Remote scripts on CloudBolt Documentation

Supported platforms and execution methods

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) runs a remote script either over SSH or WinRM, which works on any platform, or through a platform-specific mechanism, which is available on a few. Some operating systems and platforms require setup first; see OS-specific requirements.

SSH and WinRM

The generic method works on a server of any resource technology. What it needs is a network route from the CMP appliance to the server and credentials that CMP can authenticate with. The platform the server runs on does not matter.

Authentication requirements

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) must be able to authenticate with the remote guest in order to interact with it. That is done with either a password or an SSH key, depending on the resource handler and OS involved.

Passwords

VMware relies on passwords for accessing VMs. Authentication with these servers requires a password and sometimes a username.

Credentials can be set in several places:

On the server’s details page. For a server that has already been provisioned, view or update its credentials here to match the VM’s actual configuration.
On the template. Set credentials before provisioning so they are applied to new servers built from it.
On the group, environment, or globally. Set the Password and, if needed, Username parameters at any of these levels.
On a remote script action. Credentials set here override any set on the server when that action runs.

These credentials are associated with the server during provisioning, so they are available for running remote scripts at provision time or later. The username must be provided explicitly unless it is ubuntu for Ubuntu servers, root for other *nix distributions, or Administrator for Windows.

Configure remote script method

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) runs remote scripts through a platform-specific mechanism where one exists, and over SSH or WinRM otherwise. You can change that choice globally, or for particular servers and environments.

Choose the execution method

What happens by default depends on the platform:

VMware runs remote scripts through VMware Tools.
AWS, Azure, and Oracle Cloud Infrastructure can run scripts through their own channels, but do not by default; you must enable it.
Every other platform uses SSH or WinRM.

The Use Tech-Specific Script Execution parameter sets this per server or environment: True to use the platform’s own mechanism, False to use SSH for *nix and WinRM for Windows.

Write remote scripts

Mon, 01 Jan 0001 00:00:00 +0000

A remote script can be written in any scripting language, as long as that language is installed on the target server and allowed to run there. On Windows, the execution policy must permit the script. On *nix, the script must begin with a shebang line.

Shebang lines

A bash script starts with one of these:

#!/bin/bash

or the more portable form, which resolves bash through env:

#!/usr/bin/env bash

The portable form requires the interpreter to be on the PATH of the target server.

AWS tech-specific script execution

Mon, 01 Jan 0001 00:00:00 +0000

Tech-specific script execution lets Cloud Management Platform (CMP) run remote scripts on an EC2 instance it cannot reach directly over SSH or WinRM. CMP instead uses the AWS Systems Manager (SSM) Run Command feature, which delivers the script to the instance and reports the result back.

Prerequisites

Set these up in AWS before configuring anything in CMP.

Instances must have the SSM Agent installed. See Images with the SSM Agent pre-installed.
Linux instances need port 443 reachable, or a correctly configured VPC endpoint for SSM.
Windows instances need port 3389 open. The default launch-wizard security groups do not work. Use an instance type of t2.small or larger for acceptable performance, and allow a few minutes longer than Linux for SSM to finish installing: an instance can report Running before SSM is ready. The instance system log in AWS helps here.
If the deployment has no internet access over port 443, configure VPC endpoints. See the AWS guidance on creating VPC endpoints.

Roles and policies

Roles are what SSM support in CMP rests on. Create an IAM role in AWS for SSM, for example EnablesEC2ToAccessSystemsManagerRole. CMP uses it to enable SSM on supported operating systems. See Supported operating systems in the AWS documentation.

Azure tech-specific script execution

Mon, 01 Jan 0001 00:00:00 +0000

Tech-specific script execution lets Cloud Management Platform (CMP) run remote scripts on an Azure VM it cannot reach directly over SSH or WinRM. CMP uses the Azure Run Command feature, so Azure delivers the script to the VM and reports the result back.

Prerequisites

An Azure resource handler with an environment.
An Azure account with the VMs you intend to run scripts on.

Azure imposes its own limits on what Run Command can do. See the Microsoft documentation for running PowerShell scripts on a Windows VM and shell scripts on a Linux VM, particularly the listed restrictions.

OCI tech-specific script execution

Mon, 01 Jan 0001 00:00:00 +0000

In Cloud Management Platform (CMP), this is an alternative to SSH, controlled by a server parameter. When enabled, ad hoc scripts are executed by the Oracle Cloud Agent running on the instance rather than over an SSH connection.

This method provides additional security; however, due to the Oracle Cloud Agent’s polling interval, it is slower than SSH.

How it works

The Oracle Cloud Agent polls for queued commands approximately every 90 seconds. When CMP submits a script to run on an OCI server with tech-specific script execution enabled, the command is added to the Oracle Cloud Agent’s queue. The agent picks up the command on its next poll, executes the script, and returns the output.

OS-specific requirements

Mon, 01 Jan 0001 00:00:00 +0000

These requirements apply to the generic execution method. A server that runs scripts through its platform’s own mechanism, such as a VMware server using VMware Tools, does not need them. See Configure remote script method.

*nix servers using SSH

Cloud Management Platform (CMP) copies the script to the server and runs it over SSH. For that to work:

The server’s IP address must be routable from the CMP appliance. In public cloud environments, this often means using a public IP address.
CMP must know the server’s IP address, usually because CMP provisioned it or the resource handler reports it.
TCP port 22 must be open. Test this by opening an SSH session from the CMP appliance to the server.
sshd must be installed and running on the server, with password authentication enabled in its configuration if you authenticate by password.
The package providing the scp client must be installed on the server: openssh-clients on CentOS and RHEL, openssh-client on Debian and Ubuntu, or the equivalent.

If scripts fail due to a permissions error, point CMP to a directory the connecting user owns, such as a path under that user’s home directory, instead of the default temporary directory. Change it in Admin > Miscellaneous Settings > Resource management tab > *nix Temporary Directory for Remote Scripts, and verify that the ownership and permissions on that directory are correct.

Examples

Mon, 01 Jan 0001 00:00:00 +0000

Expire a user password

Expires the named user’s password, so that the user must set a new one at next login. Replace cbuser with the account you want to expire.

#!/bin/bash
passwd --expire cbuser

Join a Windows server to an OU

On a Windows server, this executes as PowerShell and joins the server to the given domain and organizational unit. Replace the domain, OU, and account values with your own.