Secure shell (SSH) proxy for a platform-as-a-service system

Patent metadata

Field	Value
Publication number	US-9900313-B2
Application number	US-201514613772-A
Country	US
Kind code	B2
Filing date	Feb 4, 2015
Priority date	Feb 4, 2015
Publication date	Feb 20, 2018
Grant date	Feb 20, 2018

Abstract

Implementations provide for a secure shell (SSH) proxy for a Platform-as-a-Service (PaaS) system. A method of the disclosure includes receiving, by a processing device executing a Secure Shell (SSH) proxy server, a request to establish an SSH connection with a component of an application of a multi-tenant Platform-as-a-Service (PaaS) system, the component is separate from the SSH proxy server, authenticating credentials provided as part of the request, establishing the SSH connection with a device originating the request, receiving, in view of authenticating the credentials and establishing the SSH connection, routing information for the application, the routing information comprising a location of a node of the multi-tenant PaaS system executing the application, establishing an internal communication session with an executing proxy of the node, and forward information conveyed over the SSH connection to the executing proxy via the internal communication session.

First claim

What is claimed is:

1. A method, comprising:
providing, by a processing device executing a Secure Shell (SSH) proxy server, a static uniform resource locator (URL) to a user associated with an application of a multi-tenant Platform-as-a-Service (PaaS) system, the static URL provided in response to the user registering the application with the multi-tenant PaaS system;
receiving, by the processing device, a request to establish an SSH connection with a component of the application, the component separate from the SSH proxy server, wherein the request to establish the SSH connection comprises the static URL;
authenticating, by the processing device via the SSH proxy server, credentials provided as part of the request, the authenticating further comprising retrieving a first token associated with a user corresponding to the request and storing the first token in environment variables maintained by the SSH proxy server for the SSH connection;
establishing the SSH connection with a device originating the request, wherein the SSH connection comprises the static URL utilized by the device to communicate with the component via the SSH proxy server;
receiving, by the processing device via the SSH proxy server in view of authenticating the credentials and establishing the SSH connection, routing information for the component of the application from a PaaS master component, the routing information comprising endpoint information of the component of the application, wherein the endpoint information comprises identification of a target node hosting the component in the multi-tenant PaaS system, and wherein the endpoint information changes when the component is hosted by a different node of the multi-tenant PaaS system while the static address remains the same;
receiving a second token corresponding to the SSH connection, wherein the second token is different from the first token and is used to authenticate the user to the target node;
in view of successful authentication of the user to the target node using the second token, establishing, by the processing device via the SSH proxy server, an internal communication session with an executing proxy of the target node, wherein the executing proxy is executed on the target node separate from the component; and
forwarding information conveyed over the SSH connection to the executing proxy via the internal communication session.

2. The method of claim 1 , wherein authenticating the credentials comprising communicating with the PaaS master component to authenticate the credentials and utilizing the first token to authenticate the user to the executing proxy.

3. The method of claim 2 , wherein the routing information is sent from the PaaS master component when the PaaS master component determines that a user associated with the credentials is authorized to access the component of the application.

4. The method of claim 1 , wherein the component of the application is a container executing on the target node of the multi-tenant PaaS system, the container launched from an application image providing functionality of the application.

5. The method of claim 1 , wherein the component of the application is source code of the application stored in a repository.

6. The method of claim 1 , wherein the executing proxy comprises a process executing on the target node, the process to run one or more executables to provide access to the component of the application on the target node.

7. The method of claim 1 , wherein the internal communication session utilizes a communication protocol that is different than SSH.

8. The method of claim 1 , wherein the target node executes components of multiple applications comprising at least the application, and wherein the multiple applications are owned by different owners.

9. A system, comprising:
a memory;
a processing device communicably coupled to the memory, the processing device to:
execute a Secure Shell (SSH) proxy server as part of a multi-tenant Platform-as-a-Service (PaaS) system;
provide a static uniform resource locator (URL) to a user associated with an application of the multi-tenant PaaS system, the static URL provided in response to the user registering the application with the multi-tenant PaaS system;
receive a request to establish an SSH connection with a component of the application, the component separate from the SSH proxy server, wherein the request to establish the SSH connection comprises the static URL;
authenticate credentials provided as part of the request, the authenticating further comprising the processing device to retrieve a token associated with a user corresponding to the request and store the retrieved token in environment variables maintained by the SSH proxy server for the SSH connection;
establish the SSH connection with a device originating the request, wherein the SSH connection comprises the static URL utilized by the device to communicate with the component via the SSH proxy server;
receive, in view of authenticating the credentials and establishing the SSH connection, routing information for the component of the application from a PaaS master component, the routing information comprising endpoint information of the component of the application, wherein the endpoint information comprises identification of a target node hosting the component in the multi-tenant PaaS system, and wherein the endpoint information changes when the component is hosted by a different node of the multi-tenant PaaS system while the static address remains the same;
receive a second token corresponding to the SSH connection, wherein the second token is different from the first token and is used to authenticate the user to the target node;
in view of successful authentication of the user to the target node using the second token, establish an internal communication session with an executing proxy of the target node, wherein the executing proxy is executed on the target node separate from the component; and
forward information conveyed over the SSH connection to the executing proxy via the internal communication session.

10. The system of claim 9 , wherein the processing device is further to authenticate the credentials further comprises the SSH proxy server to communicate with the PaaS master component to authenticate the credentials and utilize the first token to authenticate the user to the executing proxy.

11. The system of claim 10 , wherein the routing information is sent from the PaaS master component when the PaaS master component determines that a user associated with the credentials is authorized to access the component of the application.

12. The system of claim 9 , wherein the component of the application is a container executing on the target node of the multi-tenant PaaS system, the container launched from an application image providing functionality of the application.

13. The system of claim 9 , wherein the component of the application is source code of the application stored in a repository.

14. The system of claim 9 , wherein the executing proxy comprises a process executing on the target node, the process to run one or more executables to provide access to the component of the application on the target node.

15. The system of claim 9 , wherein the internal communication session utilizes a communication protocol that is different than SSH.

16. A non-transitory machine-readable storage medium including instructions that, when accessed by a processing device, cause the processing device to:
provide, by the processing device executing a Secure Shell (SSH) proxy server, a static uniform resource locator (U

Assignees

• Red Hat Inc

Inventors

• Wiest Thomas
• Coleman Clayton
• Goldstein Andrew

Classifications

• H04L67/141

  Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title