42 lines
1.3 KiB
Bash
Executable File
42 lines
1.3 KiB
Bash
Executable File
#!/bin/bash
|
|
# Emergency access script - maintains a reverse SSH tunnel as backup
|
|
# Only use this if you have a reliable jump server
|
|
|
|
# Configuration (set these in service.env)
|
|
JUMP_SERVER="${EMERGENCY_JUMP_SERVER:-}"
|
|
JUMP_USER="${EMERGENCY_JUMP_USER:-}"
|
|
JUMP_PORT="${EMERGENCY_JUMP_PORT:-22}"
|
|
LOCAL_SSH_PORT="${LOCAL_SSH_PORT:-22}"
|
|
TUNNEL_PORT="${EMERGENCY_TUNNEL_PORT:-}" # Port on jump server
|
|
|
|
if [ -z "$JUMP_SERVER" ] || [ -z "$TUNNEL_PORT" ]; then
|
|
echo "Emergency access not configured. Skipping."
|
|
exit 0
|
|
fi
|
|
|
|
echo "Setting up emergency SSH reverse tunnel..."
|
|
|
|
# Create systemd service for persistent reverse tunnel
|
|
cat << EOF | sudo tee /etc/systemd/system/emergency-tunnel.service
|
|
[Unit]
|
|
Description=Emergency SSH Reverse Tunnel
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/bin/ssh -o ServerAliveInterval=60 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes -o StrictHostKeyChecking=no -N -R ${TUNNEL_PORT}:localhost:${LOCAL_SSH_PORT} ${JUMP_USER}@${JUMP_SERVER} -p ${JUMP_PORT}
|
|
Restart=always
|
|
RestartSec=30
|
|
User=root
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl enable emergency-tunnel.service
|
|
sudo systemctl start emergency-tunnel.service
|
|
|
|
echo "Emergency tunnel service configured."
|
|
echo "In case of emergency, SSH to jump server and then:"
|
|
echo " ssh -p ${TUNNEL_PORT} localhost" |