The cacert flag was removed from the curl output during the tsh app login as
most production Teleport clusters are likely to be using publicly trusted CAs,
and therefore wouldn't need the flag. If the user specifies an insecure login,
however, the cacert flag is included with the curl output as it used to be.
Additionally, some tests have been added for the formatAppConfig function. It
was discovered that the YAML output format was outputting two newlines, so a
small modification was made to remove this.
Addresses issue #7518.
* Predicate expressions using the "name" identifier will now use
field "hostname" when `ls` querying for nodes, as expected by
the user
* Change predicate expression for access request that use
name identifier to using the actual json field names
* check if proxy requested already has an active profile that is not expired before relogging the user in
maintain cert reissue
use site name
make client for currently logged in proxy
simplify if
remove cert reissue
simplify and add test
revert comment
explicitly save profile
add initial commands
add better output
* review comments
* Update tool/tctl/common/proxy_command.go
Co-authored-by: Nic Klaassen <nic@goteleport.com>
* Update tool/tctl/common/proxy_command.go
Co-authored-by: Nic Klaassen <nic@goteleport.com>
* remove stdout redirect for now
* lint
Co-authored-by: Nic Klaassen <nic@goteleport.com>
This reverts commit 4f3aa9a3f2.
We're unable to build for 32-bit Linux due to
https://github.com/golang/go/issues/55152,
which looks like it will be fixed with Go 1.19.2 next week.
We'll re-evaluate with the next Go release and reintroduce this change
as soon as we can.
Application sessions were previously only logged when launching an application
session via the UI, and not from the `tsh app login` command. This has been
corrected. The AppName and AppURI are now passed in as part of the gRPC
request to the auth server, which is then used to emit the audit event.
Label based tsh was sending UUID:0 as the node name to the
IsMFARequired check. The server was checking this name against each
nodes name and uuid. However the port included in the name prevented
any matches from being found. Which resulted in the ssh session being
rejected with an access denied message by the node because mfa was
required but never performed.
This removes the :0 from the node name to the IsMFARequired check and
adds a test case to TestSSHOnMultipleNodes that uses role based
per session mfa.
* switch underlying protocol used for 'tsh scp' to SFTP
* address TODO
* appease linter
* add method to make it easier for other callers to transfer files
* add tests
* print transfer progress with progress bar by default
Also allow a SIGINT to gracefully stop the SFTP connection. This is
necessary because the progress bar will ignore signals and prevent the
process from exiting.
* address SFTP fork issues
* make tests less flakey
* fix specifying dir for dst not copying files to correct paths
* make tests less flakey (again)
* don't check file access times, often differs when run in CI
* few small fixes from review, simplify Create method now that HTTP FS isn't needed
* create dst files and dirs with src mode
* improved error messages when doing file operations
* expand home dirs in remote paths
* addressed more feedback
* add license to get_home_dir.go
* address minor feedback of tests, add home dir expansion test
* update sftp fork to point to latest commit on master branch
* addressed feedback
* don't cache home dir lookups, only one remote path can ever be used
* Reduce number of auth dials for tsh commands
One of the major areas of latency for `tsh ssh` is creating multiple
auth clients. Since the auth client is lazy and only actually performs
the dial on first use we can create an auth client once and simply
reuse it. This is done by adding an `auth.ClientI` to `ProxyClient`
which is created via `connectToProxy`. All attempts to connect to
the current auth server via the `ProxyClient` will be given the
cached `auth.ClientI`.
The new method of retrieving the current auth client also allowed
to remove a number of calls to `GetSites` which were used to obtain
the current cluster name. The local profile already contains the name
of the cluster and calls to `GetSites` were unnecessary. All instances
which relied on the site name now retrieve from information that the
`ProxyClient` already has.
In an effort to reduce ambiguity and confusion `CurrentClusterAccessPoint`
and `ClusterAccessPoint` were also removed. AccessPoint denotes that
you are connecting to a cache, but the `ProxyClient` is always going
to be hitting the auth server directly. The two have been replaced
with `CurrentCluster` and `ConnectToCluster`, which they were merely
wrappers for anyhow.
* Add Yubikey PrivateKey implementation for use by Teleport clients.
- Add yubikey login logic, reusing previously stored private keys.
- Fix identity file decoding with PIV keys, which sign ecdsa certificates.
- Add libpcsclite-dev pre-req for building on linux.
- Remove unnecessary keys.Signer interface and move its functionality to keys.PrivateKey.
- Move retry and jitter utils to new api/utils/retryutils package.
Update metalinter, fix a few lint warnings and replace deprecated linters.
`deadcode`, `structcheck` and `varcheck` are abandoned and now replaced by [`unused`][1].
