fix(dashboard): gh #651 Fixed turbovnc version and template for local environment #56

abujeda · 2022-03-23T11:18:09Z

New Docker image with turbovnc version already built and pushed

whorka

changes requested

whorka · 2022-03-28T18:58:43Z

dashboard/Makefile

 remote-dev clean-remote-dev:     LOGIN_HOST   := login.rc.fas.harvard.edu
 remote-dev clean-remote-dev:     APP_FOLDER   := ./fasrc/dev/dashboard
+remote-dev:                      TEMPLATE_URL := https://vdi.rc.fas.harvard.edu/pun/sys/dashboard/files/fs/opt/ood/ondemand/root/usr/share/gems/2.7/ondemand/2.0.12/gems/ood_core-0.17.1/lib/ood_core/batch_connect/templates


The way in which TEMPLATE_URL is specified is extremely fragile. This will break whenever minor upgrades to OOD are performed.

You could probe for the location of this file. It would be easy over SSH, but it will be a little tricky using curl to interact with the file browser.

If that does not seem feasible, then please update the Sid2 Dependencies page, section on Open OnDemand to specify that these variables need to be updated whenever the version of Open OnDemand changes in Remote Dev Cannon / Remote Dev FASSE.

I cannot think any other way. I have added a check to make sure there is a valid template file coming back from the server. But with this approach we will need to update the Makefile on every OOD update.

As the actual templates will change less often, not sure it will be less troublesome to change the approach and have a copy of the files in the code base and copy the right version with Make.

I like that you added a validation check, but I'd like to think about this a little more. How can we avoid introducing this troublesome and potentially unnecessary effort of multiple password entries and updating URL paths?

The problem we are trying to solve is to keep the turbovnc.rb and kvm.rb files from the default dashboard app in sync with the same files in the Sid dashboard app. Is there another opportunity for us to do so, other than at deployment time?

What about at runtime? Would it be possible for the Sid dashboard app itself to check the local filesystem to determine if the files differ, and raise a warning if so? This implementation would also address #658.

We decided that if we do #658 first (to change the puppet manifest so that it deploys a copy of the turbovnc.rb and kvm.rb files directly in to the Sid app installation dir), then we will be able to access these files at a fixed path from the Cannon Staging and FASSE Staging servers. This will make this implementation of deploying the files to remote dev at build time more resilient.

whorka · 2022-03-28T19:03:38Z

dashboard/Makefile

+	@echo "You need to be connected to the VPN"
+	@read -p "OOD password to copy templates:" ood_password; \
+	echo "Downloading: $(TEMPLATE_URL)/$(TURBOVNC_TEMPLATE)"; \
+	curl -kL $(TEMPLATE_URL)/$(TURBOVNC_TEMPLATE) --user $(REMOTE_USERNAME):$$ood_password -o $(TEMPLATE_LOCATION)/$(TURBOVNC_TEMPLATE) ; \


Do not use the -k option to curl; it is a synonym for --insecure. We want to ensure that this connection is encrypted and verified since we will be sending a[n admin] password.

Do not pass the user password as a command-line parameter. The curl manpage itself advises against this, since it will be visible in plaintext in the process table. Instead, just omit the password and curl will prompt for it.

You can add the -sS options to curl to suppress status output and only output errors.

whorka · 2022-03-28T19:05:38Z

dashboard/Makefile

+	echo "Downloading: $(TEMPLATE_URL)/$(TURBOVNC_TEMPLATE)"; \
+	curl -kL $(TEMPLATE_URL)/$(TURBOVNC_TEMPLATE) --user $(REMOTE_USERNAME):$$ood_password -o $(TEMPLATE_LOCATION)/$(TURBOVNC_TEMPLATE) ; \
+	echo "Downloading: $(TEMPLATE_URL)/$(KVM_TEMPLATE)"; \
+	curl -kL $(TEMPLATE_URL)/$(KVM_TEMPLATE) --user $(REMOTE_USERNAME):$$ood_password -o $(TEMPLATE_LOCATION)/$(KVM_TEMPLATE) ; \


You can avoid having to prompt again for a password by storing the cookies from the first curl session and loading them in the second curl session. If you do so, be sure to store the file in a secure location with secure permissions, and end the session with a Logout and remove the cookie jar file. See e.g. https://stackoverflow.com/questions/12752555/sessions-with-curl

OOD uses basic auth, this requires an specific Authorization header.
There are no auth cookies being set in the response.

