Return-Path: X-Original-To: apmail-camel-users-archive@www.apache.org Delivered-To: apmail-camel-users-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 2E0B8EC22 for ; Fri, 15 Feb 2013 20:34:04 +0000 (UTC) Received: (qmail 96055 invoked by uid 500); 15 Feb 2013 20:34:03 -0000 Delivered-To: apmail-camel-users-archive@camel.apache.org Received: (qmail 96013 invoked by uid 500); 15 Feb 2013 20:34:03 -0000 Mailing-List: contact users-help@camel.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: users@camel.apache.org Delivered-To: mailing list users@camel.apache.org Received: (qmail 96000 invoked by uid 99); 15 Feb 2013 20:34:03 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 15 Feb 2013 20:34:03 +0000 X-ASF-Spam-Status: No, hits=-0.0 required=5.0 tests=RCVD_IN_DNSWL_LOW,SPF_NEUTRAL X-Spam-Check-By: apache.org Received-SPF: neutral (athena.apache.org: local policy) Received: from [209.85.210.171] (HELO mail-ia0-f171.google.com) (209.85.210.171) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 15 Feb 2013 20:33:59 +0000 Received: by mail-ia0-f171.google.com with SMTP id z13so3653515iaz.2 for ; Fri, 15 Feb 2013 12:33:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cranton.com; s=google; h=mime-version:x-received:x-originating-ip:in-reply-to:references :date:message-id:subject:from:to:content-type :content-transfer-encoding; bh=j+jn7/jDq4h7Ca8K399UszZZmTw9liCvLTm0ZLQyOqo=; b=iB3vaX35ogbWrly07+tZmoXeB2NJxyvAWEfWgcVJOww4k4f/FqHkc58SQ3FJUesJnQ z8i9+sx8YLd3HeiiUOApqsP+0a9qzisBWupevcP/1HnpGkTtOdaCPUNUBL0M2koaMIvv q4vkJ/28pA73L3XjGfzLnxxlwrxuXiyxmOeHM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-received:x-originating-ip:in-reply-to:references :date:message-id:subject:from:to:content-type :content-transfer-encoding:x-gm-message-state; bh=j+jn7/jDq4h7Ca8K399UszZZmTw9liCvLTm0ZLQyOqo=; b=e1xOtKyi+vQ4OT9L3vg08Ni6SQMuexDG9Zcn+e5shhzGLV3TAj1ks8X3bxKcgb6qMH EWTYnRibd5BSGrcI/uEO+FsaX+Fiy6G8kd1l0d9T7e1jTwIklaFLkHuEWR0N0n8deZ+n kUkMAA++2YYex+r9yLBK/cERIvEfbvrdZyLFK7YFPulKCiVW3eK5WHYoqC0RvYaSk2vl Wvo8MuA96rIQy/sjuKlMl3kXXVPri9TqwXhuDb/Of+QkKNVuRFeRNZMdYOK1AeCnZMOB Y9M9B+y3bpTIsK3miY/XKJD0hzsO95w8oNMOdB6BnlsbNXhrRPTUAE2pot70h9D0LiWY VmTg== MIME-Version: 1.0 X-Received: by 10.50.51.131 with SMTP id k3mr2743619igo.54.1360960418121; Fri, 15 Feb 2013 12:33:38 -0800 (PST) Received: by 10.64.24.148 with HTTP; Fri, 15 Feb 2013 12:33:37 -0800 (PST) X-Originating-IP: [24.128.50.227] In-Reply-To: References: Date: Fri, 15 Feb 2013 15:33:37 -0500 Message-ID: Subject: Re: camel-ssh - SSH keys authentication From: Scott Cranton To: users@camel.apache.org Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Gm-Message-State: ALoCoQnZYb7Ny2YAzGeiE4YhZtG3VDClOLXGK38GbmQMVJV9KAhkLUaFM8caAJ2wYdEkqQnhfQOy X-Virus-Checked: Checked by ClamAV on apache.org I've created an example showing camel-ssh deployed in Karaf using classpath and file based public key security. https://github.com/scranton/example-security-camel-ssh I'll try to clean it up shortly, and submit to camel either updating existing camel-ssh example, or adding as a new example... Then look to update the doc... On Fri, Feb 15, 2013 at 6:53 AM, Scott Cranton wrote: > Excellent! thanks for the QA ;-) > > The camel-ssh doc clearly needs help, so any thoughts you have on how > to update based on your recent experience would be most appreciated... > > On Fri, Feb 15, 2013 at 6:48 AM, Martin Stiborsk=C3=BD > wrote: >> Woohoo, victory, thanks for the hint, Scott. ClassLoader was the magical >> thing. >> >> ResourceKeyPairProvider keyPairProvider =3D new ResourceKeyPairProvider( >> new String[]{pathToTheKey}, null, >> this.getClass().getClassLoader()); >> >> And camel-crypto, as new dependency, because org.bouncycastle.openssl ..