From 306d01115179b954e6d2983e4035f31b8bc4047d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marco=20Andr=C3=A9=20Dinis?= Date: Mon, 6 Jun 2022 16:18:15 +0100 Subject: [PATCH] Deprecate `ca_signature_algo` config (#13033) After the merge of https://github.com/gravitational/teleport/pull/12674 we no longer use the following configuration: ```yaml teleport: ca_signature_algo: "rsa-sha2-512" ``` As we now rely upon the `x/crypto` package to choose the signing algorithm (it defaults to `rsa-sha2-512`) **Demo** If we set `ca_signature_algo` (the value is irrelevant) and start `teleport` we get: ```shell root@marco:/workspace# teleport start --debug 2022-06-02T09:33:58Z WARN ca_signing_algo config option is deprecated and will be ignored, we'll always default to rsa-sha2-512. config/configuration.go:348 2022-06-02T09:33:58Z INFO Generating new host UUID: b001159a-10e0-49a7-b4dc-61c73fbe9e42. service/service.go:726 ... ``` Fixes #12905 --- api/types/authority.go | 14 --- docs/pages/setup/reference/config.mdx | 5 - integration/helpers.go | 8 +- integration/integration_test.go | 151 ----------------------- lib/auth/auth.go | 12 -- lib/auth/clt_test.go | 2 - lib/auth/init.go | 6 - lib/auth/init_test.go | 51 -------- lib/auth/native/native_test.go | 5 - lib/auth/rotate.go | 24 ++-- lib/auth/test/suite.go | 6 - lib/client/identityfile/identity_test.go | 1 - lib/client/keyagent_test.go | 3 - lib/client/keystore_test.go | 2 - lib/client/known_hosts_migrate_test.go | 2 - lib/config/configuration.go | 4 +- lib/config/configuration_test.go | 15 --- lib/config/fileconf.go | 13 +- lib/defaults/defaults.go | 6 - lib/reversetunnel/srv_test.go | 5 - lib/service/cfg.go | 5 - lib/service/cfg_test.go | 1 - lib/service/service.go | 1 - lib/services/authority.go | 12 +- lib/services/watcher_test.go | 2 - lib/sshutils/authority.go | 40 ------ tool/tctl/common/auth_command_test.go | 2 - 27 files changed, 14 insertions(+), 384 deletions(-) diff --git a/api/types/authority.go b/api/types/authority.go index e7ef7afc834..2b92748010d 100644 --- a/api/types/authority.go +++ b/api/types/authority.go @@ -71,10 +71,6 @@ type CertAuthority interface { GetRotation() Rotation // SetRotation sets rotation state. SetRotation(Rotation) - // GetSigningAlg returns the signing algorithm used by signing keys. - GetSigningAlg() CertAuthoritySpecV2_SigningAlgType - // SetSigningAlg sets the signing algorithm used by signing keys. - SetSigningAlg(CertAuthoritySpecV2_SigningAlgType) // AllKeyTypesMatch returns true if all keys in the CA are of the same type. AllKeyTypesMatch() bool // Clone returns a copy of the cert authority object. @@ -263,16 +259,6 @@ func (ca *CertAuthorityV2) ID() *CertAuthID { return &CertAuthID{DomainName: ca.Spec.ClusterName, Type: ca.Spec.Type} } -// GetSigningAlg returns the CA's signing algorithm type -func (ca *CertAuthorityV2) GetSigningAlg() CertAuthoritySpecV2_SigningAlgType { - return ca.Spec.SigningAlg -} - -// SetSigningAlg sets the CA's signing algorith type -func (ca *CertAuthorityV2) SetSigningAlg(alg CertAuthoritySpecV2_SigningAlgType) { - ca.Spec.SigningAlg = alg -} - func (ca *CertAuthorityV2) getOldKeySet(index int) (keySet CAKeySet) { // in the "old" CA schema, index 0 contains the active keys and index 1 the // additional trusted keys diff --git a/docs/pages/setup/reference/config.mdx b/docs/pages/setup/reference/config.mdx index ed232818f4e..2bdcc764cd2 100644 --- a/docs/pages/setup/reference/config.mdx +++ b/docs/pages/setup/reference/config.mdx @@ -210,11 +210,6 @@ teleport: write_max_capacity: int write_target_value: float - # CA Signing algorithm used for OpenSSH Certificates - # Defaults to rsa-sha2-512 in 4.3 and above. - # valid values are: ssh-rsa, rsa-sha2-256, rsa-sha2-512; ssh-rsa is SHA1 - ca_signature_algo: "rsa-sha2-512" - # Cipher algorithms that the server supports. This section only needs to be # set if you want to override the defaults. ciphers: diff --git a/integration/helpers.go b/integration/helpers.go index 98854949c99..0eb36229ce6 100644 --- a/integration/helpers.go +++ b/integration/helpers.go @@ -212,7 +212,6 @@ func NewInstance(cfg InstanceConfig) *TeleInstance { cert, err := keygen.GenerateHostCert(services.HostCertParams{ CASigner: signer, - CASigningAlg: defaults.CASignatureAlgorithm, PublicHostKey: cfg.Pub, HostID: cfg.HostID, NodeName: cfg.NodeName, @@ -298,8 +297,6 @@ func (s *InstanceSecrets) GetCAs() ([]types.CertAuthority, error) { Cert: s.TLSCACert, }}, }, - Roles: []string{}, - SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_512, }) if err != nil { return nil, trace.Wrap(err) @@ -320,8 +317,7 @@ func (s *InstanceSecrets) GetCAs() ([]types.CertAuthority, error) { Cert: s.TLSCACert, }}, }, - Roles: []string{services.RoleNameForCertAuthority(s.SiteName)}, - SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_512, + Roles: []string{services.RoleNameForCertAuthority(s.SiteName)}, }) if err != nil { return nil, trace.Wrap(err) @@ -337,8 +333,6 @@ func (s *InstanceSecrets) GetCAs() ([]types.CertAuthority, error) { Cert: s.TLSCACert, }}, }, - Roles: []string{}, - SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_512, }) if err != nil { return nil, trace.Wrap(err) diff --git a/integration/integration_test.go b/integration/integration_test.go index 7616dcea0ce..46f427bb840 100644 --- a/integration/integration_test.go +++ b/integration/integration_test.go @@ -57,7 +57,6 @@ import ( "github.com/gravitational/teleport/lib/auth/testauthority" "github.com/gravitational/teleport/lib/bpf" "github.com/gravitational/teleport/lib/client" - "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/events" "github.com/gravitational/teleport/lib/pam" "github.com/gravitational/teleport/lib/reversetunnel" @@ -65,7 +64,6 @@ import ( "github.com/gravitational/teleport/lib/services" "github.com/gravitational/teleport/lib/session" "github.com/gravitational/teleport/lib/srv" - "github.com/gravitational/teleport/lib/sshutils" "github.com/gravitational/teleport/lib/utils" "github.com/google/uuid" @@ -191,7 +189,6 @@ func TestIntegrations(t *testing.T) { t.Run("PortForwarding", suite.bind(testPortForwarding)) t.Run("ProxyHostKeyCheck", suite.bind(testProxyHostKeyCheck)) t.Run("ReverseTunnelCollapse", suite.bind(testReverseTunnelCollapse)) - t.Run("RotateChangeSigningAlg", suite.bind(testRotateChangeSigningAlg)) t.Run("RotateRollback", suite.bind(testRotateRollback)) t.Run("RotateSuccess", suite.bind(testRotateSuccess)) t.Run("RotateTrustedClusters", suite.bind(testRotateTrustedClusters)) @@ -4210,154 +4207,6 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) { } } -// TestRotateChangeSigningAlg tests the change of CA signing algorithm on -// manual rotation. -func testRotateChangeSigningAlg(t *testing.T, suite *integrationTestSuite) { - ctx := context.Background() - // Start with an instance using default signing alg. - tconf := suite.rotationConfig(true) - teleport := suite.newTeleportInstance() - logins := []string{suite.me.Username} - for _, login := range logins { - teleport.AddUser(login, []string{login}) - } - config, err := teleport.GenerateConfig(t, nil, tconf) - require.NoError(t, err) - - serviceC := make(chan *service.TeleportProcess, 20) - runErrCh := make(chan error, 1) - - restart := func(svc *service.TeleportProcess, cancel func()) (*service.TeleportProcess, func()) { - if svc != nil && cancel != nil { - // shut down the service - cancel() - // close the service without waiting for the connections to drain - err := svc.Close() - require.NoError(t, err) - err = svc.Wait() - require.NoError(t, err) - - select { - case err := <-runErrCh: - require.NoError(t, err) - case <-time.After(20 * time.Second): - t.Fatalf("failed to shut down the server") - } - } - - ctx, cancel := context.WithCancel(context.Background()) - go func() { - runErrCh <- service.Run(ctx, *config, func(cfg *service.Config) (service.Process, error) { - svc, err := service.NewTeleport(cfg, service.WithIMDSClient(&disabledIMDSClient{})) - if err == nil { - serviceC <- svc - } - return svc, err - }) - }() - - svc, err = waitForProcessStart(serviceC) - require.NoError(t, err) - return svc, cancel - } - - assertSigningAlg := func(svc *service.TeleportProcess, alg string) { - hostCA, err := svc.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{Type: types.HostCA, DomainName: Site}, false) - require.NoError(t, err) - require.Equal(t, alg, sshutils.GetSigningAlgName(hostCA)) - - userCA, err := svc.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{Type: types.UserCA, DomainName: Site}, false) - require.NoError(t, err) - require.Equal(t, alg, sshutils.GetSigningAlgName(userCA)) - } - - rotate := func(svc *service.TeleportProcess, mode string) *service.TeleportProcess { - t.Logf("Rotation phase: %q.", types.RotationPhaseInit) - err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{ - TargetPhase: types.RotationPhaseInit, - Mode: mode, - }) - require.NoError(t, err) - - // wait until service phase update to be broadcasted (init phase does not trigger reload) - err = waitForProcessEvent(svc, service.TeleportPhaseChangeEvent, 10*time.Second) - require.NoError(t, err) - - t.Logf("Rotation phase: %q.", types.RotationPhaseUpdateClients) - err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{ - TargetPhase: types.RotationPhaseUpdateClients, - Mode: mode, - }) - require.NoError(t, err) - - // wait until service reload - svc, err = waitForReload(serviceC, svc) - require.NoError(t, err) - - t.Logf("Rotation phase: %q.", types.RotationPhaseUpdateServers) - err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{ - TargetPhase: types.RotationPhaseUpdateServers, - Mode: mode, - }) - require.NoError(t, err) - - // wait until service reloaded - svc, err = waitForReload(serviceC, svc) - require.NoError(t, err) - - t.Logf("rotation phase: %q", types.RotationPhaseStandby) - err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{ - TargetPhase: types.RotationPhaseStandby, - Mode: mode, - }) - require.NoError(t, err) - - // wait until service reloaded - svc, err = waitForReload(serviceC, svc) - require.NoError(t, err) - - return svc - } - - // Start the instance. - svc, cancel := restart(nil, nil) - - t.Log("default signature algorithm due to empty config value") - // Verify the default signing algorithm with config value empty. - assertSigningAlg(svc, defaults.CASignatureAlgorithm) - - t.Log("change signature algorithm with custom config value and manual rotation") - // Change the signing algorithm in config file. - signingAlg := ssh.KeyAlgoRSA - config.CASignatureAlgorithm = &signingAlg - svc, cancel = restart(svc, cancel) - // Do a manual rotation - this should change the signing algorithm. - svc = rotate(svc, types.RotationModeManual) - assertSigningAlg(svc, ssh.KeyAlgoRSA) - - t.Log("preserve signature algorithm with empty config value and manual rotation") - // Unset the config value. - config.CASignatureAlgorithm = nil - svc, cancel = restart(svc, cancel) - - // Do a manual rotation - this should leave the signing algorithm - // unaffected because config value is not set. - svc = rotate(svc, types.RotationModeManual) - assertSigningAlg(svc, ssh.KeyAlgoRSA) - - // shut down the service - cancel() - // close the service without waiting for the connections to drain - svc.Close() - - select { - case err := <-runErrCh: - require.NoError(t, err) - case <-time.After(20 * time.Second): - t.Fatalf("failed to shut down the server") - } -} - // rotationConfig sets up default config used for CA rotation tests func (s *integrationTestSuite) rotationConfig(disableWebService bool) *service.Config { tconf := s.defaultServiceConfig() diff --git a/lib/auth/auth.go b/lib/auth/auth.go index 761c6b884e3..d8f281d62c2 100644 --- a/lib/auth/auth.go +++ b/lib/auth/auth.go @@ -180,7 +180,6 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) { oidcClients: make(map[string]*oidcClient), samlProviders: make(map[string]*samlProvider), githubClients: make(map[string]*githubClient), - caSigningAlg: cfg.CASigningAlg, cancelFunc: cancelFunc, closeCtx: closeCtx, emitter: cfg.Emitter, @@ -339,9 +338,6 @@ type Server struct { // cipherSuites is a list of ciphersuites that the auth server supports. cipherSuites []uint16 - // caSigningAlg is an SSH signing algorithm to use when generating new CAs. - caSigningAlg *string - // cache is a fast cache that allows auth server // to use cache for most frequent operations, // if not set, cache uses itself @@ -673,7 +669,6 @@ func (a *Server) GenerateHostCert(hostPublicKey []byte, hostID, nodeName string, // create and sign! return a.generateHostCert(services.HostCertParams{ CASigner: caSigner, - CASigningAlg: sshutils.GetSigningAlgName(ca), PublicHostKey: hostPublicKey, HostID: hostID, NodeName: nodeName, @@ -1069,7 +1064,6 @@ func (a *Server) generateUserCert(req certRequest) (*proto.Certs, error) { params := services.UserCertParams{ CASigner: caSigner, - CASigningAlg: sshutils.GetSigningAlgName(userCA), PublicUserKey: req.publicKey, Username: req.user.GetName(), Impersonator: req.impersonator, @@ -2178,7 +2172,6 @@ func (a *Server) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequ // generate host SSH certificate hostSSHCert, err := a.generateHostCert(services.HostCertParams{ CASigner: caSigner, - CASigningAlg: sshutils.GetSigningAlgName(ca), PublicHostKey: req.PublicSSHKey, HostID: req.HostID, NodeName: req.NodeName, @@ -3580,15 +3573,10 @@ func (a *Server) createSelfSignedCA(caID types.CertAuthID) error { if err != nil { return trace.Wrap(err) } - sigAlg := defaults.CASignatureAlgorithm - if a.caSigningAlg != nil && *a.caSigningAlg != "" { - sigAlg = *a.caSigningAlg - } ca, err := types.NewCertAuthority(types.CertAuthoritySpecV2{ Type: caID.Type, ClusterName: caID.DomainName, ActiveKeys: keySet, - SigningAlg: sshutils.ParseSigningAlg(sigAlg), }) if err != nil { return trace.Wrap(err) diff --git a/lib/auth/clt_test.go