* Add `DelegationSessionService` protobuf definition
* Implement `GenerateCerts` RPC
* Prevent restricted delegation sessions from inheriting administrative privileges
Previously, the `resources` list on a delegation session would restrict regular
access to resources that weren't explicitly included, but not administrative
actions.
Now, we explicitly deny all administrative (rule-authorized) actions for
delegation sessions unless you include a wildcard in `resources`.
* Only permit list/read/readnosecrets for allow-listed resource kinds
* Fix reused extension OID
* Add a small amount of tolerance for clock skew
* Make the "expires must be in the future" message clearer
* Fix linter errors
* Access to a windows desktop implies access to the desktop service
* Add `DelegationSessionID` to the decision package's `SSHIdentity` and `TLSIdentity`
* Wrap `ExtractConditionForIdentifier` for delegation sessions too
* Prevent calling `GenerateCerts` inside a delegation session
* No need for indirection with GenerateUserCerts method now
* Fix import ordering
* Stop delegation service from returning CA certificates
Per @strideynet's request, to avoid replicating existing bad patterns around
conflating the user and host CAs.
* Error messages should start with lowercase letters
* Add `RouteToKubernetes` wrapping message
* Replace expires parameter with TTL
* Remove unnesasary error check
* Fix `AgentScope` extension type assertion
* Move the reexec parts of lib/srv to session/reexec
* Update references to the moved bits of lib/srv
* Avoid testutils in session/reexec
* Shuffle some constants around to avoid imports in session/reexec
* Vendor in the relevant parts of logutils in session/reexec
* Remove unnecessary symlink checks when opening files
* Inline the last two things from lib/utils in session/reexec
* Inline moved constants
* Deprecate group name consts and fix missed inlines
* Add missing session/reexec.TestMain with reexec check
* Reuse existing constants from the log constants package in session
* Fix broken godoc link
* enforce region validation on all AWS config loading
Replace direct uses of `github.com/aws/aws-sdk-go-v2/config.LoadDefaultConfig`
with the internal `lib/cloud/aws/config.LoadDefaultConfig` wrapper, which
validates any explicitly requested AWS region before use. Enforces this via a
new forbidigo linter rule.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* fix unit tests
* include underscores and uppercase letters
* add ConfigureRegion
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* Add the api/client.Client.SubCAClient() method
* Implement tctl resource support for cert_authority_override
* Remove `false` booleans
* Change "tctl create" message according to action
* Add support for all 3 forms of "tctl get"
* Add the "tctl auth pub-key-hash" command
* Rename test so it's clearly specific to the pub-key-hash command
* Rename prepareFlags to prepareCommand
* Fix typo on commandState.Stderr
* Depguard rules for the session submodule
* Move lib/auditd to session/auditd
* Move lib/loginuid to session/loginuid
* Reduce dependencies of lib/utils/envutils
* Move lib/utils/envutils to session/envutils
* Split the SSH utilities of sshutils/x11 into sshutils/x11forward
* Move lib/sshutils/x11 to session/networking/x11
* Move lib/sshutils/networking to session/networking
* Move lib/shell to session/shell
* Move lib/utils/uds to session/uds
* Move lib/utils/host to session/host
* Move lib/pam to session/pam
* Avoid lib/utils/log in session/pam
* Move lib/service/servicecfg.PAMConfig to session/pam/pamcfg.PAMConfig
* Move lib/srv/uacc to session/uacc
* Avoid importing lib/utils in session/uacc
* Move lib/selinux to session/selinux
* Avoid lib/utils and lib/utils/log in session/selinux
* make go-mod-tidy-all
* Update oss-fuzz path for session/networking/x11
* Provide user friendly error message when host user creation is denied by some, but not all, roles; Add test case.
* Add host user creation error context to any PAM error, not just PAM auth errors; error wrapping on user-facing pam context error.
* Fix test.
* Write reexec errors to stderr; Isolate reexec stderr from shell/pam.
* Capture reexec stderr in parent process; Add test.
* Fix flaky test caused by closing the ssh channel before completing stderr copying.
* Remove proxy recording test case to fix test flakes.
* Improve reexec error code handling:
* Don't print Exit Code 255 errors in tsh ssh.
* Don't write exec error to stderr if the exit code happens to be 255.
* Don't print plain exit status in tsh ssh.
* Remove deprecated PTYFile for reexec.
* Wait until stderr from the reexec process is consumed by all parties.
* Fix pipe naming.
* Address comments.
* External Audit Storage - Handler Refactor
* Refactor `tctl` external_audit_storage resource to use Handler pattern
* Made ExternalAuditStorage a non-singleton to prevent deletion without providing a name
* support diag checks on linux
* add support for tsh vnet --diag
* remove isDiagSupported
* update go.mod for rtnetlink dependency
* skip routes with no output interface
This commit provides a message that tctl recordings download <session-id>
has successfully downloaded a session id to a file.
