operasoftware/ssh-key-authority

Multiple hosts behind NAT

Closed this issue · 9 comments

Hello,

I've at least one problem.
We have a few hosts behind a nat which are accessable with the same ip but with different ports.
Would it be possible to have a "behind NAT" tick so that the ip check will allow it?

Seems like it would make more sense to take the port field into account when checking for conflicts.

I've pushed a couple of commits (2bac430 and dc478ca) that should resolve this.

Hello thanks for your fast response.
But i´ve to say that isn't working with this changes.

I don't have any infrastructure to test this with, but as far as I can tell it should be working. Have you definitely done a git pull to update to the latest version, and then restarted the sync process? Can you check the output from the sync process when you run a sync? journalctl -f -u keys-sync should show what it is doing. Click the Sync now button for an affected server and then take a look for lines that mention Checking IP address in the journalctl output.

Hello,

I tested a little bit.
This isnt working in the sync.php:
$matching_servers = $server_dir->list_servers(array(), array('ip_address' => $server->ip_address, 'port' => $server->port, 'key_management' => array('keys')));

We have 4 machines with different IPs, but also different ports.
I echo'ed the count($matching_servers).
And the result is still 4.

Ah, I see where I went wrong. I'll have a fix shortly.

I believe this should work now. I also put the fix on to the sync_groups branch in case you are testing that.

Perfect, this is working now.

But i will test the other thing with the groups not on our life system.

Will inform you!

Thanks for your work.

Excellent. Thanks for your help debugging it.