= . >> >> Thanks a lot guys. >> >> >> On Fri, Feb 15, 2013 at 11:34 AM, Scott Cranton wrot= e: >> >>> Have you tried setting the keyPairProvider to an instance of >>> org.apache.sshd.common.keyprovider.ResourceKeyPairProvider? That >>> should work better in OSGi, though I haven't tried it recently... >>> >>> Re mulitple ids: you can add multiple component instances with >>> different ids (e.g. sshGit) and reference them from Camel by those >>> ids. >>> >>> addComponent("sshGit", sshGitComponent) >>> >>> .to("sshGit:git@localhost) >>> >>> On Fri, Feb 15, 2013 at 4:26 AM, Martin Stiborsk=C3=BD >>> wrote: >>> > Often I found solution for a problem in few minutes after posting to >>> > mailing list, so let's try the luck now :) >>> > >>> > Currently I'm digging in the camel-ssh, because definitely there is >>> problem >>> > with referencing the key file from resources. >>> > The very first thing I should do was enabling debug for camel-ssh >>> component >>> > (surprise surprise...), because this: >>> > >>> > 2013-02-15 10:21:46,261 | INFO | qtp724367630-92 | FileKeyPairProvi= der >>> > | 24 - org.apache.sshd.core - 0.8.0 | Unable to read key >>> > /gitkeys/mykey.pem: java.io.FileNotFoundException: /gitkeys/mykey.pem= (No >>> > such file or directory) >>> > >>> > I'll follow advice from Claus Ibsen and check ResourceHelper and how = it >>> > could be used in camel-ssh... >>> > >>> > >>> > On Fri, Feb 15, 2013 at 9:01 AM, Martin Stiborsk=C3=BD < >>> > martin.stiborsky@gmail.com> wrote: >>> > >>> >> One more weird thing, from the log file: >>> >> >>> >> 2013-02-15 08:58:22,582 | INFO | NioProcessor-21 | ClientSessionIm= pl >>> >> | 24 - org.apache.sshd.core - 0.8.0 | Session >>> >> null@my-git.server.com/10.xx.xx.xx:22 closed >>> >> >>> >> The "null"=E2=80=A6I assume there should be username :) >>> >> >>> >> >>> >> On Fri, Feb 15, 2013 at 8:40 AM, Martin Stiborsk=C3=BD < >>> >> martin.stiborsky@gmail.com> wrote: >>> >> >>> >>> So, maybe the problem is really in the camel-ssh component, because= , >>> it's >>> >>> possible to get the key from resources, like that: >>> >>> >>> >>> from("cxfrs:bean:gitServer") >>> >>> .routeId("GitRoutes") >>> >>> .choice() >>> >>> >>> >>> .when(header(CxfConstants.OPERATION_NAME).isEqualTo("getRepositorie= s")) >>> >>> .setBody(constant("info")) >>> >>> .process(new Processor() { >>> >>> @Override >>> >>> public void process(Exchange exchange) throws >>> >>> Exception { >>> >>> InputStream is =3D >>> >>> getClass().getResourceAsStream("/gitkeys/mykey.pem"); >>> >>> String myString =3D IOUtils.toString(is, >>> "UTF-8"); >>> >>> >>> >>> exchange.getOut().setBody(myString); >>> >>> } >>> >>> }); >>> >>> >>> >>> So, no OSGi trouble here I guess=E2=80=A6 >>> >>> >>> >>> >>> >>> On Thu, Feb 14, 2013 at 9:06 PM, Martin Stiborsk=C3=BD < >>> >>> martin.stiborsky@gmail.com> wrote: >>> >>> >>> >>>> Ok, so camel-ssh needs some