Closes#64690
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* first build
* add d-bus daemon for vnet
* set up dns server via systemd-resolved d-bus api
* get DNS upstreams via systemd-resolved API
* never forward DNS requests to self
* refactor: move all systemd-resolved logic to a separate package
* refactor: move all polkit logic to a separate package
* filter systemd-resolved loopback upstreams
* add scope for link-local IPv6 adresses for upstreams
* comment updates, small fixes, and typo cleanup
* return uid from D-Bus authorize func
* add typed constants for systemd unit states
* avoid using canceled context for stopping VNet daemon
* refactor: do not store ctx in dbusDaemon
* Improve dbusDaemon lifecycle handling
* Log errors from `dbusDaemon.Wait`
* refactor: reuse shared darwin/linux code for admin process
* reintroduce isDiagSupported
* refactor logging errors from dbusDaemon.Wait
* do not return error for missing TUN during deconfigure
* use d.conn.Context()
* avoid using bare slog logger
* avoid mutating cached upstream nameserver slices
* fix race between dbus Start and Stop
* small fixes
* some refactoring
---------
Co-authored-by: Nic Klaassen <nic@goteleport.com>
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Make it clear in generated CLI reference docs that they were generated
so authors do not attempt to edit them directly. Edit the template for
generated CLI docs to add a message.
Regenerate CLI references to include the message. This also updates the
references.
Note that the CLI reference doc generation is not yet fully idempotent,
so we cannot enforce generation.
To pass linting, edit the `teleport` CLI to use "Amazon Bedrock" (the
correct product name) in an error message instead of "AWS Bedrock".
* MWI: Add certificate expiry check leeway for app tunnel service
This adds some leeway to the application-tunnel service's certificate
expiration check.
For context, the app tunnel service does not follow Machine ID's
usual certificate renewal cycle and instead opts to renew
certificates just-in-time before completing a request if the
certificate has expired per the local clock.
Unfortunately, the local clock is not always accurate, and if the
certificate or underlying app session has already expired from the
server's perspective, client requests can still fail until the local
clock catches up and the certificate is refreshed.
To mitigate this, this change adds a `leeway` parameter to the
service, configurable via YAML, with a default value of 1m. This is
added to the current time when certificate validity is checked. This
means that, in the worst case, certificates will be refreshed to early
rather than too late.
See also: #64284
* Remove duration pointer and ignore leeway if greater than cert TTL
* Make tbot's leeway parameter global
This makes the leeway parameter global, and additionally uses it in
the main renewal loop (for the expired bot internal identity
detection) and in the database tunnel service.
Also adds some test coverage for app tunnel cert renewals.
* Tweak doc comment for clarity
* Remove unused code
* Ignore excessive leeway values in identity service
* Honor effective lifetime in leeway check
* Fix leeway var reference
* Update golden tests
* Codex reviewer appeasement
Factor in actual cert TTL in the leeway cap.
* Fix failing test
* Fix imports
* Add scope aware profiles after tsh login
Update tsh.go
fix some minor issues
Update client_store_test.go
fix rebase
Update client_store.go
Add scope changing feature
Update tsh.go
Update tsh.go
* Remove "none" descoping
Update tsh.go
clean up
* nil the scope pin when "" is in the profile instead of scope pin ""
* Forbid semver.New in forbidigo
* Fix type in require.Greater
* Fix missed semver.New in build.assets
* Restore whitespace in Test_formatAzureIdentities
* Re-fix TestAzure
* Add service commands to tsh
* Install updater service and run updates through it
* Add signature verification
* Disable CTMU for `tsh.exe connect-updater-install-update`
* Force install mode when migrating from one-click to assisted multi-user
* Spawn `tsh.exe connect-updater-install-update` synchronously and catch errors
* Use single parent command, remove args from `service.Start`
* Do not ignore error from closing handle
* Grammar fixes
* Use single command in installer.nsh too
* Use `svc.IsWindowsService()` instead of `isWindowsService`
* Switch from `CertCompareCertificateName` to comparing subject properties
* Log certs if they don't match
* Improve comment
* Update suggested reviewers to include owners of JIT access lists
* Replace undefined with empty array so data serialises without error
* Use consistent proto naming
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Remove unused req return value from reviewer list function
* Remove suggested reviewers logic from OSS API
* Tests and tidy up
* Refactoring
* wip
* Remove changes addresses in a separate PR
* Remove proto for reviewers
* Add godoc
---------
Co-authored-by: Marek Smoliński <marek@goteleport.com>
Update and upsert scoped tokens will reject any changes to secret, but will allow requests to come in if status is not present, not changing the secrets.
Dan Upton