Remote SSH and semi-automatic configuration

[mpfusion]

I just upgraded from FreeNAS-11.2-U6 to 11.3-U2 and I'm redoing the replication. I have a few questions:

1)

First I created an SSH key pair in System → SSH Keypairs. On the old system, this public key needed to be added to

Code:

remoteSystem@example.com:/root/.ssh/authorized_keys

Is this still the case in 11.3-U2 or is there a GUI field to add the key to allow SSH remote login? I use ssh key rather than password authentication.

2)

In System → SSH Connections → Add the Setup Method is “Semi-automatic (FreeNAS only)” by default. But I have no clue how that's supposed to work. The manual at https://www.ixsystems.com/documentation/freenas/11.3-U2/system.html#ssh-connections doesn't really help either:

Hostname or IP address of the remote FreeNAS® system. Only available with Semi-automatic configurations. A valid URL scheme is required. Example: https://10.231.3.76

Why URL and https? It's SSH, there is no http involved. Is it maybe the URL of the web GUI of the remove system? The web GUI is not publicly accessible and I do not intent to open the web GUI to the Internet.

Maybe someone can shed some light onto this mysterious semi-automatic configuration and its URL.

 

[danb35]

The manual at https://www.ixsystems.com/documentation/freenas/11.3-U2/system.html#ssh-connections doesn't really help either:

It doesn't? This doesn't explain what's going on?

(see https://www.ixsystems.com/documentation/freenas/11.3-U2/system.html#semi-automatic-setup, which is linked from the link you gave)

 

[mpfusion]

It doesn't? This doesn't explain what's going on?

No it doens't. It just states “Enter the host 2 URL”. Which URL? And it doens't explain why http?

 

[danb35]

Which URL?

It tells you: http://freenas.remote, where freenas.remote is the Host 2 hostname or IP address. What part of that is unclear?

And it doens't explain why http?

No, the manual isn't a "why to", it's a "how to." The "why" is presumably because you call the API via http, not ssh. I'd expect it would work over HTTPS as well, but I can't say that I've used it.

 

[mpfusion]

It tells you: http://freenas.remote, where freenas.remote is the Host 2 hostname or IP address. What part of that is unclear?

The unclear part is the http part. This is about an SSH connection and there is not http server listening on that host, which is why I'm getting an error message if I try to use http (which is expected).

No, the manual isn't a "why to", it's a "how to." The "why" is presumably because you call the API via http, not ssh. I'd expect it would work over HTTPS as well, but I can't say that I've used it.

The web gui and API use http (or https for that matter), true. But neither is exposed to the internet, only SSH is exposed. I don't know how one could reach a remote server without exposing the gui/API to the internet. And the manual does not suggest opening any additional ports.

If I exactly follow the manual I get an error message, which is expected because there is no http server listening.

 

[danb35]

there is not http server listening on that host

If that host is a FreeNAS box, how is there not a HTTP server listening?

And the manual does not suggest opening any additional ports.

The manual doesn't suggest opening any ports at all--I don't think it contemplates the case (which is apparently your use case) where there's a firewall between host 1 and host 2. If that's your situation, I don't believe there's going to be a good way to make the semi-automatic setup work for you. Zerotier would have made this easy, but they took that out in 11.3.

 

[mpfusion]

If that host is a FreeNAS box, how is there not a HTTP server listening?

The freenas http server that runs the GUI and the API is not to be exposed to the internet (as mentioned in the OP). It's not recommended to expose it to the internet. It's not desiged to be exposed to the internet. That's why there's no http server listening on any port accessible from the internet.

The manual doesn't suggest opening any ports at all--I don't think it contemplates the case (which is apparently your use case) where there's a firewall between host 1 and host 2.

There's the internet between host 1 and host 2 (as mentioned in the OP), an untrusted network. Freenas used SSH (and SSH only) to traverse this untrusted network and send the replication stream in older fn versions. There was no need to open any other ports than the SSH port.

Neither the GUI nor the manual mention that the semi-automatic mode only works for trusted networks which have access to the gui/api, so I assume this is not the case. And having routers/firewalls between different freenas boxes is a very common use case.

 

[danb35]

There's the internet between host 1 and host 2 (as mentioned in the OP)

No, this wasn't mentioned in your OP. Maybe you meant to, but you didn't. What you said was:

The web GUI is not publicly accessible and I do not intent to open the web GUI to the Internet.

...but you never said why you believed that fact to be relevant. Perhaps you meant for the reader to infer that for it to be publicly accessible and open to the Internet would be the only way that host 1 would have access to it, but that's hardly the same thing.

Neither the GUI nor the manual mention that the semi-automatic mode only works for trusted networks which have access to the gui/api, so I assume this is not the case.

But you assume incorrectly, and if you take a minute to think about it, this is obvious. The "semi-automatic mode" semi-automates configuring a SSH connection. That means the SSH connection isn't configured yet, which means that it can't be done over SSH--it must be done through some other channel. I guess this doesn't prove that the "other channel" needs to be http(s), but when the manual literally tells you in two different places to use a http:// URL that should be a bit of a clue.

Maybe the docs could be clarified on this--file a bug against them if you think so.

 

[mpfusion]

But you assume incorrectly, and if you take a minute to think about it, this is obvious. The "semi-automatic mode" semi-automates configuring a SSH connection. That means the SSH connection isn't configured yet, which means that it can't be done over SSH--it must be done through some other channel. I guess this doesn't prove that the "other channel" needs to be http(s), but when the manual literally tells you in two different places to use a http:// URL that should be a bit of a clue.

That's why I was asking in the first place how this is supposed to work. So the answer is: It uses the API, making it unsuitable for remote hosts and was probably designed for other freenas hosts in the same or another trusted network where the API is accessible.

In this case I'll use the manual SSH setup rather than the semi-automatic. Thanks for your responses.