* Add new protos for hardware key prompts
* Implement hardware key prompts on the daemon side
* Show prompts in the UI
* `PromptHardwareKeyPINAsk` -> `PromptHardwareKeyPIN`
* Improve proto docs
* `PromptHardwareKeySlotOverwrite` -> `ConfirmHardwareKeySlotOverwrite`
* Fix typo
* Remove unnecessary `form`
* Pass an enum to `AskPIN` instead of the entire message
* Remove an invalid restriction of PIN/PUK to numbers only
* Improve the copy
* Allow passing custom prompt to YubiKey
* Handle `prompt.Touch` cancellation
* Pass `HardwareKeyPrompt` through all the layers
* Add an empty `HardwareKeyPromptConstructor` to Connect
* Remove `ParsePrivateKeyWithCustomPrompt`
* Add missing godoc
* Fix teleterm tests
* Include `cliprompt.go` only for `go:build piv && !pivtest`
* Lint and test fixes
* Cache yubikey objects.
* Cache PIV connections to share across the program execution.
* Do not release the connection until `sign` returns
* Do not ignore errors
* Perform a "warm up" call to YubiKey
* Fix tests
* Use a specific interface to check if the key can be "warmed up"
* Allow abandoning `signer.Sign` call when context is canceled
* Make sure that the cached key is valid for the given private key policy
The reason for adding this check was failing `invalid key policies` test.
* Make `hardwareKeyWarmer` private
* Force callers to release connection
* Improve comments
* Fix lint
* Improve `connect` comment
* Fix race condition
* Simplify `release` logic
* Trigger license/cla
---------
Co-authored-by: joerger <bjoerger@goteleport.com>
* Fix creation of JKS wallet for Oracle.
Unwrap *keys.PrivateKey to fetch inner signer that satisfies `x509.MarshalPKCS8PrivateKey` expectations. This change allows passing keys.PrivateKey to createJKSWallet. The updated function will correctly marshal the private key for Oracle's JKS wallet creation.
* Add and use `MarshalSoftwarePrivateKeyPKCS8DER`.
* Update lib/client/db/oracle/oracle_test.go
Co-authored-by: Nic Klaassen <nic@goteleport.com>
---------
Co-authored-by: Nic Klaassen <nic@goteleport.com>
* fix: tolerate mismatched key PEM headers
Issue #43381 introduced a regression where we now fail to parse PKCS8
encoded RSA private keys within an "RSA PRIVATE KEY" PEM block in
some cases.
This format is somewhat non-standard, usually PKCS8 data should be in a
"PRIVATE KEY" PEM block. However, certain versions of OpenSSL and
possibly even Teleport in specific cases have generated private keys in
this format.
This commit updates ParsePrivateKey and ParsePublicKey to be more
tolerant of PKCS8, PKCS1, or PKIX key data no matter which PEM header is
used.
Fixes#46710
changelog: fixed regression in private key parser to handle mismatched PEM headers
* fix typo in comment
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* key split wip
* fix piv tests
* fix terraform tests
* spelling fixes
* fix kube benchmark
* fix identity files in integrations tests
* self review
* fix typo in comment
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* speed up device login tests
* use EC keys in TestProxyAppWithIdentity
* faster tsh tests
* fix race on error value
* fix lint
* write out EC SSH keys in OpenSSH format
* fix lint
* fix keyring comparisons
* PrecomputeTestKeys in lib/client
* parallelize TestNoRelogin subtests
* use ecdsa for self-signed TLS certs
* remove redundant GetTrustedCerts
* improve latency of precomputeTestKeys
Instead of waiting for all 25 test keys before returning a single one,
tests can now make use of the first precomputed test key as soon as it's
ready.
In local testing with this change, the first key is ready after ~75ms vs
>350ms on master.
* fix test and lint
---------
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* consolidate (un)marshalling of key PEMs
This commit consolidates various functions we have for marshalling
private and public keys to and from the PEM format, mostly by replacing
functions from lib/utils and lib/tlsca with equivalents in api/utils/keys.