Since 1.19, `go fmt` reformats godocs according to https://go.dev/doc/comment. I've done a bulk-reformatting of the codebase to keep the linter happy. Backporting is mostly harmless (the exception being `lib/services/role_test.go`, that for some reason breaks the _old_ linter using the new format).
[1]: https://golangci-lint.run/usage/linters/
* Bump golangci-lint version
* Replace abandoned linters
* Fix bodyclose on lib/auth/github.com
* Fix bodyclose on lib/kube/proxy/streamproto/proto_test.go
* Fix bodyclose on lib/srv/alpnproxy/proxy_test.go
* Fix bodyclose on lib/web/conn_upgrade_test.go
* Silence staticcheck on lib/kube/proxy/forwarder_test.go
* Silence staticcheck on lib/utils/certs_test.go
* Address BuildNameToCertificate deprecation warnings
* Run `go fmt ./...`
* Run `go fmt ./...` on api/
* Ignore formatting in role_test.go
* Remove redundant initializers in lib/srv/uacc/
* Update e/
* Propagate tctl --insecure flag
* Move ExitCodeError into common package
* Add TryRun helper func to tctl for testing
* Return error instead of exiting directly
* Add test for tctl insecure with profile
* Remove debug println
* Update want err message
* Remove unnecessary errors.Is implementation for ExitCodeError
* Update error message for cert error in test
* Fix flaky TestHandlerConnectionUpgrade
* Test that TryRun error is assignable to ExitCodeError
* gofmt
* Fix import order
Co-authored-by: STeve Huang <xin.huang@goteleport.com>
* Fix incorrect use of loop variables
This commit fixes a few occurrences of loop variables being
incorrectly used in the context of Go-routines or (most frequently)
parallel tests. To fix the issues, we create a local copy of the range
variables before the parallel tests (or Go-routine), as suggested in
the documentation of the `testing` package:
https://pkg.go.dev/testing#hdr-Subtests_and_Sub_benchmarks
Issues were found using the `loopvarcapture` linter.
Signed-off-by: Roman Tkachenko <roman@goteleport.com>
* fix TestTraceProvider/spans_exported_with_gRPC+TLS
* run TestSSH serially
* operator: Conserve 'created_by' data in user spec
Signed-off-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: Renato Costa <renato@cockroachlabs.com>
Co-authored-by: Tim Ross <tim.ross@goteleport.com>
Co-authored-by: Hugo Hervieux <hugo.hervieux@goteleport.com>
Switches label based ssh to always use the node UUID instead of its
address. This prevents issues that occurred when dialing by address
if the public_addr isn't set correctly.
Closes#3214
Also add optional --ttl and --severity flags.
This allows cluster administrators to set custom alerts
(during maintenance periods, for example).
Fixes#6442
* Fix flaky TestHandlerConnectionUpgrade
* Fix tctl --auth-server with logged in profile
* Export tctl applyConfig so we can test it from tsh/tctl tests
* Add test for tctl --auth-server w/ profile
* Update tool/tctl/common/tctl.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update tool/tsh/tctl_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Alan's suggestion to not use new()
* Add message to require.NotEmpty
Co-authored-by: STeve Huang <xin.huang@goteleport.com>
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add util helpers for untrusted cert errors
* Remove superfluous error checking
* Add helpful message on first time node join
* Cleanup cert error messages when connecting to auth service
* Add helpful certs message for tctl
* Fix flaky TestHandlerConnectionUpgrade
* Change long line back to the way it was before
Co-authored-by: STeve Huang <xin.huang@goteleport.com>
* Allow for multiple installer scripts instead of using a singleton
* Resolve comments
- require name be provided to installer
- MetaNameClusterInstallerScript -> defaults.InstallerScriptName
- Require VerbList for GetInstallers
* Resolve comments
- Include the default installer in GetInstallers output
- Update how the scripts are prefixed
* resolve conflicts
* make the linters happy
Primary Changes:
- Remove reliance on Private Key PEM:
- Update native and keygen packages to return PrivateKey instead of PEM key
- Add new PrivateKey interface which implements crypto.Signer
- Replace PEM encoded private key usage where possible
- Replace calls to tls.(Load)X509KeyPair with keys.(Load)X509KeyPair in
client packages
Minor Changes:
- Remove unused agent.AddedKey return from LoadKey
- Simplify sshutils and removed unused code paths
- Add ecdsa and ed25519 key support
* Add Azure auto-discovery configuration fields
* Init databases if azure matchers are in config
* Use AzureMatchers in db service
* Use all azure subscriptions/resource groups if omitted in matcher
* Add azure config tests
* Update protobuf and fix database serialization
* Update azure database spec/status
* Change proto to use resource id string
* Fix database serialization test
Lisa Kim