# docker-ssh-proxy
Docker ssh proxy repo. This repo contains a Dockerfile to build a docker image that can be used as Fivetran or Looker ssh proxy
to connect to databases that are not publicly accessible in AWS. 

![Python version](https://img.shields.io/badge/python-3.12-blue)
![Static Badge](https://img.shields.io/badge/jenkins_pipline-blue?logo=jenkins&logoColor=black&labelColor=red&link=https%3A%2F%2Fpipeline.theorchard.io%2Fjob%2Ftheorchard%2Fjob%2Fdocker-ssh-proxy%2F)

This repository contains the `entrypoint.py` script, which is used as the entry point for the Docker SSH Proxy.

## Description

The `entrypoint.py` script performs several operations to set up an SSH proxy user and configure SSHD for the Docker container.

## Features

- Creates a proxy user in the Docker container.
- Copies authorized SSH keys for valid proxy users.
- Removes existing SSH host keys.
- Retrieves and sets SSHD host keys from AWS Secrets Manager.
- Updates the SSHD configuration with the database host.

## Usage

The script is designed to be run as the entry point for the Docker container. It requires several environment variables to be set:

- `PROXY_USER`: The name of the proxy user to create.
- `Environment`: The environment in which the service is running (used to retrieve secrets from AWS Secrets Manager).
- `SERVICE_NAME`: The name of the service (used to retrieve secrets from AWS Secrets Manager).
- `PERMIT_DB_HOST`: The database host to be used in the SSHD configuration.

## Dependencies

- Python 3.12
- boto3

## Infrastructure
- AWS ECS

## Notes
- AWS Secrets Manager is used to store the SSHD host keys and the authorized SSH keys for the proxy user.
- The script retrieves these secrets using the `Environment` and `SERVICE_NAME` environment variables.
- If AWS Secrets Manager secrets are not found, ECS task will fail to start.
- To upload the SSHD host keys to AWS Secrets Manager, build the Docker image and run the container locally with the `--entrypoint` flag set to `/bin/bash`.
Then run these commands in the container:
```bash
# Install and configure aws-cli
pip install awscli
aws configure

Use the following values:
AWS Access Key ID [None]: <access_key>
AWS Secret: <secret_key>
Default region name [None]: us-east-1
Default output format [None]: text

# Remove existing SSH host keys
rm -f /etc/ssh/ssh_host_*key*

# Example for generating new SSH host keys for fivetran
ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N ''
ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key -N ''
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''

# Upload the new keys to AWS Secrets Manager
aws secretsmanager update-secret --secret-id prod/fivetran-rds-proxy/SSH_HOST_RSA_KEY --secret-string file:///etc/ssh/ssh_host_rsa_key
aws secretsmanager update-secret --secret-id prod/fivetran-rds-proxy/SSH_HOST_ECDSA_KEY --secret-string file:///etc/ssh/ssh_host_ecdsa_key
aws secretsmanager update-secret --secret-id prod/fivetran-rds-proxy/SSH_HOST_ED25519_KEY --secret-string file:///etc/ssh/ssh_host_ed25519_key

# Upload the public keys to AWS Secrets Manager
aws secretsmanager update-secret --secret-id prod/fivetran-rds-proxy/SSH_HOST_RSA_KEY_PUB --secret-string file:///etc/ssh/ssh_host_rsa_key.pub
aws secretsmanager update-secret --secret-id prod/fivetran-rds-proxy/SSH_HOST_ECDSA_KEY_PUB --secret-string file:///etc/ssh/ssh_host_ecdsa_key.pub
aws secretsmanager update-secret --secret-id prod/fivetran-rds-proxy/SSH_HOST_ED25519_KEY_PUB --secret-string file:///etc/ssh/ssh_host_ed25519_key.pub