Portainer endpoint over ssh

Question

I have a server with docker containers and with only ssh access to it.

I can not connect to it over http or etc.

I can not add more network ports available, except 22(and 22 is already occupied by ssh).

I have portainer, running on my local PC.

So. Is there a way i can add endpoint in portainer, to work with this servers containers over ssh?

Answer 1

If you're permitted to forward connections you could forward a local socket connection to the remote server over ssh then run portainer locally bind-mounting that socket:

ssh -n -N -T -L ${PWD}/docker.sock:/var/run/docker.sock user@host &
docker run -d \
    -p 8000:8000 \
    -p 9000:9000 \
    --name=portainer \
    --restart=always \
    -v ${PWD}/docker.sock:/var/run/docker.sock \
    -v portainer_data:/data \
    portainer/portainer-ce

Answer 2

I am also searching for a solution to this and the solution masseyb can be extended for persistence in a couple of ways:

1. autossh
2. systemd service file
3. run ssh from a local docker container -- unsure on this one, I'm quite new to docker

Instead of starting portainer directly you can just add the environment in the portainer web interface (Environments -> create Environment). This is pretty much a requirement for these methods.

EDIT: portainer needs to be started with the port forwarding or with --network host so it can see the exposed port or with -v /var/run/docker-$${HOST}.sock:/var/run/docker-$${HOST}.sock so it can see the unix socket.

Autossh is a straightfoward method, just replace ssh with autossh and you are done.

For use with systemd: Here is a unit file I use for creating reverse tunnels, but it can easily be adjusted for local->remote tunneling by changing -R to -L (and optionally changing the description):

    [Unit]
    Description=A reverse tunnel using ssh for %I (format remote port:host:local port, connect to host forward remote port to local port)
    Wants=network-online.target
    After=network-online.target
    StartLimitIntervalSec=0
    
    [Service]
    ExecStart=/usr/bin/bash -c 'URI=%i; REMOTE_PORT=$${URI%%%%:*}; LOCAL_PORT=$${URI##*:}; HOST=$${URI%:*}; HOST=$${HOST#*:}; /usr/bin/ssh -qNnT -o ServerAliveInterval=30  -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /etc/rtunnel/$${HOST}.id_rsa -R $$REMOTE_PORT:localhost:$$LOCAL_PORT sshdummy@$$HOST'
    Restart=always
    RestartSec=60
    
    [Install]
    WantedBy=multi-user.target

To set this up:

1. save as something like /lib/systemd/system/[email protected] on localhost
2. adjust parameters as needed (change -R to -L for local->remote port forwarding)
3. create a separate user on the server (mine is called sshdummy).
4. create a password-less ssh key pair on localhost, save private key in /etc/rtunnel/${host}.id_rsa and copy public id to sshdummy@host:~/.ssh/authorized_keys
5. run sudo systemctl enable --now rtunnel@10022:myhost:22 on your host (This creates a persistent tunnel from myhost:10022 to localhost:22)

• optional for 3.: set user's login shell to /bin/cat (for extra security)
• optional for 3.: add rule in /etc/ssh/sshd_config for user so the ClientAliveInterval and ClientAliveCountMax values are set too:

Match User sshdummy
  ClientAliveInterval 15
  ClientAliveCountMax 3

explanation of ssh and systemd options:

StartLimitIntervalSec=0 stops systemd from killing the service if it fails to start after X seconds

Restart=always ensures the service is always restarted after RestartSec=60 seconds

-o ExitOnForwardFailure=yes ensures that ssh exits and thus the service restarts when the tunnel can't be set up

-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no disregard host key validation failures

-i /etc/rtunnel/$${HOST}.id_rsa use a separate ssh key for every host you want to connect to