love, to make it better=E2=80=A6ok. >>> >>>> But without modifications in camel-ssh, I'm just not able to use i= t >>> with >>> >>>> my SSH key, I tried like all possible combinations now. >>> >>>> >>> >>>> SshComponent sshGitComponent =3D new SshComponent(); >>> >>>> sshGitComponent.setHost("localhost"); >>> >>>> sshGitComponent.setPort(22); >>> >>>> sshGitComponent.setUsername("git"); >>> >>>> sshGitComponent.setKeyPairProvider(new FileKeyPairProvider= (new >>> >>>> String[]{"gitkeys/mykey.pem"})); >>> >>>> sshGitComponent.setKeyType(KeyPairProvider.SSH_RSA); >>> >>>> >>> >>>> getContext().removeComponent("ssh"); >>> >>>> getContext().addComponent("ssh", sshGitComponent); >>> >>>> >>> >>>> from("cxfrs:bean:gitServer") >>> >>>> .routeId("GitRoutes") >>> >>>> .choice() >>> >>>> >>> >>>> >>> .when(header(CxfConstants.OPERATION_NAME).isEqualTo("getRepositories")) >>> >>>> .setBody(constant("info")) >>> >>>> .to("ssh:git@localhost"); >>> >>>> >>> >>>> Why the removeComponent and the addComponent? I'd like to add new >>> >>>> instance of SshComponent, under different id, but when I do that, >>> >>>> Camel stucks on start, trying to find this new component=E2=80=A6s= o I'm doing >>> >>>> something wrong there probably=E2=80=A6 >>> >>>> >>> >>>> In src/main/resources/gitkeys/mykey.pem is the key=E2=80=A6but as = I said, it >>> >>>> doesn't work for me, or I missed the correct combination=E2=80=A6I= tried also >>> >>>> classpath and file prefix, but no luck. >>> >>>> >>> >>>> The unit test works fine=E2=80=A6problem is in the OSGi I guess=E2= =80=A6some classpath >>> >>>> issue? I don't know, I have quite a headache from this already, ne= ed a >>> >>>> break. >>> >>>> >>> >>>> >>> >>>> On Thu, Feb 14, 2013 at 3:13 PM, Claus Ibsen >> >wrote: >>> >>>> >>> >>>>> On Thu, Feb 14, 2013 at 2:57 PM, Martin Stiborsk=C3=BD >>> >>>>> wrote: >>> >>>>> > Still one problem=E2=80=A6the unit test was fine, but now in OS= Gi >>> environment, >>> >>>>> > there are more troubles=E2=80=A6 >>> >>>>> > Is there some trick how to get resource from a bundle? I can't = get >>> a >>> >>>>> > reference to the key file stored in src/main/resources :( >>> >>>>> > >>> >>>>> >>> >>>>> I guess maybe camel-ssh should load the cert file like we do in o= ther >>> >>>>> components using ResourceHelper. >>> >>>>> Then we can load from classpath (osgi and the rest of the world), >>> files >>> >>>>> etc. >>> >>>>> >>> >>>>> eg prefix with classpath: or file: >>> >>>>> >>> >>>>> >>> >>>>> > >>> >>>>> > On Thu, Feb 14, 2013 at 12:25 PM, Martin Stiborsk=C3=BD < >>> >>>>> > martin.stiborsky@gmail.com> wrote: >>> >>>>> > >>> >>>>> >> I can try help there as well. I was looking for a chance to ma= ke >>> my >>> >>>>> "first >>> >>>>> >> camel commit" anyway :) >>> >>>>> >> >>> >>>>> >> >>> >>>>> >> On Thu, Feb 14, 2013 at 12:00 PM, Scott Cranton < >>> scott@cranton.com> >>> >>>>> wrote: >>> >>>>> >> >>> >>>>> >>> Glad you figured it out. Yeah, the camel-ssh page does need s= ome >>> >>>>> >>> attention. Thanks for the feedback, and I look forward to see= ing >>> >>>>> your >>> >>>>> >>> suggested updates to the doc. >>> >>>>> >>> >>> >>>>> >>> The certFilename is just a shorthand for creating a >>> >>>>> >>> FileKeyPairProvider, which is identical to what the >>> >>>>> >>> SshComponentSecurityTest is