I tested the examples in stackoverflow, just in case, but they do not work for OOD.

Yes, you are right, we are not yet using OIDC in production. Even if there were session cookies, we would still need to send the Authorization header for HTTP Basic auth. I think for now you will just need to prompt for the password multiple times, since it is not secure to put in in plaintext into the process table, and it would be possibly even less secure to read it plaintext from a file.

whorka · 2022-03-28T19:09:23Z

dashboard/README.md

@@ -60,15 +60,21 @@ Docker images are used to create the local development environment. Information

 - Run `make down`

-## Deploying to remote development (your FASRC account)
+## Deploying to remote development (your FASRC/FASSE account)
+### Cannon

 - Run `make remote-dev`. `make remote-dev` builds all required OOD/Ruby libs locally and exports built artifacts to FASRC. This task will prompt you for your FASRC SSH credentials (password and pin) twice as it creates/validates the pre-requisite directory structure as setup in your home directory.


Suggested change

- Run `make remote-dev`. `make remote-dev` builds all required OOD/Ruby libs locally and exports built artifacts to FASRC. This task will prompt you for your FASRC SSH credentials (password and pin) twice as it creates/validates the pre-requisite directory structure as setup in your home directory.

- Run `make remote-dev`. `make remote-dev` builds all required OOD/Ruby libs locally and exports built artifacts to FASRC. This task will prompt you for your FASRC credentials (password and pin) more than once as it retrieves files, creates/validates the pre-requisite directory structure, and deploys the app to your home directory.

whorka · 2022-03-28T19:10:02Z

dashboard/README.md


 - Run `make remote-dev`. `make remote-dev` builds all required OOD/Ruby libs locally and exports built artifacts to FASRC. This task will prompt you for your FASRC SSH credentials (password and pin) twice as it creates/validates the pre-requisite directory structure as setup in your home directory.

 - Once completed, visit:

  https://vdi.rc.fas.harvard.edu

-  and go through the same Validation process as for the development environment.
+### FASSE
+- Run `make remote-fasse`. `make remote-fasse` builds as before and deploys to FASSE. This task will prompt you for your FASSE SSH credentials (password and pin) twice as it creates/validates the pre-requisite directory structure as setup in your home directory.


Suggested change

- Run `make remote-fasse`. `make remote-fasse` builds as before and deploys to FASSE. This task will prompt you for your FASSE SSH credentials (password and pin) twice as it creates/validates the pre-requisite directory structure as setup in your home directory.

- Run `make remote-fasse`. `make remote-fasse` builds as before and deploys to FASSE. This task will prompt you for your FASRC credentials (password and pin) more than once as it retrieves files, creates/validates the pre-requisite directory structure, and deploys the app to your home directory.

If you are accepting this suggestion, you can click the "Commit suggestion" button.

Yes, I am.
sorry, I thought that I had add it to my new commit.
I have reset my commit and made the update into a new one, just to push all changes under a single commit.

abujeda · 2022-03-29T18:06:06Z

I have made all the changes. This is ready for review again

whorka · 2022-05-27T17:45:27Z

dashboard/download_and_check.sh

+
+FILE_NAME=$(basename "$FILE_LOCATION")
+
+NEW_VERSION_FILE_LOCATION=$(mktemp /tmp/dashboard_template.XXXXXX)


Please use ${TMPDIR:-/tmp} instead of tmp

Please check the return value of mktemp to ensure it succeeded

These two checks will help to prevent symlink attacks on multi-user systems with a shared /tmp.

Check added. PR ready for review.

