SSH 로컬 작업

https://docs.axelabs.ai/onboard/ssh-access 따라 내 머신을 SSH 셋업해줘.

진행:
1. 내 머신 OS 진단 (Windows/macOS/Linux)
2. 기존 환경 확인 (cloudflared 설치, ~/.ssh/id_ed25519 존재, ~/.ssh/config 등)
3. 페이지의 각 Step 명령 실행 + 검증, 매 step 결과 받고 다음
4. 함정 발생 시 페이지 "함정 정리" 표 따라 우회
5. Step 3 server-side 등록 = 운영자 ai ([email protected]) 에 Teams DM 으로 내 public key + email 전달, 회신 받고 다음 진행

winget install --id Cloudflare.cloudflared

cloudflared --version

brew install cloudflare/cloudflare/cloudflared

ssh-keygen -t ed25519 -C "<your-email>@axellc.com"

cat ~/.ssh/id_ed25519.pub

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIzszmDFVQCu3ViuGwWV2NatlLhYozWalisAtw6xgQWh [email protected]

# (a) public key append to axe user's authorized_keys (codebase 작업용)
#     ⚠️ axe 는 공용 계정 — install 은 destination replace 라 기존 직원 키 전부 삭제됨.
#     반드시 tee -a 로 append. 권한·소유자는 기존 file 의 것이 유지됨 (file 이 이미 600/axe:staff).
echo "<your-pubkey-one-line>" | sudo /usr/bin/tee -a /Users/axe/.ssh/authorized_keys >/dev/null
 
# (b) SACL 추가 (PAM pam_sacl.so 통과)
sudo /usr/sbin/dseditgroup -o edit -a <your-shortname> -t user com.apple.access_ssh
 
# (c) (선택) 본인 home directory 도 SSH 진입 허용 — 본인 personal 작업 시 (첫 등록 시만 install OK)
sudo /usr/bin/install -d -m 700 -o <your-shortname> -g dev /Users/<your-shortname>/.ssh
sudo /usr/bin/install -m 600 -o <your-shortname> -g dev <tmp-key-file> /Users/<your-shortname>/.ssh/authorized_keys
# 두 번째 키 추가 시에는 (a) 처럼 tee -a 로 append.

@'
Host axe-macmini
  HostName ssh-axe.axelabs.ai
  User axe
  ProxyCommand "C:\Program Files (x86)\cloudflared\cloudflared.exe" access ssh --hostname %h
  IdentityFile ~/.ssh/id_ed25519
'@ | Out-File -Encoding ascii -FilePath $env:USERPROFILE\.ssh\config

cat <<'EOF' >> ~/.ssh/config
 
Host axe-macmini
  HostName ssh-axe.axelabs.ai
  User axe
  ProxyCommand cloudflared access ssh --hostname %h
  IdentityFile ~/.ssh/id_ed25519
EOF

cloudflared access login https://ssh-axe.axelabs.ai

ssh -o StrictHostKeyChecking=accept-new axe-macmini

Start-Process -FilePath "C:\Program Files (x86)\cloudflared\cloudflared.exe" -ArgumentList 'access tcp --hostname ssh-axe.axelabs.ai --url localhost:2222'

ssh -o StrictHostKeyChecking=accept-new -p 2222 axe@localhost

New-Item -ItemType Directory -Path 'C:\ProgramData\cloudflared-ssh-axe' -Force | Out-Null
 
# VBScript wrapper — 0-flash + 무한 재시작
@'
Set sh = CreateObject("WScript.Shell")
Do
    sh.Run """C:\Program Files (x86)\cloudflared\cloudflared.exe"" access tcp --hostname ssh-axe.axelabs.ai --url localhost:2222", 0, True
    WScript.Sleep 5000
Loop
'@ | Out-File -FilePath 'C:\ProgramData\cloudflared-ssh-axe\tcp-forward.vbs' -Encoding ascii
 
# Task 등록
$action    = New-ScheduledTaskAction -Execute 'wscript.exe' `
    -Argument '"C:\ProgramData\cloudflared-ssh-axe\tcp-forward.vbs"'
$trigger   = New-ScheduledTaskTrigger -AtLogOn -User "$env:USERDOMAIN\$env:USERNAME"
$principal = New-ScheduledTaskPrincipal -UserId "$env:USERDOMAIN\$env:USERNAME" -LogonType Interactive
$settings  = New-ScheduledTaskSettingsSet -StartWhenAvailable `
    -DontStopIfGoingOnBatteries -AllowStartIfOnBatteries `
    -ExecutionTimeLimit ([TimeSpan]::Zero) -Hidden
 
Register-ScheduledTask -TaskName 'cloudflared-ssh-axe-tcp' `
    -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force
 
Start-ScheduledTask -TaskName 'cloudflared-ssh-axe-tcp'

Start-Sleep -Seconds 5
Get-NetTCPConnection -LocalPort 2222 -State Listen
Get-Process cloudflared, wscript -ErrorAction SilentlyContinue | Select-Object Name, Id, StartTime
 