doing >>> >>>>> >>> >>> >>>>> >>> sshComponent.setKeyPairProvider(new FileKeyPairProvider(n= ew >>> >>>>> >>> String[]{"src/test/resources/hostkey.pem"})); >>> >>>>> >>> >>> >>>>> >>> but I see in the tests, I'm using the same resource for both >>> >>>>> producer >>> >>>>> >>> and consumer, so to your point about when public key, when >>> private, >>> >>>>> I >>> >>>>> >>> should check that, update the tests, and most importantly upd= ate >>> the >>> >>>>> >>> docs as it isn't clear... >>> >>>>> >>> >>> >>>>> >>> Thanks, >>> >>>>> >>> Scott >>> >>>>> >>> >>> >>>>> >>> >>> >>>>> >>> >>> >>>>> >>> On Thu, Feb 14, 2013 at 5:48 AM, Martin Stiborsk=C3=BD >>> >>>>> >>> wrote: >>> >>>>> >>> > As usually, problem solved few minutes after I posted this >>> "call >>> >>>>> for >>> >>>>> >>> help >>> >>>>> >>> > message". >>> >>>>> >>> > Really there was a problem with loading the private key fro= m >>> >>>>> resources. >>> >>>>> >>> > >>> >>>>> >>> > Now it works...my next message will be about updating the >>> >>>>> camel-ssh >>> >>>>> >>> wiki :) >>> >>>>> >>> > >>> >>>>> >>> > >>> >>>>> >>> > On Thu, Feb 14, 2013 at 10:37 AM, Martin Stiborsk=C3=BD < >>> >>>>> >>> > martin.stiborsky@gmail.com> wrote: >>> >>>>> >>> > >>> >>>>> >>> >> Hello guys, >>> >>>>> >>> >> I need to use camel-ssh in my route, also, I need >>> authentication >>> >>>>> with >>> >>>>> >>> SSH >>> >>>>> >>> >> keys to the remote server. >>> >>>>> >>> >> I can't figure out how to configure the SSH producer in Ca= mel. >>> >>>>> >>> >> >>> >>>>> >>> >> Now I started digging in camel-ssh source codes, but that = is a >>> >>>>> long >>> >>>>> >>> trip >>> >>>>> >>> >> for me right now :( >>> >>>>> >>> >> >>> >>>>> >>> >> First of all, I'm not sure, what is difference between >>> >>>>> "certFilename" >>> >>>>> >>> and >>> >>>>> >>> >> "keyPairProvider" options for the ssh endpoint? >>> >>>>> >>> >> >>> >>>>> >>> >> Then, the private key have to be provided for the ssh >>> endpoint, >>> >>>>> right? >>> >>>>> >>> The >>> >>>>> >>> >> public key is configured on the remote server account... >>> >>>>> >>> >> Also, in which format the SSH private key should be? PEM? >>> >>>>> >>> >> Like this? >>> >>>>> >>> >> >>> >>>>> >>> >> openssl rsa -in ~/.ssh/id_rsa -outform pem > id_rsa.pem >>> >>>>> >>> >> >>> >>>>> >>> >> I guess so, because it's like this here: >>> >>>>> >>> >> >>> >>>>> >>> >>> >>>>> >>> https://github.com/apache/camel/blob/trunk/components/camel-ssh/src/tes= t/resources/hostkey.pem >>> >>>>> >>> >> >>> >>>>> >>> >> I'm not even sure if the key is loaded properly in the Jav= a >>> code >>> >>>>> from >>> >>>>> >>> >> resources directory, because the exception I see there is: >>> >>>>> >>> >> >>> >>>>> >>> >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>> >>>>> >>> >> Caused by: java.io.IOException: Error performing public ke= y >>> >>>>> >>> authentication >>> >>>>> >>> >> at >>> >>>>> >>> >> >>> >>>>> >>> >>> >>>>> >>> org.apache.sshd.client.auth.UserAuthPublicKey.(UserAuthPublicKey.= java:86) >>> >>>>> >>> >> at >>> >>>>> >>> >> >>> >>>>> >>> >>> >>>>> >>> org.apache.sshd.client.session.ClientSessionImpl.authPublicKey(ClientSe= ssionImpl.java:146) >>> >>>>> >>> >> at >>> >>>>> >>> >> >>> >>>>> >>> >>> >>>>> >>> org.apache.camel.component.ssh.SshEndpoint.sendExecCommand(SshEndpoint.