Locked out of my production Environment

pixeline · November 25, 2017, 2:05pm

I provisioned a website on a digitalocean VPS, which default user is “root” instead of “admin”.
I provisioned and deployed with the setting sshd_permit_root_login set to true.

A few days later, with the site now up and running, I thought it be a good idea to set that setting to false… Forgetting that my admin user is “root”… Oups.

I’m now locked out. I tried ssh-ing using the web user then sudo, but it asks for a password that does not exist…

The only option I have is to reset the root password using digitalocean control panel, but that creates downtime.

Do you see any other option that would not involve downtime (apart from setting up a new VPS!) ?

strarsis · November 25, 2017, 4:00pm

You could spin up a 2nd instance, point the domain to it (DNS) and then destroy the old one.

pixeline · November 25, 2017, 4:33pm

Thank you, but that’s the one option i’d rather not consider. This site’s migration is a PITA.

strarsis · November 25, 2017, 5:15pm

Why is the migration hard in this case? Database and uploads/ files can be transferred using a script.

ben · November 25, 2017, 6:39pm

Hold up. “admin” is still created when you provision a VPS — that’s done by Trellis.

github.com

roots/trellis/blob/3e32e2ae9cc78010e8b36ba63cb52da52ed1582c/group_vars/all/users.yml#L2


      
          # Documentation: https://roots.io/trellis/docs/ssh-keys/
          admin_user: admin
          
          # Also define 'vault_users' (`group_vars/staging/vault.yml`, `group_vars/production/vault.yml`)
          users:
            - name: "{{ web_user }}"
              groups:
                - "{{ web_group }}"
              keys:
                - "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
                # - https://github.com/username.keys
            - name: "{{ admin_user }}"

Sure it does. Do ansible-vault view group_vars/<environment>/vault.yml and then copy the admin user password at the top.

It’s pretty brief.

pixeline · November 26, 2017, 12:18pm

Thanks a lot that solved it!