Having vagrant provisioning clone a repository,

Question

I'm trying to build an environment that when it finishes bringing the VM up it clones a repository into the share directory. The problem is that the box doesn't have SSH permission on the remote repository.

I have a simple bash script:

#!/bin/bash
cd /vagrant
if [ ! -d "repo" ]; then
  git clone [email protected]:/my/repo.git
end

I get the error:

Host key verification failed.

fatal: The remote end hung up unexpectedly

Which makes sense since there is no keys in /home/vagrant/.ssh

I've done a fair bit of googling to no avail, I've tried to set config.ssh.forward_agent = true which allows me to manually clone the repo when I'm ssh'ed into the machine but not when it tries to run itself. I've also tried to specify config.ssh.private_ssh_key = "~/.ssh/id_rsa" but then vagrant simply won't finish loading (I assume the application can't ssh into the box).

So my question is... Do I need to rebuild my base box to include a set of keys and authorize those keys with my remote repo? Or is there an easier solution I'm missing?

note: I've looked at SSH Basics on Vagrant VMs which seem similar but I think this is more about setting up a different user on the box and the solution posted is much more manual than I'd like.

Answer 1

The temporary solution for me was to generate a set of keys and place them in the same directory as the Vagrantfile, then when provisioning I copy the keys over into /root/.ssh/ . There was one small hitch with this and that was that I also had to generate a known_hosts file in order for the VM to accept the connection from the remote server. The known_hosts file also resides in the /vagrant/.ssh/ dir and gets copied over with the keys and everything is now working.

Eventually when I'm not trying to upload a 1GB box to my file host over spotty wi-fi the real solution will be to include these files in the basebox permanently.

Answer 2

There's some stuff about this here: https://serverfault.com/questions/107187/ssh-agent-forwarding-and-sudo-to-another-user - the summary is that SSH forwarding works via an environment variable that isn't preserved by su. Solutions at various levels of Unix-fu are suggested; I went with a cheap and cheerful one:

su -c "export SSH_AUTH_SOCK=$SSH_AUTH_SOCK; CMD" -l vagrant

where CMD is the command you want to run.

This then lets me run git clone as vagrant during provisioning, so I can clone GitHub/Bitbucket repos using the public SSH key from my OS X host system without having everything end up owned by root. And the only other step required is to prepopulate ~/.ssh/known_hosts with any required keys (which I imagine you're already doing).

(Unlike the situation on a real system (see comments to the answer suggesting this - https://serverfault.com/a/371788/321408), there's no need to change the socket permissions, since it's already owned by vagrant - something that the vagrant ssh mechanism handles for you, I assume. So I don't believe that there are any security issues associated with doing this.)