= java:113) >>> >>>>> >>> >> at >>> >>>>> >>> >> >>> >>>>> >>> org.apache.camel.component.ssh.SshProducer.process(SshProducer.java:38) >>> >>>>> >>> >> ... 72 more >>> >>>>> >>> >> Caused by: java.lang.NullPointerException >>> >>>>> >>> >> at >>> >>>>> >>> >> >>> >>>>> >>> >>> >>>>> >>> org.apache.sshd.client.auth.UserAuthPublicKey.(UserAuthPublicKey.= java:59) >>> >>>>> >>> >> ... 75 more >>> >>>>> >>> >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>> >>>>> >>> >> >>> >>>>> >>> >> Note the NullPointerException ... >>> >>>>> >>> >> >>> >>>>> >>> >> But I tried to follow this ( >>> >>>>> >>> >> >>> >>>>> >>> >>> >>>>> >>> https://github.com/apache/camel/blob/trunk/components/camel-ssh/src/tes= t/java/org/apache/camel/component/ssh/SshComponentSecurityTest.java >>> >>>>> ) >>> >>>>> >>> test, >>> >>>>> >>> >> so I guess it should work... >>> >>>>> >>> >> >>> >>>>> >>> >> Could you give me at least some hint? >>> >>>>> >>> >> I promise I'll extend Camel wiki related to this topic >>> >>>>> definitely :P >>> >>>>> >>> >> >>> >>>>> >>> >> -- >>> >>>>> >>> >> S pozdravem / Best regards >>> >>>>> >>> >> Martin Stiborsk=C3=BD >>> >>>>> >>> >> >>> >>>>> >>> >> Jabber: stibi@njs.netlab.cz >>> >>>>> >>> >> Twitter: http://www.twitter.com/stibi >>> >>>>> >>> >> >>> >>>>> >>> > >>> >>>>> >>> > >>> >>>>> >>> > >>> >>>>> >>> > -- >>> >>>>> >>> > S pozdravem / Best regards >>> >>>>> >>> > Martin Stiborsk=C3=BD >>> >>>>> >>> > >>> >>>>> >>> > Jabber: stibi@njs.netlab.cz >>> >>>>> >>> > Twitter: http://www.twitter.com/stibi >>> >>>>> >>> >>> >>>>> >> >>> >>>>> >> >>> >>>>> >> >>> >>>>> >> -- >>> >>>>> >> S pozdravem / Best regards >>> >>>>> >> Martin Stiborsk=C3=BD >>> >>>>> >> >>> >>>>> >> Jabber: stibi@njs.netlab.cz >>> >>>>> >> Twitter: http://www.twitter.com/stibi >>> >>>>> >> >>> >>>>> > >>> >>>>> > >>> >>>>> > >>> >>>>> > -- >>> >>>>> > S pozdravem / Best regards >>> >>>>> > Martin Stiborsk=C3=BD >>> >>>>> > >>> >>>>> > Jabber: stibi@njs.netlab.cz >>> >>>>> > Twitter: http://www.twitter.com/stibi >>> >>>>> >>> >>>>> >>> >>>>> >>> >>>>> -- >>> >>>>> Claus Ibsen >>> >>>>> ----------------- >>> >>>>> Red Hat, Inc. >>> >>>>> FuseSource is now part of Red Hat >>> >>>>> Email: cibsen@redhat.com >>> >>>>> Web: http://fusesource.com >>> >>>>> Twitter: davsclaus >>> >>>>> Blog: http://davsclaus.com >>> >>>>> Author of Camel in Action: http://www.manning.com/ibsen >>> >>>>> >>> >>>> >>> >>>> >>> >>>> >>> >>>> -- >>> >>>> S pozdravem / Best regards >>> >>>> Martin Stiborsk=C3=BD >>> >>>> >>> >>>> Jabber: stibi@njs.netlab.cz >>> >>>> Twitter: http://www.twitter.com/stibi >>> >>>> >>> >>> >>> >>> >>> >>> >>> >>> -- >>> >>> S pozdravem / Best regards >>> >>> Martin Stiborsk=C3=BD >>> >>> >>> >>> Jabber: stibi@njs.netlab.cz >>> >>> Twitter: http://www.twitter.com/stibi >>> >>> >>> >> >>> >> >>> >> >>> >> -- >>> >> S pozdravem / Best regards >>> >> Martin Stiborsk=C3=BD >>> >> >>> >> Jabber: stibi@njs.netlab.cz >>> >> Twitter: http://www.twitter.com/stibi >>> >> >>> > >>> > >>> > >>> > -- >>> > S pozdravem / Best regards >>> > Martin Stiborsk=C3=BD >>> > >>> > Jabber: stibi@njs.netlab.cz >>> > Twitter: http://www.twitter.com/stibi >>> >> >> >> >> -- >> S pozdravem / Best regards >> Martin Stiborsk=C3=BD >> >> Jabber: stibi@njs.netlab.cz >> Twitter: http://www.twitter.com/stibi