… environment

abujeda force-pushed the 651-fix-turbovnc-local branch from 52de044 to f43184f Compare March 28, 2022 13:22

whorka self-requested a review March 28, 2022 18:14

abujeda force-pushed the 651-fix-turbovnc-local branch from f43184f to 7b35a7a Compare March 29, 2022 14:04

whorka reviewed Mar 29, 2022

View reviewed changes

abujeda force-pushed the 651-fix-turbovnc-local branch from 7b35a7a to 9633e02 Compare March 29, 2022 18:01

abujeda force-pushed the 651-fix-turbovnc-local branch from 9633e02 to 4472ca5 Compare March 29, 2022 18:41

abujeda force-pushed the 651-fix-turbovnc-local branch 2 times, most recently from 1da512d to 6d0be9c Compare April 25, 2022 10:41

abujeda force-pushed the 651-fix-turbovnc-local branch 2 times, most recently from ab1d9d4 to 44705ac Compare May 27, 2022 08:30

whorka requested changes May 27, 2022

View reviewed changes

abujeda force-pushed the 651-fix-turbovnc-local branch 2 times, most recently from 2557dcf to d25e457 Compare May 31, 2022 09:47

fix(dashboard): gh #651 Fixed turbovnc version and template for local…

593ae2c

… environment

abujeda force-pushed the 651-fix-turbovnc-local branch from d25e457 to 593ae2c Compare May 31, 2022 09:52

whorka merged commit 23c5a77 into canary Aug 19, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(dashboard): gh #651 Fixed turbovnc version and template for local environment #56

fix(dashboard): gh #651 Fixed turbovnc version and template for local environment #56

abujeda commented Mar 23, 2022 •

edited

Loading

whorka left a comment

whorka Mar 28, 2022

abujeda Mar 29, 2022

whorka Mar 29, 2022

whorka Mar 31, 2022

whorka Mar 28, 2022

whorka Mar 28, 2022

abujeda Mar 29, 2022 •

edited

Loading

whorka Mar 29, 2022 •

edited

Loading

whorka Mar 28, 2022

whorka Mar 28, 2022

whorka Mar 29, 2022

abujeda Mar 29, 2022 •

edited

Loading

abujeda commented Mar 29, 2022

whorka May 27, 2022

abujeda May 31, 2022

	- Run `make remote-dev`. `make remote-dev` builds all required OOD/Ruby libs locally and exports built artifacts to FASRC. This task will prompt you for your FASRC SSH credentials (password and pin) twice as it creates/validates the pre-requisite directory structure as setup in your home directory.
	- Run `make remote-dev`. `make remote-dev` builds all required OOD/Ruby libs locally and exports built artifacts to FASRC. This task will prompt you for your FASRC credentials (password and pin) more than once as it retrieves files, creates/validates the pre-requisite directory structure, and deploys the app to your home directory.

	- Run `make remote-fasse`. `make remote-fasse` builds as before and deploys to FASSE. This task will prompt you for your FASSE SSH credentials (password and pin) twice as it creates/validates the pre-requisite directory structure as setup in your home directory.
	- Run `make remote-fasse`. `make remote-fasse` builds as before and deploys to FASSE. This task will prompt you for your FASRC credentials (password and pin) more than once as it retrieves files, creates/validates the pre-requisite directory structure, and deploys the app to your home directory.


		FILE_NAME=$(basename "$FILE_LOCATION")

		NEW_VERSION_FILE_LOCATION=$(mktemp /tmp/dashboard_template.XXXXXX)

fix(dashboard): gh #651 Fixed turbovnc version and template for local environment #56

fix(dashboard): gh #651 Fixed turbovnc version and template for local environment #56

Conversation

abujeda commented Mar 23, 2022 • edited Loading

whorka left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

abujeda Mar 29, 2022 • edited Loading

Choose a reason for hiding this comment

whorka Mar 29, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

abujeda Mar 29, 2022 • edited Loading

Choose a reason for hiding this comment

abujeda commented Mar 29, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

abujeda commented Mar 23, 2022 •

edited

Loading

abujeda Mar 29, 2022 •

edited

Loading

whorka Mar 29, 2022 •

edited

Loading

abujeda Mar 29, 2022 •

edited

Loading