The new functions also support ECDSA and Ed25519 keys, which is
necessary for the implementation of RFD136.
* speed up TestMTLSClientCAs
* fix new use in local proxy middleware
* Save the WebAuthn UserHandle in the mock Key
* Simplify passwordless tests
* fix: Forbid SSO users from logging in using passwordless
* Rename tests to TestPasswordlessProhibitedForSSO
* Add fake yubikey private key implementation for tests.
* Add TestHardwareKeyLogin.
* Simplify Hardware Key support test plan.
* Enable piv test package in tests.
* Add TestMarshalAndParsePrivateKey.
* Address simple comments.
* Remove *testing.T from mockSSOLogin in; Add and use better helper methods for mocking sso login.
* Refactor test to dynamically set mock attestation data; revert related changes.
* Add support for hardware key serial number attestation through user
trait.
* Modify AttestHardwareKey interface to return full attestation data
* Add serial number to attestation data and verify it
* Add unit test.
* Address comments.
* Don't accept partial matches.
* Fix build and test errors.
* Add web_session private key policy.
* Add attestation logic for web session.
* Prevent users from retrieving their own web session secrets.
* Update RFD.
* Attest extended web sessions if the original web session was attested.
* Update rfd/0080-hardware-key-support.md
Co-authored-by: Mike Jensen <jentfoo@users.noreply.github.com>
* Fix policy set unit test.
---------
Co-authored-by: Mike Jensen <jentfoo@users.noreply.github.com>
* Update RFD with hardware key pin policies.
* Consolidate policy logic and update tests.
* Add pin private key policies; Make PIV PIN/Touch prompts work together.
* Prompt user to set pin/puk from default.
* Handle unexpected PIN auth errors.
* Resolve RFD password prompt comment.
* Handle incompatible private key policy in role sets (future-proof).
* Resolve comment on require mfa type string godocs and tests.
* A satisfying change.
* Address PIN/PUK prompt comments and other code suggestions.
* Resolve comments.
* Fix test that prompts for pin twice.
* Fix test.
* Add the Access List review backend.
The Access List review backend has been added to Teleport.
* Update tests to remove frequency_changed.
* Update lib/services/access_list.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Update lib/services/access_list.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Tweak errors, add gRPC client to go along with new interfaces.
* Update comments, fix errant bugs with api client, remove reviews getter.
* Fix comments in proto, tweaks to tests and backend.
* Remove call to SetName.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Make yubikey unit test interactive and add to test plan.
* Move yubikey hardware signer method tests to interactive yubikey test.
* Remove hardware key interactive unit test from testplan
* Change PIV metadata cert to be self signed by an ephemeral key so it can be signed without touch/pin.
* Refactor touch prompt logic.
* Prompt user before overwriting non-teleport certificates instead of just returning an error.
* Update RFD and Docs.
* Address CR.
* Export some methods and variables for use in tests.
* Address comments.
While loading a key from storage, Teleport client transverses the
storage directory to read the secrets and reads each file one by one.
This has huge impacts on `tsh kube credentials` because when calling
`kubectl` in parallel, the disk operations become overloaded and the
operation time increases exponentially.
