GCP

Tasks

Basics

Auth

gcloud auth login

Set project and zone

gcloud config set compute/zone us-east4-a
# see es command for more

Cloning a VM

• Create an image of an existing VM, with the same name. It will be added under...

Compute Engine > VMs > Machine images

• Create a new VM from the machine image

Remove external IP

Edit the network and change the External IP from Ephemeral to None.

Set up a new VM for gcloud SSH 2fa access

• Do one of these:
  • Remove external IP (see above) - this will force `gcloud compute ssh...` to use "IAP Tunneling".
  • Specifically request IAP tunneling:

gcloud compute ssh box-1 --tunnel-through-iap

• Add a network tag to the VM that allows access - it seems I don't have rights to tags, but I can use `demo-meteor-1` to get the job done

Harden SSH to internal connections only

• create a FUCKING NORMAL SSH CONNECTION from source to target machine (it won't work, that's ok, but you better do it right)
• make the user that is connectable FULL SUDO or you will be fucked out of access!

sudo visudo # and change sudo group to: (ALL) NOPASSWD: ALL
sudo usermod -a -G sudo esauto

• Remove the GCP ssh bullshit
  • set metadata key enable-oslogin to FALSE
  • [x] block project-wide ssh
  • restart
• Now normal ssh should start working

old notes

(This no longer seems true.) It never seems enough to remove external IP. Additional steps to get it done:

gcloud compute instances describe box-1
              networkInteface
               - accessConfigs:
                 - ...
                   name: External NAT
gcloud compute instances delete-access-config box-1 --access-config-name "External NAT"
# REBOOT THE VM

Install gcloud CLI

curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key --keyring /usr/share/keyrings/cloud.google.gpg add -
echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
sudo apt update
sudo apt install google-cloud-sdk

Details Then you should copy the ssh key from another location:

scp -r case:.ssh/google_compute* ~/.ssh/