GCP - Revision history

M at 21:26, 26 April 2022

2022-04-26T21:26:08Z

← Older revision		Revision as of 21:26, 26 April 2022
Line 6:		Line 6:
	gcloud config set compute/zone us-east4-a		gcloud config set compute/zone us-east4-a
	# see es command for more		# see es command for more
			==== Increase VM hard drive size ====
			Allegedly you don't even have to stop the VM to do this! Maybe better to do so, though.
			Compute Engine > Storage > Disks > (find the VM's matching disk) > Edit > Upsize it
	==== Cloning a VM ====		==== Cloning a VM ====
	* Create an image of an existing VM, with the same name. It will be added under...		* Create an image of an existing VM, with the same name. It will be added under...

M: /* Install gcloud CLI */

2022-03-08T18:16:18Z

Install gcloud CLI

← Older revision		Revision as of 18:16, 8 March 2022
Line 42:		Line 42:

	=== Install gcloud CLI ===		=== Install gcloud CLI ===
			sudo apt-get install apt-transport-https ca-certificates gnupg
			echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" \| sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
	curl https://packages.cloud.google.com/apt/doc/apt-key.gpg \| sudo apt-key --keyring /usr/share/keyrings/cloud.google.gpg add -		curl https://packages.cloud.google.com/apt/doc/apt-key.gpg \| sudo apt-key --keyring /usr/share/keyrings/cloud.google.gpg add -
	~~echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" \|~~ sudo ~~tee -a /etc/~~apt~~/sources.list.d/google-cloud~~-~~sdk.list~~		sudo apt-get update && sudo apt-get install google-cloud-cli
	~~sudo apt~~ update
	sudo apt install google-cloud-~~sdk~~
	[https://cloud.google.com/sdk/docs/install#deb Details]		[https://cloud.google.com/sdk/docs/install#deb Details]
	Then you should copy the ssh key from another location:		Then you should copy the ssh key from another location:
	scp -r case:.ssh/google_compute* ~/.ssh/		scp -r case:.ssh/google_compute* ~/.ssh/

M: /* Set up a new VM for gcloud SSH 2fa access */

2022-02-07T13:31:22Z

Set up a new VM for gcloud SSH 2fa access

← Older revision		Revision as of 13:31, 7 February 2022
Line 17:		Line 17:
	** Specifically request IAP tunneling:		** Specifically request IAP tunneling:
	gcloud compute ssh box-1 --tunnel-through-iap		gcloud compute ssh box-1 --tunnel-through-iap
	* Add a network tag to the VM that allows access - it ~~seems I don't have rights to tags, but I can use `demo-meteor-1` to get the job done~~		* Add a network tag to the VM that allows access - not sure which rules for IAP yet... try SSH and see if that's it...

	==== Harden SSH to internal connections only ====		==== Harden SSH to internal connections only ====

M: /* Set up a new VM for gcloud SSH 2fa access */

2022-02-07T13:30:27Z

Set up a new VM for gcloud SSH 2fa access

← Older revision		Revision as of 13:30, 7 February 2022
Line 13:		Line 13:
	Edit the network and change the External IP from Ephemeral to None.		Edit the network and change the External IP from Ephemeral to None.
	==== Set up a new VM for gcloud SSH 2fa access ====		==== Set up a new VM for gcloud SSH 2fa access ====
	* Remove external IP (see above) - this will force `gcloud compute ssh...` to use "IAP Tunneling".		* Do one of these:
			** Remove external IP (see above) - this will force `gcloud compute ssh...` to use "IAP Tunneling".
			** Specifically request IAP tunneling:
			gcloud compute ssh box-1 --tunnel-through-iap
	* Add a network tag to the VM that allows access - it seems I don't have rights to tags, but I can use `demo-meteor-1` to get the job done		* Add a network tag to the VM that allows access - it seems I don't have rights to tags, but I can use `demo-meteor-1` to get the job done

	==== Harden SSH to internal connections only ====		==== Harden SSH to internal connections only ====
	* create a FUCKING NORMAL SSH CONNECTION from source to target machine (it won't work, that's ok, but you better do it right)		* create a FUCKING NORMAL SSH CONNECTION from source to target machine (it won't work, that's ok, but you better do it right)

M at 18:38, 29 January 2022

2022-01-29T18:38:02Z

← Older revision		Revision as of 18:38, 29 January 2022
Line 1:		Line 1:
	=== Basics ===		=== Tasks ===
			==== Basics ====
	Auth		Auth
	gcloud auth login		gcloud auth login
Line 5:		Line 6:
	gcloud config set compute/zone us-east4-a		gcloud config set compute/zone us-east4-a
	# see es command for more		# see es command for more
	~~=== Tasks ===~~
	==== Cloning a VM ====		==== Cloning a VM ====
	* Create an image of an existing VM, with the same name. It will be added under...		* Create an image of an existing VM, with the same name. It will be added under...