b/lib/auth/clt_test.go index 997c551f19b..871c2b15228 100644 --- a/lib/auth/clt_test.go +++ b/lib/auth/clt_test.go @@ -165,8 +165,6 @@ func newCertAuthority(t *testing.T, name string, caType types.CertAuthType) type Key: key, }}, }, - Roles: nil, - SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_256, }) require.NoError(t, err) return ca diff --git a/lib/auth/init.go b/lib/auth/init.go index 0c88e7db14d..8b79f89b1c0 100644 --- a/lib/auth/init.go +++ b/lib/auth/init.go @@ -159,11 +159,6 @@ type InitConfig struct { // CipherSuites is a list of ciphersuites that the auth server supports. CipherSuites []uint16 - // CASigningAlg is a signing algorithm used for SSH (certificate and - // handshake) signatures for both host and user CAs. This option only - // affects newly-created CAs. - CASigningAlg *string - // Emitter is events emitter, used to submit discrete events Emitter apievents.Emitter @@ -1105,7 +1100,6 @@ func migrateDBAuthority(ctx context.Context, asrv *Server) error { // Copy only TLS keys as SSH are not needed. TLS: cav2.Spec.ActiveKeys.TLS, }, - SigningAlg: cav2.Spec.SigningAlg, }) if err != nil { return trace.Wrap(err) diff --git a/lib/auth/init_test.go b/lib/auth/init_test.go index 90fbc6ae999..da04d87f1ca 100644 --- a/lib/auth/init_test.go +++ b/lib/auth/init_test.go @@ -31,7 +31,6 @@ import ( "github.com/gravitational/teleport/lib/auth/testauthority" "github.com/gravitational/teleport/lib/backend" "github.com/gravitational/teleport/lib/backend/lite" - "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/fixtures" "github.com/gravitational/teleport/lib/services" "github.com/gravitational/teleport/lib/services/suite" @@ -61,7 +60,6 @@ func TestReadIdentity(t *testing.T) { cert, err := a.GenerateHostCert(services.HostCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicHostKey: pub, HostID: "id1", NodeName: "node-name", @@ -83,7 +81,6 @@ func TestReadIdentity(t *testing.T) { expiryDate := clock.Now().Add(ttl) bytes, err := a.GenerateHostCert(services.HostCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicHostKey: pub, HostID: "id1", NodeName: "node-name", @@ -111,7 +108,6 @@ func TestBadIdentity(t *testing.T) { // missing authority domain cert, err := a.GenerateHostCert(services.HostCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicHostKey: pub, HostID: "id2", NodeName: "", @@ -127,7 +123,6 @@ func TestBadIdentity(t *testing.T) { // missing host uuid cert, err = a.GenerateHostCert(services.HostCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicHostKey: pub, HostID: "example.com", NodeName: "", @@ -143,7 +138,6 @@ func TestBadIdentity(t *testing.T) { // unrecognized role cert, err = a.GenerateHostCert(services.HostCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicHostKey: pub, HostID: "example.com", NodeName: "", @@ -447,51 +441,6 @@ func TestClusterName(t *testing.T) { require.Equal(t, conf.ClusterName.GetClusterName(), cn.GetClusterName()) } -func TestCASigningAlg(t *testing.T) { - ctx := context.Background() - verifyCAs := func(auth *Server, alg string) { - hostCAs, err := auth.GetCertAuthorities(ctx, types.HostCA, false) - require.NoError(t, err) - for _, ca := range hostCAs { - require.Equal(t, sshutils.GetSigningAlgName(ca), alg) - } - userCAs, err := auth.GetCertAuthorities(ctx, types.UserCA, false) - require.NoError(t, err) - for _, ca := range userCAs { - require.Equal(t, sshutils.GetSigningAlgName(ca), alg) - } - } - - // Start a new server without specifying a signing alg. - conf := setupConfig(t) - auth, err := Init(conf) - require.NoError(t, err) - defer auth.Close() - verifyCAs(auth, ssh.KeyAlgoRSASHA512) - - require.NoError(t, auth.Close()) - - // Reset the auth server state. - conf.Backend, err = lite.New(context.TODO(), backend.Params{"path": t.TempDir()}) - require.NoError(t, err) - conf.DataDir = t.TempDir() - - // Start a new server with non-default signing alg. - signingAlg := ssh.KeyAlgoRSA - conf.CASigningAlg = &signingAlg - auth, err = Init(conf) - require.NoError(t, err) - defer auth.Close() - verifyCAs(auth, ssh.KeyAlgoRSA) - - // Start again, using a different alg. This should not change the existing - // CA. - signingAlg = ssh.KeyAlgoRSASHA256 - auth, err = Init(conf) - require.NoError(t, err) - verifyCAs(auth, ssh.KeyAlgoRSA) -} - // TestPresets tests behavior of presets func TestPresets(t *testing.T) { ctx := context.Background() diff --git a/lib/auth/native/native_test.go b/lib/auth/native/native_test.go index 4bc8d89c099..dc4a97ab114 100644 --- a/lib/auth/native/native_test.go +++ b/lib/auth/native/native_test.go @@ -27,7 +27,6 @@ import ( "github.com/gravitational/teleport/api/types" "github.com/gravitational/teleport/api/utils/sshutils" "github.com/gravitational/teleport/lib/auth/test" - "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/services" "github.com/gravitational/teleport/lib/utils" @@ -163,7 +162,6 @@ func (s *NativeSuite) TestBuildPrincipals(c *check.C) { hostCertificateBytes, err := s.suite.A.GenerateHostCert( services.HostCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicHostKey: hostPublicKey, HostID: tt.inHostID, NodeName: tt.inNodeName, @@ -211,7 +209,6 @@ func (s *NativeSuite) TestUserCertCompatibility(c *check.C) { userCertificateBytes, err := s.suite.A.GenerateUserCert(services.UserCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicUserKey: pub, Username: "user", AllowedLogins: []string{"centos", "root"}, @@ -232,8 +229,6 @@ func (s *NativeSuite) TestUserCertCompatibility(c *check.C) { userCertificate, err := sshutils.ParseCertificate(userCertificateBytes) c.Assert(err, check.IsNil, comment) - // Check that the signature algorithm is correct. - c.Assert(userCertificate.Signature.Format, check.Equals, defaults.CASignatureAlgorithm) // check if we added the roles extension _, ok := userCertificate.Extensions[teleport.CertExtensionTeleportRoles] c.Assert(ok, check.Equals, tt.outHasRoles, comment) diff --git a/lib/auth/rotate.go b/lib/auth/rotate.go index 8ebda490a4f..60341752dcd 100644 --- a/lib/auth/rotate.go +++ b/lib/auth/rotate.go @@ -26,7 +26,6 @@ import ( "github.com/gravitational/teleport/api/types" "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/services" - "github.com/gravitational/teleport/lib/sshutils" "github.com/gravitational/teleport/lib/tlsca" "github.com/gravitational/teleport/lib/utils" @@ -128,8 +127,6 @@ type rotationReq struct { // privateKey is passed by tests to supply private key for cert authorities // instead of generating them on each iteration privateKey []byte - // caSigningAlg is an SSH signing algorithm to use with the new CA. - caSigningAlg *string } // RotateCertAuthority starts or restarts certificate authority rotation process. @@ -228,14 +225,13 @@ func (a *Server) RotateCertAuthority(ctx context.Context, req RotateRequest) err } rotated, err := a.processRotationRequest(rotationReq{ - ca: existing, - clock: a.clock, - targetPhase: req.TargetPhase, - schedule: *req.Schedule, - gracePeriod: *req.GracePeriod, - mode: req.Mode, - privateKey: a.privateKey, - caSigningAlg: a.caSigningAlg, + ca: existing, + clock: a.clock, + targetPhase: req.TargetPhase, + schedule: *req.Schedule, + gracePeriod: *req.GracePeriod, + mode: req.Mode, + privateKey: a.privateKey, }) if err != nil { return trace.Wrap(err) @@ -696,12 +692,6 @@ func (a *Server) startNewRotation(req rotationReq, ca types.CertAuthority) error } ca.SetRotation(rotation) - // The certificate signing algorithm is only set when signing algorithm is - // explicitly set in the config file. If the config file doesn't set a value, - // preserve the signing algorithm of the existing CA. - if req.caSigningAlg != nil { - sshutils.SetSigningAlgName(ca, *req.caSigningAlg) - } return nil } diff --git a/lib/auth/test/suite.go b/lib/auth/test/suite.go index 57d3841d092..298f04ac8b4 100644 --- a/lib/auth/test/suite.go +++ b/lib/auth/test/suite.go @@ -64,7 +64,6 @@ func (s *AuthSuite) GenerateHostCert(c *check.C) { cert, err := s.A.GenerateHostCert( services.HostCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicHostKey: pub, HostID: "00000000-0000-0000-0000-000000000000", NodeName: "auth.example.com", @@ -95,7 +94,6 @@ func (s *AuthSuite) GenerateUserCert(c *check.C) { cert, err := s.A.GenerateUserCert(services.UserCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicUserKey: pub, Username: "user", AllowedLogins: []string{"centos", "root"}, @@ -113,7 +111,6 @@ func (s *AuthSuite) GenerateUserCert(c *check.C) { cert, err = s.A.GenerateUserCert(services.UserCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicUserKey: pub, Username: "user", AllowedLogins: []string{"root"}, @@ -128,7 +125,6 @@ func (s *AuthSuite) GenerateUserCert(c *check.C) { _, err = s.A.GenerateUserCert(services.UserCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicUserKey: pub, Username: "user", AllowedLogins: []string{"root"}, @@ -143,7 +139,6 @@ func (s *AuthSuite) GenerateUserCert(c *check.C) { _, err = s.A.GenerateUserCert(services.UserCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicUserKey: pub, Username: "user", AllowedLogins: []string{"root"}, @@ -158,7 +153,6 @@ func (s *AuthSuite) GenerateUserCert(c *check.C) { impersonator := "alice" cert, err = s.A.GenerateUserCert(services.UserCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicUserKey: