Questions[agent](server)

I am trying to set up a docker deployment process with Azure DevOps using a self-hosted Linux VM as a deployment target. It seems that I must install the AzurePipelines agent on the target Linux VM first, however it always stalls at the "Connect" stage. Since I am doing this for the first time, I suspect that I have missed some crucial step in the process.

What I have done so far:

• created an Azure DevOps project with a build pipeline that successfully pushes a docker image to AzureCR

• created an admin user on a (3rd party hosted) Linux VM VM (have tried CentOS 7 64bit and Ubuntu 18.04 LTS 64bit -- same result)

• created an Environment in DevOps Pipelines

• tried to add a resource to the new environment by copying the provided script to an SSH command prompt on the VM. --> download and unpacking successful, but ends with error:

   ./config.sh: Zeile 86:  4947 Speicherzugriffsfehler  ./bin/Agent.Listener configure "$@"
   sudo: ./svc.sh: Befehl nicht gefunden
   sudo: ./svc.sh: Befehl nicht gefunden
  

• manually run ~/azagent$ sudo bin/installdependencies.sh --> finished successfully

• manually run ~/azagent$ sudo ./config.sh --> following output, after that it stalls and does nothing; no VM appears in Azure Pipelines environment resources:

  ___                      ______ _            _ _
 / _ \                     | ___ (_)          | (_)
/ /_\ \_____   _ _ __ ___  | |_/ /_ _ __   ___| |_ _ __   ___  ___
|  _  |_  / | | | '__/ _ \ |  __/| | '_ \ / _ \ | | '_ \ / _ \/ __|
| | | |/ /| |_| | | |  __/ | |   | | |_) |  __/ | | | | |  __/\__ \
\_| |_/___|\__,_|_|  \___| \_|   |_| .__/ \___|_|_|_| |_|\___||___/
                                   | |
        agent v2.175.2             |_|          (commit 5c4925c)


>> Endbenutzer-Lizenzbestimmungen:

Für das Erstellen von Quellen aus einem TFVC-Repository muss die Zustimmung zu den Team Explorer Everywhere-Endbenutzer-Lizenzbestimmungen erfolgen. Dieser Schritt ist für das Erstellen von Quellen aus Git-Repositorys nicht erforderlich.

Eine Kopie der Team Explorer Everywhere-Endbenutzer-Lizenzbestimmungen finden Sie hier:
  /home/admin/azagent/externals/tee/license.html

Geben Sie (J/N) Den Team Explorer Everywhere-Lizenzbedingungen jetzt zustimmen? ein (Drücken Sie die EINGABETASTE, um N). > J

>> Verbinden:

Server-URL eingeben > https://dev.azure.com/[~~~~~]
Geben Sie Authentifizierungstyp ein (Drücken Sie die EINGABETASTE, um PAT). >
Persönliches Zugriffstoken eingeben > ****************************************************

Of course, I have inserted a proper name in the URL instead of [~~~~~].

On a side note, I was able to supply the very same VM with a managed identity by installing the Azure CLI as described in this article, but this does not solve my problem; it just rules out connectivity problems.

What am I missing?

Could somebody please explain the difference between build and release agents in the simplest of terms? This relates to Azure DevOps. I find info on build agents from Microsoft but I haven't found anything specifically for release agents. I'm not a developer by trade so if somebody could clear this up I would appreciate the help.

I have a MacBook with MacOSX Leopard (10.6.2) and I use it to connect to some servers (their O.S. is Debian Lenny) using SSH. I use RSA keys to login to server A, and from there I "bounce" to other servers B, C and D. I have activated agent forwarding in my laptop's .ssh/config for server A in order to be able to connect to A and then "bounce" from A to B, C or D without having to type my password every time. It works fine.

But I read that agent forwarding has one security flaw: if a hacker gets root access on server A, he will be able to hijack the agent forwarding mechanism and connect to servers B, C and D without any password.

Apparently, one solution is to use ssh-add's -c option: it is supposed to ask me for confirmation every time server A wants to use my RSA key. But for some reason, it fails:

miniquark@mylaptop:~$ ssh-add -c
Enter passphrase for /Users/miniquark/.ssh/id_rsa: 
Identity added: /Users/miniquark/.ssh/id_rsa (/Users/miniquark/.ssh/id_rsa)
The user has to confirm each use of the key
miniquark@mylaptop:~$ ssh serverA
Agent admitted failure to sign using the key.
miniquark@serverA's password: 

Normally, I don't need to launch ssh-add manually, since MacOSX does it for me automatically when I launch an ssh connection that requires an RSA key. So perhaps the solution would be to configure MacOSX to launch ssh-add with the -c option. Unfortunately, I just cannot find that option.

If you have any other idea that would protect me from agent forwarding hijacking, I would be very grateful.

Thank you.

If I have a server A into which I can login with my ssh key and I have the ability to "sudo su - otheruser", I lose key forwarding, because the env variables are removed and the socket is only readable by my original user. Is there a way I can bridge the key forwarding through the "sudo su - otheruser", so I can do stuff on a server B with my forwarded key (git clone and rsync in my case)?

The only way I can think of is adding my key to authorized_keys of otheruser and "ssh otheruser@localhost", but that's cumbersome to do for every user and server combination I may have.

In short:

$ sudo -HE ssh user@host
(success)
$ sudo -HE -u otheruser ssh user@host
Permission denied (publickey). 

I have a SQL Server Agent job comprised of 10 steps and each step has many parameters defined. Now I need another job almost exactly the same, but with a few differences. Since "copy / paste" isn't an option for jobs, I'm looking for suggestions on what would be the best way to create a new job based on the first.

Edit: I just noticed that I can right-click and "Script Job As". I suppose one option would be to do just that and edit the script for my changes. I'm still curious as to if there are any other (better?) options as well.