M at 18:37, 29 January 2022

2022-01-29T18:37:05Z

@@ Line 5: / Line 5: @@
   gcloud config set compute/zone us-east4-a
   # see es command for more
 === Tasks ===
 ==== Cloning a VM ====
@@ Line 20: / Line 11: @@
 * Create a new VM from the machine image
 ==== Remove external IP ====
-You can edit the network and remove the External IP there, but it never seems enough.  Additional steps to get it done:
+Edit the network and change the External IP from Ephemeral to None.
- gcloud compute instances describe box-1
+==== Set up a new VM for gcloud SSH 2fa access ====
-               networkInteface
+* Remove external IP (see above) - this will force `gcloud compute ssh...` to use "IAP Tunneling".
-                - accessConfigs:
+* Add a network tag to the VM that allows access - it seems I don't have rights to tags, but I can use `demo-meteor-1` to get the job done
 ==== Harden SSH to internal connections only ====
 * create a FUCKING NORMAL SSH CONNECTION from source to target machine (it won't work, that's ok, but you better do it right)
@@ Line 38: / Line 25: @@
 ** restart
 * Now normal ssh should start working

M: /* Harden SSH to internal connections only */

2021-07-02T19:06:50Z

Harden SSH to internal connections only

← Older revision		Revision as of 19:06, 2 July 2021
Line 29:		Line 29:
	# REBOOT THE VM		# REBOOT THE VM
	==== Harden SSH to internal connections only ====		==== Harden SSH to internal connections only ====
	* create a FUCKING NORMAL SSH CONNECTION from source to target machine		* create a FUCKING NORMAL SSH CONNECTION from source to target machine (it won't work, that's ok, but you better do it right)
	* make the user that is connectable FULL SUDO or you will be fucked out of access!		* make the user that is connectable FULL SUDO or you will be fucked out of access!
	sudo visudo # and change sudo group to: (ALL) NOPASSWD: ALL		sudo visudo # and change sudo group to: (ALL) NOPASSWD: ALL

M: /* Harden SSH to internal connections only */

2021-07-02T17:07:29Z

Harden SSH to internal connections only

← Older revision		Revision as of 17:07, 2 July 2021
Line 31:		Line 31:
	* create a FUCKING NORMAL SSH CONNECTION from source to target machine		* create a FUCKING NORMAL SSH CONNECTION from source to target machine
	* make the user that is connectable FULL SUDO or you will be fucked out of access!		* make the user that is connectable FULL SUDO or you will be fucked out of access!
			sudo visudo # and change sudo group to: (ALL) NOPASSWD: ALL
			sudo usermod -a -G sudo esauto
	* Remove the GCP ssh bullshit		* Remove the GCP ssh bullshit
	** set metadata key enable-oslogin to FALSE		** set metadata key enable-oslogin to FALSE

M: /* Harden SSH to internal connections only */

2021-07-02T16:40:48Z

Harden SSH to internal connections only

← Older revision		Revision as of 16:40, 2 July 2021
Line 30:		Line 30:
	==== Harden SSH to internal connections only ====		==== Harden SSH to internal connections only ====
	* create a FUCKING NORMAL SSH CONNECTION from source to target machine		* create a FUCKING NORMAL SSH CONNECTION from source to target machine
			* make the user that is connectable FULL SUDO or you will be fucked out of access!
	* Remove the GCP ssh bullshit		* Remove the GCP ssh bullshit
	** set metadata key enable-oslogin to FALSE		** set metadata key enable-oslogin to FALSE

M at 16:16, 2 July 2021

2021-07-02T16:16:24Z

← Older revision		Revision as of 16:16, 2 July 2021
Line 28:		Line 28:
	gcloud compute instances delete-access-config box-1 --access-config-name "External NAT"		gcloud compute instances delete-access-config box-1 --access-config-name "External NAT"
	# REBOOT THE VM		# REBOOT THE VM
			==== Harden SSH to internal connections only ====
			* create a FUCKING NORMAL SSH CONNECTION from source to target machine
			* Remove the GCP ssh bullshit
			** set metadata key enable-oslogin to FALSE
			** [x] block project-wide ssh
			** restart
			* Now normal ssh should start working