pub, Username: "user", Impersonator: impersonator, diff --git a/lib/client/identityfile/identity_test.go b/lib/client/identityfile/identity_test.go index 5f1d28395a9..59203e86bcd 100644 --- a/lib/client/identityfile/identity_test.go +++ b/lib/client/identityfile/identity_test.go @@ -93,7 +93,6 @@ func newClientKey(t *testing.T) *client.Key { certificate, err := keygen.GenerateUserCert(services.UserCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicUserKey: publicKey, Username: "testuser", }) diff --git a/lib/client/keyagent_test.go b/lib/client/keyagent_test.go index c52d6b9eac6..eb75c631658 100644 --- a/lib/client/keyagent_test.go +++ b/lib/client/keyagent_test.go @@ -36,7 +36,6 @@ import ( "github.com/gravitational/teleport/api/utils/keypaths" "github.com/gravitational/teleport/lib/auth" "github.com/gravitational/teleport/lib/auth/testauthority" - "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/fixtures" "github.com/gravitational/teleport/lib/services" "github.com/gravitational/teleport/lib/sshutils" @@ -272,7 +271,6 @@ func TestHostCertVerification(t *testing.T) { require.NoError(t, err) hostCertBytes, err := keygen.GenerateHostCert(services.HostCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicHostKey: hostPub, HostID: "5ff40d80-9007-4f28-8f49-7d4fda2f574d", NodeName: "server01", @@ -520,7 +518,6 @@ func (s *KeyAgentTestSuite) makeKey(username string, allowedLogins []string, ttl certificate, err := keygen.GenerateUserCert(services.UserCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicUserKey: publicKey, Username: username, AllowedLogins: allowedLogins, diff --git a/lib/client/keystore_test.go b/lib/client/keystore_test.go index 9672fc11000..1a486dc8978 100644 --- a/lib/client/keystore_test.go +++ b/lib/client/keystore_test.go @@ -255,7 +255,6 @@ func TestProxySSHConfig(t *testing.T) { hostCert, err := s.keygen.GenerateHostCert(services.HostCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicHostKey: hostPub, HostID: "127.0.0.1", NodeName: "127.0.0.1", @@ -465,7 +464,6 @@ func (s *keyStoreTest) makeSignedKey(t *testing.T, idx KeyIndex, makeExpired boo cert, err = s.keygen.GenerateUserCert(services.UserCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicUserKey: pub, Username: idx.Username, AllowedLogins: allowedLogins, diff --git a/lib/client/known_hosts_migrate_test.go b/lib/client/known_hosts_migrate_test.go index 4a86355180a..4c7d9c9afb8 100644 --- a/lib/client/known_hosts_migrate_test.go +++ b/lib/client/known_hosts_migrate_test.go @@ -23,7 +23,6 @@ import ( "testing" "github.com/gravitational/teleport/lib/auth/testauthority" - "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/services" "github.com/stretchr/testify/require" "golang.org/x/crypto/ssh" @@ -51,7 +50,6 @@ func generateHostCert(t *testing.T, s *knownHostsMigrateTest, clusterName string HostID: "127.0.0.1", NodeName: "127.0.0.1", ClusterName: clusterName, - CASigningAlg: defaults.CASignatureAlgorithm, PublicHostKey: hostPub, }) require.Nil(t, err) diff --git a/lib/config/configuration.go b/lib/config/configuration.go index 967701e848b..75500015e40 100644 --- a/lib/config/configuration.go +++ b/lib/config/configuration.go @@ -345,7 +345,7 @@ func ApplyFileConfig(fc *FileConfig, cfg *service.Config) error { cfg.MACAlgorithms = fc.MACAlgorithms } if fc.CASignatureAlgorithm != nil { - cfg.CASignatureAlgorithm = fc.CASignatureAlgorithm + log.Warn("ca_signing_algo config option is deprecated and will be removed in a future release, Teleport defaults to rsa-sha2-512.") } // Read in how nodes will validate the CA. A single empty string in the file @@ -1493,8 +1493,6 @@ func parseAuthorizedKeys(bytes []byte, allowedLogins []string) (types.CertAuthor PublicKey: ssh.MarshalAuthorizedKey(pubkey), }}, }, - Roles: nil, - SigningAlg: types.CertAuthoritySpecV2_UNKNOWN, }) if err != nil { return nil, nil, trace.Wrap(err) diff --git a/lib/config/configuration_test.go b/lib/config/configuration_test.go index 5cff3fa4ab9..b12ab255578 100644 --- a/lib/config/configuration_test.go +++ b/lib/config/configuration_test.go @@ -606,21 +606,6 @@ teleport: - kexAlgoCurve25519SHA256 mac_algos: - hmac-sha2-256-etm@openssh.com -`, - outError: true, - }, - { - desc: "change CA signature alg, valid", - inConfig: ` -teleport: - ca_signature_algo: ssh-rsa -`, - }, - { - desc: "invalid CA signature alg, not valid", - inConfig: ` -teleport: - ca_signature_algo: foobar `, outError: true, }, diff --git a/lib/config/fileconf.go b/lib/config/fileconf.go index 3c0e956d246..544aaedbbc5 100644 --- a/lib/config/fileconf.go +++ b/lib/config/fileconf.go @@ -54,12 +54,6 @@ import ( "gopkg.in/yaml.v2" ) -var validCASigAlgos = []string{ - ssh.KeyAlgoRSA, - ssh.KeyAlgoRSASHA256, - ssh.KeyAlgoRSASHA512, -} - // FileConfig structre represents the teleport configuration stored in a config file // in YAML format (usually /etc/teleport.yaml) // @@ -426,9 +420,6 @@ func (conf *FileConfig) CheckAndSetDefaults() error { return trace.BadParameter("MAC algorithm %q is not supported; supported algorithms: %q", m, sc.MACs) } } - if conf.CASignatureAlgorithm != nil && !apiutils.SliceContainsStr(validCASigAlgos, *conf.CASignatureAlgorithm) { - return trace.BadParameter("CA signature algorithm %q is not supported; supported algorithms: %q", *conf.CASignatureAlgorithm, validCASigAlgos) - } return nil } @@ -543,9 +534,7 @@ type Global struct { // the server supports. If omitted the defaults will be used. MACAlgorithms []string `yaml:"mac_algos,omitempty"` - // CASignatureAlgorithm is an SSH Certificate Authority (CA) signature - // algorithm that the server uses for signing user and host certificates. - // If omitted, the default will be used. + // CASignatureAlgorithm is ignored but ketp for config backwards compat CASignatureAlgorithm *string `yaml:"ca_signature_algo,omitempty"` // CAPin is the SKPI hash of the CA used to verify the Auth Server. Can be diff --git a/lib/defaults/defaults.go b/lib/defaults/defaults.go index 1fffe1f2a80..cb131bb9c49 100644 --- a/lib/defaults/defaults.go +++ b/lib/defaults/defaults.go @@ -30,8 +30,6 @@ import ( "github.com/gravitational/trace" "gopkg.in/square/go-jose.v2" - - "golang.org/x/crypto/ssh" ) // Default port numbers used by all teleport tools @@ -378,10 +376,6 @@ var ( // WindowsDesktopQueueSize is windows_desktop service watch queue size. WindowsDesktopQueueSize = 128 - // CASignatureAlgorithm is the default signing algorithm to use when - // creating new SSH CAs. - CASignatureAlgorithm = ssh.KeyAlgoRSASHA512 - // SessionControlTimeout is the maximum amount of time a controlled session // may persist after contact with the auth server is lost (sessctl semaphore // leases are refreshed at a rate of ~1/2 this duration). diff --git a/lib/reversetunnel/srv_test.go b/lib/reversetunnel/srv_test.go index b71c59efc81..589c091f5f3 100644 --- a/lib/reversetunnel/srv_test.go +++ b/lib/reversetunnel/srv_test.go @@ -27,7 +27,6 @@ import ( "github.com/gravitational/teleport/api/types" "github.com/gravitational/teleport/lib/auth" "github.com/gravitational/teleport/lib/auth/testauthority" - "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/services" "github.com/gravitational/teleport/lib/utils" @@ -53,8 +52,6 @@ func TestServerKeyAuth(t *testing.T) { PublicKey: pub, }}, }, - Roles: nil, - SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_256, }) require.NoError(t, err) @@ -76,7 +73,6 @@ func TestServerKeyAuth(t *testing.T) { key: func() ssh.PublicKey { rawCert, err := ta.GenerateHostCert(services.HostCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicHostKey: pub, HostID: "host-id", NodeName: con.User(), @@ -101,7 +97,6 @@ func TestServerKeyAuth(t *testing.T) { key: func() ssh.PublicKey { rawCert, err := ta.GenerateUserCert(services.UserCertParams{ CASigner: caSigner, - CASigningAlg: defaults.CASignatureAlgorithm, PublicUserKey: pub, Username: con.User(), AllowedLogins: []string{con.User()}, diff --git a/lib/service/cfg.go b/lib/service/cfg.go index 43da660f588..e393e8cea7d 100644 --- a/lib/service/cfg.go +++ b/lib/service/cfg.go @@ -192,11 +192,6 @@ type Config struct { // the server supports. If omitted the defaults will be used. MACAlgorithms []string - // CASignatureAlgorithm is an SSH Certificate Authority (CA) signature - // algorithm that the server uses for signing user and host certificates. - // If omitted, the default will be used. - CASignatureAlgorithm *string - // DiagnosticAddr is an address for diagnostic and healthz endpoint service DiagnosticAddr utils.NetAddr diff --git a/lib/service/cfg_test.go b/lib/service/cfg_test.go index 8b84e5cb317..5fd5e2a62b4 100644 --- a/lib/service/cfg_test.go +++ b/lib/service/cfg_test.go @@ -71,7 +71,6 @@ func TestDefaultConfig(t *testing.T) { "hmac-sha2-256-etm@openssh.com", "hmac-sha2-256", }) - require.Nil(t, config.CASignatureAlgorithm) // auth section auth := config.Auth diff --git a/lib/service/service.go b/lib/service/service.go index 02fd592e550..98d8965d15f 100644 --- a/lib/service/service.go +++ b/lib/service/service.go @@ -1333,7 +1333,6 @@ func (process *TeleportProcess) initAuthService() error { OIDCConnectors: cfg.OIDCConnectors, AuditLog: process.auditLog, CipherSuites: cfg.CipherSuites, - CASigningAlg: cfg.CASignatureAlgorithm, KeyStoreConfig: