Customize SSH configurations for clients

Advanced Server Access allows SSH customization options for both Advanced Server Access admins and their teams. Users can adjust how their client responds when attempting SSH connections, and admins can customize how their servers respond to clients initiating connections. Before beginning, make sure that you've installed the ScaleFT Client and run the sft ssh-config command.

Client customization

Depending on your Advanced Server Access client and your SSH configuration, you should see something like the following within your config file:

# To use ScaleFT proxycommand, add this configuration block to your $HOME/.ssh/config
Match exec "/usr/local/bin/sft resolve -q  %h"
ProxyCommand "/usr/local/bin/sft" proxycommand  %h
UserKnownHostsFile "/Users/Admin/Library/Application Support/ScaleFT/proxycommand_known_hosts"

Customization examples

• Removing -q from sft resolve

  -q stands for "quiet", meaning that any issues that occur while connecting to your target severs will not be shown to the user or provoke a reaction from your client. This includes the state where you are not logged in. In that event, with -q, your SSH command will fail to find the host and you will not be authorized to access the host inventory in Advanced Server Access. Removing -q from the Match exec line of your config file results in your client sending a browser sign in request to the Advanced Server Access Platform after an SSH attempt fails.

• Custom Match directives

  Customizing Match directives allow the user to control specific client behavior for each server within their team. By identifying potential target servers through a customized Match directive, users can than incorporate other customization options (such as removing -q) to allow their client to take certain actions when trying to connect to a specific server.

  For example, this is a Match block that could be added to your config file:

  Match Host *ubu* "/usr/local/bin/sft resolve -q  %h"
   ProxyCommand "/usr/local/bin/sft" proxycommand  %h
   UserKnownHostsFile "/Users/Admin/Library/Application Support/ScaleFT/proxycommand_known_hosts"

  This creates a scenario where any attempted connections to servers that have names containing the letters "ubu" will follow the rules listed in this Match block only.

• Identifying specific bastions to connect through

  Another customization option is to, instead of configuring a bastion via the agent configuration file sftd.yaml, dictate to your client specific bastions it needs to move through dynamically when attempting SSH connections. This is done through the --via command, which can be added to the ProxyCommand lines of your config file as such:

  ProxyCommand "/usr/local/bin/sft" proxycommand --via <bastion> %h

  Replace <bastion> with the name of your specific bastion.