invalid auth for user 'amathuri@thinkpad'

please re-run the new-client script and send the new string

adam kraitman wrote:

From looking at the gateway logs it seems that you are using the wrong hashed VPN credentials
openvpn: ERROR:auth-openvpn:auth-openvpn: invalid auth for user 'amathuri@thinkpad'

please re-run the new-client script and send the new string

I have re-run the new-client script and the following are the VPN credentials:

amathuri@lenovothinkpad MhlrEG4X+iKq2d2GxwMbmA 812cfea500340140144ecb27f7851b86d8daff658f173189fceec8e61b59cbf2

Aishwarya Mathuria wrote:

adam kraitman wrote:

From looking at the gateway logs it seems that you are using the wrong hashed VPN credentials
openvpn: ERROR:auth-openvpn:auth-openvpn: invalid auth for user 'amathuri@thinkpad'

please re-run the new-client script and send the new string

I have re-run the new-client script and the following are the VPN credentials:

amathuri@lenovothinkpad MhlrEG4X+iKq2d2GxwMbmA 812cfea500340140144ecb27f7851b86d8daff658f173189fceec8e61b59cbf2

Hi Adam,

ssh is working now. Thank you!

Regards,
Aishwarya