cfg.Auth.KeyStore, Emitter: checkingEmitter, Streamer: events.NewReportingStreamer(checkingStreamer, process.Config.UploadEventsC), diff --git a/lib/services/authority.go b/lib/services/authority.go index df6f26edecc..f096e2672b1 100644 --- a/lib/services/authority.go +++ b/lib/services/authority.go @@ -197,8 +197,6 @@ func GetSSHCheckingKeys(ca types.CertAuthority) [][]byte { type HostCertParams struct { // CASigner is the signer that will sign the public key of the host with the CA private key. CASigner ssh.Signer - // CASigningAlg is the signature algorithm used by the CA private key. - CASigningAlg string // PublicHostKey is the public key of the host PublicHostKey []byte // HostID is used by Teleport to uniquely identify a node within a cluster @@ -217,8 +215,8 @@ type HostCertParams struct { // Check checks parameters for errors func (c HostCertParams) Check() error { - if c.CASigner == nil || c.CASigningAlg == "" { - return trace.BadParameter("CASigner and CASigningAlg are required") + if c.CASigner == nil { + return trace.BadParameter("CASigner is required") } if c.HostID == "" && len(c.Principals) == 0 { return trace.BadParameter("HostID [%q] or Principals [%q] are required", @@ -253,8 +251,6 @@ type ChangePasswordReq struct { type UserCertParams struct { // CASigner is the signer that will sign the public key of the user with the CA private key CASigner ssh.Signer - // CASigningAlg is the signature algorithm used by the CA private key. - CASigningAlg string // PublicUserKey is the public key of the user PublicUserKey []byte // TTL defines how long a certificate is valid for @@ -304,8 +300,8 @@ type UserCertParams struct { // CheckAndSetDefaults checks the user certificate parameters func (c *UserCertParams) CheckAndSetDefaults() error { - if c.CASigner == nil || c.CASigningAlg == "" { - return trace.BadParameter("CASigner and CASigningAlg are required") + if c.CASigner == nil { + return trace.BadParameter("CASigner is required") } if c.TTL < defaults.MinCertDuration { c.TTL = defaults.MinCertDuration diff --git a/lib/services/watcher_test.go b/lib/services/watcher_test.go index 8864cc8dcf9..a87863aceca 100644 --- a/lib/services/watcher_test.go +++ b/lib/services/watcher_test.go @@ -866,8 +866,6 @@ func newCertAuthority(t *testing.T, name string, caType types.CertAuthType) type }, }, }, - Roles: nil, - SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_256, }) require.NoError(t, err) return ca diff --git a/lib/sshutils/authority.go b/lib/sshutils/authority.go index 89aa03a3f47..f24a64a0584 100644 --- a/lib/sshutils/authority.go +++ b/lib/sshutils/authority.go @@ -71,43 +71,3 @@ func ValidateSigners(ca types.CertAuthority) error { } return nil } - -// GetSigningAlgName returns the CA's signing algorithm type -func GetSigningAlgName(ca types.CertAuthority) string { - switch ca.GetSigningAlg() { - // UNKNOWN algorithm can come from a cluster that existed before SigningAlg - // field was added. Default to RSA-SHA1 to match the implicit algorithm - // used in those clusters. - case types.CertAuthoritySpecV2_RSA_SHA1, types.CertAuthoritySpecV2_UNKNOWN: - return ssh.KeyAlgoRSA - case types.CertAuthoritySpecV2_RSA_SHA2_256: - return ssh.KeyAlgoRSASHA256 - case types.CertAuthoritySpecV2_RSA_SHA2_512: - return ssh.KeyAlgoRSASHA512 - default: - return "" - } -} - -// SetSigningAlgName sets the signing algorithm type for the given CA -func SetSigningAlgName(ca types.CertAuthority, alg string) { - ca.SetSigningAlg(ParseSigningAlg(alg)) -} - -// ParseSigningAlg converts the name of the SSH signature algorithm to the -// corresponding proto enum value. -// -// alg should be one of ssh.SigAlgo* constants. If it's not one of those -// constants, types.CertAuthoritySpecV2_UNKNOWN is returned. -func ParseSigningAlg(alg string) types.CertAuthoritySpecV2_SigningAlgType { - switch alg { - case ssh.KeyAlgoRSA: - return types.CertAuthoritySpecV2_RSA_SHA1 - case ssh.KeyAlgoRSASHA256: - return types.CertAuthoritySpecV2_RSA_SHA2_256 - case ssh.KeyAlgoRSASHA512: - return types.CertAuthoritySpecV2_RSA_SHA2_512 - default: - return types.CertAuthoritySpecV2_UNKNOWN - } -} diff --git a/tool/tctl/common/auth_command_test.go b/tool/tctl/common/auth_command_test.go index ccd96fe3deb..9a803b8bcde 100644 --- a/tool/tctl/common/auth_command_test.go +++ b/tool/tctl/common/auth_command_test.go @@ -66,8 +66,6 @@ func TestAuthSignKubeconfig(t *testing.T) { SSH: []*types.SSHKeyPair{{PublicKey: []byte("SSH CA cert")}}, TLS: []*types.TLSKeyPair{{Cert: cert}}, }, - Roles: nil, - SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_512, }) require.NoError(t, err)