HashiDays One conference. Three cities. Find a city near you
Boundary
Boundary Home

connect ssh

Command: boundary connect ssh

The connect ssh command authorizes a session against a target and invokes an SSH client for the connection. The command fills in the local address and port. You can specify your SSH client of choice using the -style option.

You also have access to some templated values that are substituted into the command arguments, and these values are additionally injected as environment variables in the executed command:

  • {{boundary.ip}} (BOUNDARY_PROXIED_IP): The IP address of the listening socket that boundary connect has opened.
  • {{boundary.port}} (BOUNDARY_PROXIED_PORT): The port of the listening socket that boundary connect has opened.
  • {{boundary.addr}} (BOUNDARY_PROXIED_ADDR): The host:port format of the address. This is essentially equivalent to {{boundary.ip}}:{{boundary.port}}.

The SSH helper command sets the host key Alias. When an Alias is set, SSH does not use localhost:<port> for host key validation, but instead uses one of the following:

  • For connections to a target that has an attached host set, the SSH helper command sets the HostID as the alias.
  • For connections directly to a host, the SSH helper command sets the HostID as the alias.
  • For connections to a target that has an address field configured, the SSH helper command sets the TargetID as the alias.

Examples

The following example authorizes a session to a target with the ID ttcp_eTcZMueUYv and invokes the default SSH client without any additional options:

$ boundary connect ssh -target-id ttcp_eTcZMueUYv

The following example authorizes a session to a target with the ID ttcp_eTcZMueUYv, and pipes arguments directly to the invoked SSH binary. Any SSH arguments after the double hyphen are sent directly to the binary:

$ boundary connect ssh -target-id ttcp_eTcZMueUYv --  -A

$ boundary connect ssh -target-scope-name Helpdesk -target-name ubuntu-server --  -A

$ boundary connect ssh -target-id=ttcp_Gymo7Vcq7Y \
   -host-id=hst_FrdNPd9Zm9 -- -l ubuntu -i private_key.pem

Usage

$ boundary connect ssh [options] [args]

This command performs a target authorization or consumes an existing authorization token, and launches a proxied SSH connection.

Connect command options:

  • -authz-token (string: "") - The authorization string returned from the Boundary controller via an authorize-session action against a target. This option is only required if you don't set a -target-id. If you set the value to -, the command attempts to read in the authorization string from standard input. You can also specify the authorization string using the BOUNDARY_CONNECT_AUTHZ_TOKEN environment variable.

  • -exec (string: "") - If set, specifies that the given binary should be executed after connecting to the worker, if set. This value should be a binary on your path or an absolute path. If all command flags are followed by -- (space, two hyphens, space), then any arguments after that are sent directly to the binary. You can also specify a binary using the BOUNDARY_CONNECT_EXEC environment variable.

  • -host-id (string: "") - The ID of a specific host to connect to out of the target's host sets. If you do not indicate a specific host, Boundary chooses one at random.

  • -target-id (string: "") - The ID of the target to authorize against. You cannot use this option with -authz-token.

  • -target-name (string: "") - The target name, if you authorize the session using scope parameters and target name.

  • -target-scope-id (string: "") - The target scope ID, if you authorize the session using scope parameters and target name. This value is mutually exclusive with -scope-name. You can also specify the target scope ID using the BOUNDARY_CONNECT_TARGET_SCOPE_ID environment variable.

  • -target-scope-name (string: "") - The target scope name, if you authorize the session using scope parameters and target name. This value is mutually exclusive with -scope-id. You can also specify the target scope name using the BOUNDARY_CONNECT_TARGET_SCOPE_NAME environment variable.

SSH options:

  • style (string: "") - How the CLI attempts to invoke an SSH client. This value also sets a suitable default for -exec, if you did not specify a value. Currently understood values are ssh and putty. The default is ssh. You can also specify how the CLI attempts to invoke the SSH client using the BOUNDARY_CONNECT_SSH_STYLE environment variable.

  • username (string: "") - The username you want to pass through to the client. You can also specify a username using the BOUNDARY_CONNECT_USERNAME environment variable.

  • remote-command (string: "") - A command that you want to run on the remote host. You can specify a complete command line, or you may include additional arguments. If you include additional arguments, you must append them to the command and separate them using spaces.

Edit this page on GitHub