open a reverse-shell in a GitHub Actions job
This opens a reverse-shell in a GitHub Actions job to aid you troublshooting odd behaviours.
Since GitHub Actions cannot be directly accessed from the internet (only outbound connections are allowed), we need a way to expose individual services to our local machine. For this we are going to use the fatedier/frp reverse proxy and our local machine that is indirectly accessible from the internet. Something alike:
NB This also applies to Windows based GitHub Actions, but using RDP instead of SSH.
Generate the TLS certificates:
export FRPS_DOMAIN=frps.example.com
./generate-certificates.sh
Start the server with the corresponding frps.ini configuration file:
./frp/frps -c ./frps.ini
Temporarily run the client in our machine to test everything with the corresponding frpc.ini configuration file:
./frp/frpc -c ./frpc.ini
Connect to the client SSH server:
ssh -o Port=6000 127.0.0.1
Stop the frpc
client.
You are now almost ready to run frpc
inside your GitHub Action job; before doing that, you need to create the following repository encrypted secrets:
Secret Name | Value |
---|---|
RUNNER_PASSWORD |
runner account password (it will be reset to this value) |
FRPS_DOMAIN |
your frps domain |
FRPC_TLS_KEY |
paste the contents of the ca/github-key.pem file |
FRPC_TLS_CERTIFICATE |
paste the contents of the ca/github.pem file |
FRPC_TLS_CA_CERTIFICATE |
paste the contents of the ca/ca.pem file |
SSH_PUBLIC_KEY |
paste the contents of the ~/.ssh/id_rsa.pub file |
You can now run the GitHub Action.
NB frpc
will keep the Action running until GitHub expires it after 6h (as per the usage limits) or you cancel it.
Connect to the Ubuntu based GitHub Action SSH server:
ssh -o Port=6000 [email protected]
#killall frpc # terminate frpc from the shell.
Connect to the Windows based GitHub Action RDP server:
sudo apt-get install -y freerdp2-x11
xfreerdp /v:127.0.0.1:6001 /u:runneradmin "/p:$RUNNER_PASSWORD" /size:1440x900 +clipboard
And that's it... You now have a way to troubleshoot your GitHub Actions.
For more details see this repository action workflows.