packer and ssh provisioner via socks/other proxy (Question/Feature Request)

[sirmax123]

Hi!

I have the following issue: I ran packer on builder node which does not have direct ssh access to network used for build.

So for now builds are failed because builder can't connect directly to VM instances.
(it is GCP but it does not matter)

I tried to use proxychains-ng (https://github.com/rofl0r/proxychains-ng) but it looks like

• packer do not use shared libs (on mac) so I'm mot able to use hooks like this
• it does not use external ssh (so ~/.ssh/config will not help). Do packer use native go ssh lib?

If no root access/no iptables at all on builder node so not able to use power of netfilter w/o root or on other Unix systems.

My questions are:

1. Is it possible to use socks proxy for ssh in packer and how? if not it would be great to have such feature. (Not sure if it possible to use socks proxy with go ssh lib).
   1.1 Support ssh config compatible with OpenSSH (~/.ssh/config) also would be very very helpful.

2. Is it possible to build packer with shared libs to be able to use socksifiers? And how?

[mwhooker]

We have the notion of a bastion host for this problem. Please see https://www.packer.io/docs/templates/communicator.html#ssh-communicator

There's more context on this decision at #2266

[sirmax123]

Bastion host is NOT a solution because you need ssh access.
But very often you have only SOCKS/HTTP with Connect method proxy without full ssh access.

So it is just workaround for some cases and do not solve issue in general.

[rickard-von-essen]

1. Is it possible to use socks proxy for ssh in packer and how? if not it would be great to have such feature. (Not sure if it possible to use socks proxy with go ssh lib).

It might be possible to add support via for SOCKS5 with go-socks but it might be a lot of work or impossible to mangle it into the SSH code. PR's are welcome. Another solutions is just to tell the networking guys that you will defeat their network filtering.

1.1 Support ssh config compatible with OpenSSH (~/.ssh/config) also would be very very helpful.

That would be a very big task, OpenSSH is a complex software.

2. Is it possible to build packer with shared libs to be able to use socksifiers? And how?

No, Go doesn't use any shared libs.

[pkilar]

@rickard-von-essen take a look at #5439 and give it a try

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.