This PR removes the transverse when reading credentials for Kubernetes
clusters and adds a quick read operation that reads the following files:
- `$TSH_HOME/current_profile`
- `$TSH_HOME/$profile.yaml`
- `$TSH_HOME/keys/$PROXY/$USER-kube/$TELEPORT_CLUSTER/$KUBE_CLUSTER-x509.pem`
- `$TSH_HOME/keys/$PROXY/$USER`
| - | P=1 | P=10 | P=40 | P=80 | P=120 |
| --- | --- | --- | --- | --- | --- |
| old direct | 9.90s user 3.14s system 64% cpu 20.284 total | 11.08s user 3.60s system 496% cpu 2.955 total | 12.46s user 4.36s system 820% cpu 2.050 total | 12.81s user 4.76s system 811% cpu 2.164 total | 13.02s user 5.07s system 861% cpu 2.100 total|
| old teleport | 18.45s user 7.80s system 51% cpu 51.085 total | 21.58s user 10.03s system 434% cpu 7.270 total | 22.33s user 10.52s system 178% cpu 18.402 total | 22.04s user 10.83s system 96% cpu 33.977 total | 22.57s user 11.45s system 55% cpu 1:01.34 total|
| new direct | 9.51s user 2.90s system 146% cpu 8.460 total | 13.75s user 4.95s system 718% cpu 2.603 total | 12.21s user 4.43s system 832% cpu 1.999 total | 11.72s user 4.50s system 839% cpu 1.933 total | 12.06s user 4.62s system 830% cpu 2.009 total |
| new teleport | 16.10s user 5.97s system 42% cpu 52.104 total | 21.62s user 9.01s system 381% cpu 8.023 total | 23.22s user 10.11s system 540% cpu 6.162 total | 21.64s user 9.81s system 603% cpu 5.208 total | 20.70s user 9.13s system 602% cpu 4.948 total |
---
| - | P=1 | P=10 | P=40 | P=80 | P=120 |
| --- | --- | --- | --- | --- | --- |
| old no tsh kube credential | 8.61s user 2.99s system 31% cpu 36.336 total | 9.57s user 3.39s system 283% cpu 4.565 total | 10.22s user 4.03s system 553% cpu 2.574 total | 9.32s user 3.82s system 559% cpu 2.351 total | 11.49s user 4.85s system 624% cpu 2.617 total
| new no tsh kube credential | 8.27s user 2.94s system 24% cpu 45.041 total | 10.85s user 4.31s system 195% cpu 7.767 total | 11.32s user 4.64s system 469% cpu 3.401 total | 10.83s user 4.51s system 553% cpu 2.773 total | 10.90s user 4.84s system 537% cpu 2.930 total |
---
| instances | old total | old avg | **new total** | **total avg** |
| --- | --- | --- | --- | --- |
| 1 | 0.145 | 0.145 | 0.074 | 0.074 |
| 10 | 0.430 | 0.043 | 0.146 | 0.0146 |
| 20 | 0.740 | 0.037 | 0.284 | 0.0142 |
| 30 | 1.108 | 0.037 | 0.417 | 0.0139 |
| 40 | 1.483 | 0.037 | 0.580 | 0.0145 |
| 60 | 13.604 | 0.228 | 0.825 | 0.0137 |
| 80 | 30.236 | 0.378 | 1.143 | 0.0142 |
| 106 | 46.681 | 0.440 | 1.413 | 0.0133 |
Fixes#19313
Co-authored-by: Brian Joerger <bjoerger@goteleport.com>
* Save private key policy in profile.
* Fix tsh status/logout with yubikey unplugged; fix cluster alert on tsh status with hardware_key_touch.
* Set private key policy from ping response.
* Skip cluster alerts on tsh status.
- When user registers or resets, when running into
policy errors, we don't send back an error, but instead
a 200 (to indicate user has successfully registered/resetted)
and a flag to determine if policy was enabled
- Send back policy configurations for cluster config,
this will allow the web UI login page to just display
redirection messages without login attempts
- For role configured policy, login attempts will be
required and a specific error will be returned so that
the UI can then better redirect the user
* Add Yubikey PrivateKey implementation for use by Teleport clients.
- Add yubikey login logic, reusing previously stored private keys.
- Fix identity file decoding with PIV keys, which sign ecdsa certificates.
- Add libpcsclite-dev pre-req for building on linux.
- Remove unnecessary keys.Signer interface and move its functionality to keys.PrivateKey.
- Move retry and jitter utils to new api/utils/retryutils package.
Primary Changes:
- Remove reliance on Private Key PEM:
- Update native and keygen packages to return PrivateKey instead of PEM key
- Add new PrivateKey interface which implements crypto.Signer
- Replace PEM encoded private key usage where possible
- Replace calls to tls.(Load)X509KeyPair with keys.(Load)X509KeyPair in
client packages
Minor Changes:
- Remove unused agent.AddedKey return from LoadKey
- Simplify sshutils and removed unused code paths
- Add ecdsa and ed25519 key support
Edoardo Spadolini