ssh access

Figure 1076. Credentials by E-Mail

Your server "hello" was created!

You can access your server with the following credentials:
 
IPv4	128.140.108.60
IPv6	2a01:4f8:1c1c:8e3a::/64
User	root
Password	rJ3pNvJXbqMp3XNTvFdq

You will be prompted to change your password on your first login.

To improve security, we recommend that you add an SSH key when creating a server.

Figure 1077. Security problems: 😟

No protection by any firewall
IP and (initial) credentials by email 😱

Solution:

Add firewall with inbound ssh access rule avoiding:
```
$ ssh root@128.140.108.60
ssh: connect to host 128.140.108.60 port 22: Connection refused
```
Replace password by public ssh key based authentication.

Figure 1078. ssh access, firewall

# main.tf

resource "hcloud_firewall" "sshFw" {
  name = "ssh-firewall"
  rule {
    description = "Allow incoming ssh connections"
    direction   = "in"
    protocol    = "tcp"
    port        = "22"
    source_ips  = ["0.0.0.0/0", "::/0"]
  }
}
              ...
resource "hcloud_server" "mySrv" {         ...
  firewall_ids = [hcloud_firewall.sshFw.id]
}

Figure 1079. ssh access, public key

# main.tf

resource "hcloud_ssh_key" "loginUserKey" {
  name       = "goik@hdm-stuttgart.de"
  public_key = file("~/.ssh/id_ed25519.pub")
}
              ...
resource "hcloud_server" "mySrv" {
              ...
  ssh_keys     = [hcloud_ssh_key.loginUserKey.id]

}

Note: Use the Hetzner Web GUI for removing any conflicting manually installed ssh keys beforehand.

Figure 1080. Apply firewall and ssh configuration

$ terraform apply

  # hcloud_firewall.sshFw will be created
  + resource "hcloud_firewall" "sshFw" {
       ...
  # hcloud_server.mySrv will be created
  + resource "hcloud_server" "mySrv" {
       ...
  # hcloud_ssh_key.goik will be created
  + resource "hcloud_ssh_key" "loginUserKey" {
       ...
Plan: 3 to add, 0 to change, 0 to destroy.
       ...
Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

Figure 1081. Ratio behind passing *.id.

resource "hcloud_firewall" "sshFw" {...}
              ...
resource "hcloud_server" "mySrv" {     ...
  firewall_ids = [hcloud_firewall.sshFw.id]  }

Terraform cannot pass resource instances: Only string, number, bool, list, set and map are allowed.
Passing hcloud_firewall instance reference by its resource identity id value:
```
terraform apply
...
hcloud_firewall.sshFw: Creation complete after 0s [id=11941059]
...
```

Figure 1082. Resource id and state

Resource id is persistent over life cycle e.g. invoking terraform apply.
State persistence by terraform.tfstate file:

"resources": [
    { "type": "hcloud_firewall",
      "name": "sshFw",
      "provider": "provider[\"registry.terraform.io/hetznercloud/hcloud\"]",
      "instances": [
        {"schema_version": 0,
         "attributes": {
            "id": "11941059",
            ...

Prev	Up	Next
Creating a server	Home	Terraform state and Outputs

Working with Terraform