Where's /etc/pve/firewall/cluster.fw in rescue images?

2024-10-04T00:00:00+00:00

Why, You Ask?

If a firewall rule has locked you out of a Proxmox server, you can disable the firewall from a rescue system. Here is the process I used to regain access.

Step 1: Mount the Proxmox System

First, you need to access your Proxmox filesystem. If you're using LVM (Logical Volume Management), this step is pretty straightforward:

mount /dev/mapper/vg0-root /mnt

With your filesystem mounted, chroot into it:

chroot /mnt/

Now you're inside your system, ready to work some magic.

Step 2: Disabling the Firewall

The firewall is likely what caused you to get locked out, so we'll need to disable it temporarily. Run the following commands:

systemctl disable pve-firewall
systemctl mask pve-firewall

Once you've done that, reboot the server. You should now be able to reconnect to your system normally, without the firewall cutting you off.

Step 3: Fix the Issue and Restore the Firewall

After fixing whatever issue got you locked out, it's time to re-enable the firewall. Run these commands to restore it:

systemctl unmask pve-firewall
systemctl enable pve-firewall
systemctl start pve-firewall

Your firewall should now be back up and running, but without the lockout problem.

A Note About `/etc/pve/firewall/cluster.fw`

If you're hunting for /etc/pve/firewall/cluster.fw while in rescue mode, hoping it's a typical file you can modify directly, you're out of luck. This file is part of Proxmox's cluster-wide configuration and is not stored as a regular file on the disk. Instead, it's managed through Proxmox's internal database, which is part of the Proxmox Cluster File System (pmxcfs). As such, it doesn't exist as a standalone file you can access from rescue mode. To modify this configuration, you'll need to regain full access to Proxmox and make changes from within the Proxmox interface or by editing it via the proper tools once you're back online.

Summary

And there you have it! With your system back up and running, and the firewall behaving, you can get back to managing your Proxmox server. Just be cautious next time you tweak the firewall rules - locking yourself out isn't the most fun way to spend your day!

Simplify SSH

2024-10-03T00:00:00+00:00

Why, You Ask?

I was tired of entering my SSH key passphrase every time I connected to a server. The setup below lets ssh-agent remember it for the current terminal session and also keeps host settings in one place.

It's time-consuming and frustrating. I'm tired of it.

Getting Started

So, you've got your shiny new SSH key and every time you want to connect to a server, you're greeted with that ever-familiar password prompt. Sure, typing your SSH key passphrase every time is good for security, but, come on - who wants to do that? I mean, I don't know about you, but I've got enough passwords to remember without constantly dealing with this nonsense.

Let's save ourselves some time and effort by getting the SSH agent to remember our keys for us. That way, you can just run your commands like the seasoned developer you are without worrying about the whole "password entering" thing every single time.

Step 1: Start the SSH Agent

First things first - let's get the SSH agent up and running. It's like your personal SSH butler, here to remember your key so you don't have to.

Open up your terminal and type:

eval $(ssh-agent -s)

Boom! Now the agent is running in the background, ready to hold your keys like the responsible little daemon it is.

Step 2: Add your key to the SSH Agent

Now that the agent is up, let's give it your key. You only need to do this once per session, and the agent will keep it ready for you.

ssh-add ~/.ssh/your_key

Replace your_key with the name of your private key file. Enter the passphrase once and ssh-agent will remember it for the rest of the terminal session.

Step 3: Configure your SSH setup to be even lazier (I mean efficient)

Okay, we've got the agent running and the key added, but we can take it one step further. Why not tell SSH exactly what key to use for which server, so you never have to worry about it picking the wrong one?

To do this, we're going to set up a ~/.ssh/config file. If you don't have this file yet, don't worry - it's as easy as creating it:

touch ~/.ssh/config

Now, crack open that file with your favorite text editor and set things up like this:

Host your-server-alias
    HostName your.server.com
    User your-username
    IdentityFile ~/.ssh/your_key
    IdentitiesOnly yes

Breaking it down

Host: You can use any alias here that makes sense to you. This is what you'll type when you want to connect to this server.
HostName: The actual domain or IP address of the server.
User: Your username on that server, so you do not have to specify it each time.
IdentityFile: The path to your SSH private key.
IdentitiesOnly yes: Tells SSH to use only this key, rather than trying every key it can find in the agent (which is how you avoid that annoying "user mismatch" issue).

Step 4: Create a wrapper script for SSH Agent control

Alright, you want control over when your SSH agent starts up - totally understandable! Instead of running the agent automatically on login (which might feel a bit too autonomous), we'll create a neat little wrapper script. You can trigger it whenever you feel like starting the agent and adding your SSH key for the session.

Here's how to set that up.

Create the wrapper script

Let's create a script that starts the SSH agent, adds your key, and gives you control over when it runs. We'll call this script init-ssh, and we'll stick it somewhere like /usr/local/bin so it's available from anywhere in your terminal.

Create the script: Open your terminal and create the init-ssh script:
```
sudo nano /usr/local/bin/init-ssh
```

Add the script content: Paste the following content into the file:

#!/bin/bash

# Start the SSH agent
eval $(ssh-agent -s)

# Add the key to the agent
ssh-add ~/.ssh/your_key

# Optional: Display agent status for peace of mind
ssh-add -l

Make the script executable: Give the script executable permissions:
```
sudo chmod +x /usr/local/bin/init-ssh
```

How to use the script

Whenever you want to start your SSH agent for a session, just run:

. init-ssh

This will start the agent, add your key, and show you a list of the keys currently loaded in the agent. You've got full control - start the agent when you want, stop it when you're done, and enjoy a password-free SSH experience for the duration of that session.

Optional: Stopping the SSH Agent

If you want to stop the SSH agent after you're done with it, you can either let it die when you close your terminal or manually kill it with:

eval $(ssh-agent -k)

That way, you get all the convenience of an SSH agent when you need it, without it running indefinitely in the background. You're now in complete control of your SSH setup, and you can keep things secure and efficient, exactly the way you like it.

Happy SSH'ing!

svnscha - sysadmin

Where's /etc/pve/firewall/cluster.fw in rescue images?

Why, You Ask?

Step 1: Mount the Proxmox System

Step 2: Disabling the Firewall

Step 3: Fix the Issue and Restore the Firewall

A Note About /etc/pve/firewall/cluster.fw

Summary

Simplify SSH

Why, You Ask?

Getting Started

Step 1: Start the SSH Agent

Step 2: Add your key to the SSH Agent

Step 3: Configure your SSH setup to be even lazier (I mean efficient)

Breaking it down

Step 4: Create a wrapper script for SSH Agent control

Create the wrapper script

How to use the script

Optional: Stopping the SSH Agent

A Note About `/etc/pve/firewall/cluster.fw`