Configuring WSL as a ControlMaster relay server

Disclaimer: This is still and experimental procedure (work in progress). Your feedback is welcome.

With this procedure you can leverage ControlMaster under WSL so you may login to the clusters with several apps under native Windows for a certain period without having to do MFA for every session.

How to install Linux on Windows with WSL

Please follow this link for more detailed instructions
https://docs.alliancecan.ca/wiki/Windows_Subsystem_for_Linux_(WSL)

This setup assumes the following on the sample config files:

• you selected Ubuntu as your distro of choice
• the hostname for the WSL instance is 'ubuntu'. Edit /etc/hostname (ubuntu) and /etc/hosts (127.0.0.1 localhost ubuntu)
• the Windows system is named 'smart' and my login name is 'jaime'
• the user name on the ubuntu VM is also 'jaime'
• the Alliance user name is 'pinto' and I want to connect to 'cedar'

Install additional packages

 sudo apt update && sudo apt upgrade -y
 sudo apt install openssh-server -y

NOTE: you may login from Windows to Ubuntu with: ssh localhost

General idea of the setup

[ssh client] ----> [ssh relay server] ----> [ssh target server]
your Windows     modified authorized_keys     using cedar for
  machine          in your Ubuntu VM           this exercise
  'smart'              'ubuntu'                  'cedar'

Login to the ubuntu VM and create a custom_ssh folder

jaime@ubuntu:~$ cat custom_ssh/sshd_config
Port 2222
HostKey /home/jaime/custom_ssh/ssh_host_ed25519_key
HostKey /home/jaime/custom_ssh/ssh_host_rsa_key
AuthorizedKeysFile /home/jaime/custom_ssh/authorized_keys
ChallengeResponseAuthentication no
UsePAM no
Subsystem sftp /usr/lib/openssh/sftp-server
PidFile /home/jaime/custom_ssh/sshd.pid

NOTE: you may copy the ssh_host keys from /etc/ssh

Customize .ssh/config on ubuntu

jaime@ubuntu:~$ cat .ssh/config
Host cedar
    ControlPath ~/.ssh/cm-%r@%h:%p
    ControlMaster auto
    ControlPersist 10m
    HostName cedar.alliancecan.ca
    User pinto

Customize the authorized_keys

jaime@ubuntu:~/custom_ssh$ cat /home/jaime/custom_ssh/authorized_keys
ssh-ed25519 AAAZDINzaC1lZDI1NTE5AAC1lZDIvqzlffkzcjRAaMQoTBrPe5FxlSAjRAaMQyVzN+A+

NOTE: use the same public ssh key that you uploaded to CCDB

Now start the sshd server on 'ubuntu'

jaime@ubuntu:~/custom_ssh$ /usr/sbin/sshd -f ${HOME}/custom_ssh/sshd_config

NOTE: make sure your start the server as yourself, now as root.

Customize .ssh/config on 'smart' with RemoteCommand

jaime@smart ~/.ssh cat config
Host ubuntu
        Hostname localhost
        RemoteCommand ssh cedar

You are now ready to try to login to cedar

jaime@smart ~
$ ssh -t ubuntu -p 2222
Enter passphrase for key '/home/jaime/.ssh/id_ed25519':
Last login: Fri Mar 22 10:50:12 2024 from 99.239.174.157
================================================================================
Welcome to Cedar! / Bienvenue sur Cedar!
...
...
...
[pinto@cedar1 ~]$

Alternative setup

There is another way in which you could customize the authorized_keys on Ubuntu and the ~/.ssh/config on Windows such that it may work better for some Windows GUI apps that don't let you explicitly set the RemoteCommand (such as WinSCP). In this case you set the RemoteCommand on the pub key:

jaime@ubuntu:~/custom_ssh$ cat /home/jaime/custom_ssh/authorized_keys
command="ssh cedar" ssh-ed25519 AAAZDINzaC1lZDI1NTE5AAC1lZDIvqzlffkzcjRAaMQoTBrPe5FxlSAjRAaMQyVzN+A+

jaime@smart ~/.ssh cat config
Host ubuntu
        Hostname localhost
        #RemoteCommand ssh cedar

You may still "ssh ubuntu -p 2222" after that from a shell on Windows.

Setup with MobaXterm

Outstanding Challenges

With this setup you may be prompt for MFA-duo authentication only on the first session. Subsequently multiple ssh sessions can be started on cedar without MFA. This also works fine to get remote shells on cedar from several apps running natively on Windows. I already tried for WinSCP, but we can assume if will work for other apps with some tweaks.

However, what I'm realizing now is that on those very same Windows apps I'm not able to list/display the contents of the local Windows drives. Instead they all show the contents of the ubuntu relay server, which may not be what users want. I imagine in the most generic case they would like to transfer files directly between Windows and cedar, and not between Ubuntu and cedar. In any case, users may still see the contents of the Windows host mounted as the /mnt file system on Ubuntu as explained here.

I'm also trying to understand how to setup scp and sftp directly from Windows to cedar. To that effect, we might want explore the possibility of having a "generic command script", similar to the setup with automation under MFA, in which we could capture several commands with the pub key in the authorized_keys file.

Ultimately we can conceive multiple stanzas in the .ssh/config, one for each site (cedar, graham, beluga, ...) on different ports (2222, 2223, 2224, ...)

Therefore, I probably need a hand from some of you to figure this out. Alliance staff members could post suggestions in the security-mfa channel. Users in general please send email to support with the subject "WSL, ControlMaster/MFA suggestion". Thanks

Compute Canada Data Base