# 가시적 창 0 확인
Get-Process cloudflared, wscript -ErrorAction SilentlyContinue |
    Where-Object { $_.MainWindowHandle -ne 0 } |
    Select-Object Name, Id, MainWindowTitle

$dir = 'C:\ProgramData\cloudflared-ssh-axe'
New-Item -ItemType Directory -Path $dir -Force | Out-Null
 
@'
#Requires -Version 5.1
$ErrorActionPreference = 'Stop'
 
$Config = @{
    Cloudflared             = 'C:\Program Files (x86)\cloudflared\cloudflared.exe'
    AppUrl                  = 'https://ssh-axe.axelabs.ai'
    LogPath                 = 'C:\ProgramData\cloudflared-ssh-axe\renewal.log'
    TaskName                = 'cloudflared-token-renewal'
    RenewWindowMinutes      = 5
    PostLoginRecheckMinutes = 5
    FallbackRetryMinutes    = 60
}
 
function Write-Log {
    param([string]$Message)
    "$([DateTime]::Now.ToString('s'))  $Message" | Out-File $Config.LogPath -Append -Encoding utf8
    if ((Get-Item $Config.LogPath).Length -gt 1MB) {
        Get-Content $Config.LogPath -Tail 200 | Set-Content $Config.LogPath -Encoding utf8
    }
}
 
function Get-JwtExpiry {
    param([string]$Jwt)
    $payload = $Jwt.Trim().Split('.')[1].Replace('-','+').Replace('_','/')
    $payload += '=' * ((4 - ($payload.Length % 4)) % 4)
    $json = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($payload)) | ConvertFrom-Json
    [DateTimeOffset]::FromUnixTimeSeconds($json.exp).LocalDateTime
}
 
function Get-CurrentToken {
    try {
        $t = & $Config.Cloudflared access token "--app=$($Config.AppUrl)" 2>$null
        if ($LASTEXITCODE -eq 0 -and $t -and $t -notmatch 'Unable to find token|please login') {
            return $t.Trim()
        }
    } catch {}
    return $null
}
 
function Set-NextRun {
    param([DateTime]$When)
    $triggers = @(
        (New-ScheduledTaskTrigger -Once -At $When),
        (New-ScheduledTaskTrigger -AtLogOn)
    )
    Set-ScheduledTask -TaskName $Config.TaskName -Trigger $triggers | Out-Null
    Write-Log "next run: $($When.ToString('s'))"
}
 
function Invoke-Login {
    Start-Process $Config.Cloudflared -ArgumentList @('access','login',$Config.AppUrl) -WindowStyle Hidden
    Write-Log 'triggered: cloudflared access login'
}
 
try {
    $token = Get-CurrentToken
    if ($null -eq $token) {
        Invoke-Login
        Set-NextRun (Get-Date).AddMinutes($Config.PostLoginRecheckMinutes)
        return
    }
 
    $exp      = Get-JwtExpiry $token
    $minsLeft = [int]($exp - (Get-Date)).TotalMinutes
    Write-Log "token exp=$($exp.ToString('s')) (${minsLeft}min)"
 
    if ($minsLeft -lt $Config.RenewWindowMinutes) {
        Invoke-Login
        Set-NextRun (Get-Date).AddMinutes($Config.PostLoginRecheckMinutes)
    } else {
        Set-NextRun $exp.AddMinutes(-$Config.RenewWindowMinutes)
    }
}
catch {
    Write-Log "ERROR: $($_.Exception.Message)"
    try { Set-NextRun (Get-Date).AddMinutes($Config.FallbackRetryMinutes) } catch {}
    exit 1
}
'@ | Out-File -FilePath "$dir\renew-token.ps1" -Encoding utf8
 
$action    = New-ScheduledTaskAction -Execute 'powershell.exe' `
    -Argument '-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\cloudflared-ssh-axe\renew-token.ps1"'
$trigger   = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1)
$principal = New-ScheduledTaskPrincipal -UserId "$env:USERDOMAIN\$env:USERNAME" `
    -LogonType Interactive -RunLevel Highest   # ← Highest 필수 (함정 #11)
$settings  = New-ScheduledTaskSettingsSet -StartWhenAvailable `
    -DontStopIfGoingOnBatteries -AllowStartIfOnBatteries
 
Register-ScheduledTask -TaskName 'cloudflared-token-renewal' `
    -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force

Start-ScheduledTask -TaskName 'cloudflared-token-renewal'
Start-Sleep -Seconds 3
Get-Content C:\ProgramData\cloudflared-ssh-axe\renewal.log -Tail 5

failed to acquire app token lock: timed out waiting for lock file
  C:\Windows\System32\config\systemprofile\.cloudflared\...-token.lock

# repo 별
cd /Users/axe/<repo>
git config user.email "<your-email>@axellc.com"
 
# 또는 본인 session 환경변수
export GIT_AUTHOR_EMAIL="<your-email>@axellc.com"
export GIT_COMMITTER_EMAIL="<your-email>@axellc.com"