gcloud 将 ssh 从一个虚拟机计算到 Google Cloud 上的另一个虚拟机

Question

I am trying to ssh into a VM from another VM in Google Cloud using the gcloud compute ssh command. It fails with the below message:

/usr/local/bin/../share/google/google-cloud-sdk/./lib/googlecloudsdk/compute/lib/base_classes.py:9: DeprecationWarning: the sets module is deprecated
  import sets

 Connection timed out
ERROR: (gcloud.compute.ssh) [/usr/bin/ssh] exited with return code [255]. See https://cloud.google.com/compute/docs/troubleshooting#ssherrors for troubleshooting hints.

I made sure the ssh keys are in place but still it doesn't work. What am I missing here?

Answer 1

There is an assumption that you have connected to the externally-visible instance using SSH beforehand with gcloud.

From your local machine, start ssh-agent with the following command to manage your keys for you:

me@local:~$ eval `ssh-agent`

Call ssh-add to load the gcloud compute public keys from your local computer into the agent, and use them for all SSH commands for authentication:

me@local:~$ ssh-add ~/.ssh/google_compute_engine

Log into an instance with an external IP address while supplying the -A argument to enable authentication agent forwarding.

gcloud compute ssh --ssh-flag="-A" INSTANCE

source: https://cloud.google.com/compute/docs/instances/connecting-to-instance#sshbetweeninstances .

I am not sure about the 'flags' because it's not working for me bu maybe I have a different OS or Gcloud version and it will work for you.

Answer 2

Here are the steps I ran on my Mac to connect to the Google Dataproc master VM and then hop onto a worker VM from the master MV. I ssh'd to the master VM to get the IP.

$ gcloud compute ssh cluster-for-cameron-m Warning: Permanently added '104.197.45.35' (ECDSA) to the list of known hosts.

I then exit ed. I enabled forwarding for that host.

$ nano ~/.ssh/config

Host 104.197.45.35 ForwardAgent yes

I added the gcloud key. $ ssh-add ~/.ssh/google_compute_engine

I then verified that it was added by listing the key fingerprints with ssh-add -l . I reconnected to the master VM and ran ssh-add -l again to verify that the keys were indeed forwarded. After that, connecting to the worker node worked just fine.

ssh cluster-for-cameron-w-0

Answer 3

About using SSH Agent Forwarding...

Because instances are frequently created and destroyed on the cloud, the (recreated) host fingerprint keeps changing. If the new fingerprint doesn't match with ~/.ssh/known_hosts , SSH automatically disables Agent Forwarding. The solution is:

$  ssh -A -o UserKnownHostsFile=/dev/null ...