Centralized known_hosts for ssh

# I typically break things into lots of steps because I use dash instead of
# bash, so there's no pipefail setting.

aws ec2 describe-regions > /tmp/regions.tmp
REGIONS="$(< /tmp/regions.tmp jq -r '.Regions[].RegionName')"

for r in $REGIONS; do
  export AWS_DEFAULT_REGION=$r
  aws ec2 describe-instances > /tmp/instances.tmp
  cat /tmp/instances.tmp |

    # Extract the Name from the instances that are running

    jq -r '.Reservations[].Instances[] |
           select(.State.Name == "running") |
           (.Tags[] | select(.Key == "Name") |
           .Value)' |

    # Append our internal domain 

    sed 's/$/.zr.com/'
done

package main

import (
	"errors"
	"fmt"
	"os"

	// The official aws sdk for go is surprisingly good, despite forcing you to
	// write some pretty weird go
	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/ec2"
)

var ErrNameNotFound error = errors.New("Name not found")

func getName(i *ec2.Instance) (string, error) {
	for _, t := range i.Tags {
		if *t.Key == "Name" {
			return *t.Value, nil
		}
	}

	return "", ErrNameNotFound
}

// EC2Instance contains all of the identifying information we can get about a
// server through the EC2 api.  It's not shown in this blog post, but I store
// the ID and IPAddress in a JSON file for comparisons across runs.  If they
// vary I do not include the server in the known_hosts file.  Name can and does
// vary over time.
type EC2Instance struct {
	Name, IPAddress, ID string
}

// EC2Instances takes the region it's querying and returns all of the running
// instances from that region.
func EC2Instances(region string) []EC2Instance {
	awsSess, err := session.NewSession(&aws.Config{
		Region: aws.String(region),
	})
	if err != nil {
		panic(err)
	}
	svc := ec2.New(awsSess)

	// Running only
	dii := &ec2.DescribeInstancesInput{
		Filters: []*ec2.Filter{
			{
				Name:   aws.String("instance-state-name"),
				Values: []*string{aws.String("running")},
			},
		},
	}
	di, err := svc.DescribeInstances(dii)
	if err != nil {
		panic(err)
	}

	ret := make([]EC2Instance, 0, len(di.Reservations))

	for _, res := range di.Reservations {
		for _, i := range res.Instances {
			name, err := getName(i)
			if err != nil {
				fmt.Fprintf(os.Stderr, "Couldn't get name for %s: %s\n", i, err)
				continue
			}
			ret = append(ret,
				EC2Instance{
					Name:      name,
					IPAddress: *i.PrivateIpAddress,
					ID:        *i.InstanceId,
				},
			)
		}
	}

	return ret
}

package main

import (
	"encoding/base64"
	"errors"
	"fmt"
	"net"
	"time"

	"golang.org/x/crypto/ssh"
)

// This is probably silly, but predefine an error that, if we were to
// accidentally bubble it up, would make it more clear what happened.
var errDial = errors.New("SSH hostkey probe ran")

// SSHInstance contains all the information we have about a server from the
// perspective of SSH.  Neither of these two values should ever change.
type SSHInstance struct {
	IPAddress string
	Key       string
}

// GetSSHInstance takes hostname (not including port) and returns SSHInstance and error.
// We actually use the IP address instead of the hostname since some servers
// only function in a group with a single shared name between them.
func GetSSHInstance(hostname string) (SSHInstance, error) {
	var ok bool
	var ret SSHInstance

	// This HostKeyCallback closes over the hostname and the return value

	c := func(hostname string, remote net.Addr, key ssh.PublicKey) error {
		ip, _, err := net.SplitHostPort(remote.String())
		if err != nil {
			return err
		}

		encKey := key.Type() + " " + base64.StdEncoding.EncodeToString(key.Marshal())
		ret = SSHInstance{
			IPAddress: ip,
			Key:       encKey,
		}
		ok = true

		return errDial
	}

	// ClientConfig simply bakes in HostKeyCallback

	config := &ssh.ClientConfig{
		User:    "UNUSED",
		Auth:    []ssh.AuthMethod{ssh.Password("UNUSED")},
		Timeout: 30 * time.Second,

		HostKeyCallback: ssh.HostKeyCallback(c),
	}
	_, err := ssh.Dial("tcp", hostname+":22", config)

	// Return the error only if our ok boolean is false

	if !ok {
		return ret, err
	}
	return ret, nil
}

// KnownHostLine prints host formatted for known_hosts
func KnownHostLine(host, ip, key string) string {
	return fmt.Sprintf("%s,%s %s\n", host, ip, key)
}

package main

import (
	"fmt"
	"os"
)

func main() {
	instances := EC2Instances("us-west-1")
	for _, instance := range instances {
		i, err := GetSSHInstance(instance.IPAddress)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Couldn't get ssh key for %s: %s\n", instance.Name, err)
			continue
		}

		fmt.Print(KnownHostLine(instance.Name+".zr.com", i.IPAddress, i.Key))
	}
}