In the original releases of desktop access (circa Teleport 8),
Teleport itself authenticated to LDAP with a password. As a result,
Teleport could publish its own certificate authority to the Windows
NTAuth store, which made one less step for the user to do when
setting up Teleport.
Some time later, we removed the password authentication, and Teleport
started using a Teleport-issued certificate to connect to LDAP. A
side effect of this change was that Teleport could no longer
authenticate to LDAP and publish its own CA, because the cert-based
authentication could not succeed until the CA was already trusted.
At this time, it became necessary to write Teleport's CA to the NTAuth
store at installation time.
Ever since then, Teleport has been periodically publishing its CA to
NTAuth, even though it's guaranteed to be there already.
This commit removes the periodic write operation and updates the
docs to use more restrictive permissions on the Teleport service
account. The installation process remains exactly the same.
* adds ironrdp client and has it connect, alongside rdp-rs
* Integrates IronRDP client into the TDP png-response system. Instead of sending back chunks of the screen, its sends the full screen every time, and this is my running hypothesis for the current sticking point: a "Maximum call stack size exceeded" from the tdp client in the react app
* Changes arrayBufferToBase64 to use reduce, which fixes the "Maximum call stack size exceeded" bug
* removes convert_bgra_to_rgba which isn't needed with the bitmaps being produced by IronRDP
* Adds support for updating only a specific image region
* removes mistaken read_rdp_output_inner call from connect_rdp_inner
* Adds support for mouse input. I believe this code has race conditions for client.write_frame though this requires more research.
* Patches things up with the new IronRDP structure
Requires some modifications to IronRDP, see the corresponding commit hash
for IronRDP in lib/srv/desktop/rdp/rdpclient/Cargo.toml.
Started getting call stack overflows when manual testing again, but I'm
going to ignore those for now and focus on the version of this architecture
that passes the remoteFX encoded messages over TDP.
* Adds RemoteFX Frame to the backend
* Proof of concept for integrating a wasm module into the frontend
Building the wasm module still needs to be done manually, this was
just to get to a point where tools are configured and it can be successfully
called in both dev and prod modes.
Required that I comment out "default-src 'self'" in the CSP, this will
need to be figured out later.
We're also using a package called vite-plugin-wasm-pack whereas ironrdp
uses vite-plugin-wasm. I'm not sure why, I'm going to look into this and
swap out to vite-plugin-wasm if possible.
* Swaps out vite-plugin-wasm-pack for vite-plugin-wasm and adds build-wasm script to the teleport package.json.
vite-plugin-wasm-pack looks relatively unmaintained in comparison
to vite-plugin-wasm-pack.
build-wasm script is needed to build the wasm binary before calling vite [build]
* Adds backend structure for RPC PoC
Untested as of yet and it isn't pretty, but this more or less imitates the
RPC approach we have for directory sharing.
* hack solution which calls everything 'static. THIS IS VERY UNSAFE, WE SHOULD DO SOMETHING ELSE
* Gets the full display working end to end
with a particular commit of IronRDP. Unfortunately this commit is now
well out of date, and IronRDP had some bugs that were preventing RemoteFX
frames from being sent back.
* Full display working end to end with the updated IronRDP
* updates init_wasm_log to enable logging in the console
* updates hardcoded io_channel_id and user_channel_id
* Uses specific IronRDP sub-crates (i.e. ironrdp-session, ironrdp-tokio, etc.) rather than relying on whatever is re-exported from the ironrdp sub-crate itself
* Gets FastPathFrameResponse up to speed and the PoC is now working
* deletes all the rpc stuff which it turns out we don't need
* more cleanup including consolidating the FastPathFrame message between wasm and js, adding some comments
* Updates the documentation string for top level Client in lib.rs
* Removes hardcoded rdp server address, screen size, and username
* Swaps to online IronRDP repo
* Updates the TDP RFD with new messages
renaming them to be precise.
* remove hardcoded ip
* creates asRustBackedSlice
* removing some old todos
* Add cleanup for wasm-pack build artifacts to make clean
* Fix wasm in production builds (#27428)
* Converts the default Content-Security-Policy representation to a map
which makes it easier to programmatically add-to/overwrite the defaults
for special cases.
Also adds tests for the various custom CSPs.
* Alphabetize CSP directives for ease of testing/debugging in the future
* makes maps more easily composable
* removes commented code, and topLevelAwait() which was causing production builds to break
* Adds 'wasm-unsafe-eval' to the script-src section of the Content-Security-Policy
when a desktop session's url is detected.
The app already enforces no caching via the Cache-Control, Pragma, and
Expires headers (SetNoCacheHeaders), which means that any time the app
is requested in a new tab, the browser will always request a new index.html
which can be sent back with a new Content-Security-Policy header.
Since the only way to get to a desktop session is to either
click a link in the app which opens a new tab, or to open a new tab and
navigate to the url manually (this differs from most components, which can
be navigated to without a page reload using React Router), we can reliably
check each index.html request for a characteristic desktop session url path,
and only include the 'wasm-unsafe-eval' directive when strictly necessary
(in the spirit of the principle of least privilege).
* Removes vite-plugin-top-level-await from package.json
* moves regex to global so that it only need be compiled once
* CR fixes
updates Cargo.lock
removes commented feature flag
removes -framework SystemConfiguration
fixes makefile comment
* unsafe.SliceData
* fixes phrasing
* changes to docstring
* changes handle_tdp_fast_path_response to handle_tdp_rdp_response_pdu
so that its name is in line with its definition in RFD 0037 and
adds a more descriptive docstring.
* small fixes to comments
* preallocate RDPFastPathPDU Encode buffer
* updating comments
* Adds a detailed discussion of the Go/Rust Interface to the README (#29762)
* Aligns the codebase with the Go/Rust interface principles in the README (#29764)
* Move client functionality into Client (#29765)
* Adds the RDP Channel IDs TDP message (#27514)
* Refactoring `rdpclient` (#29766)
* Ironrdp recording playback (#28228)
* httplib.SetIndexContentSecurityPolicyWithWasm for recordings as well as desktop sessions so that the ironrdp wasm client can be used for recording playback
* Adds desktopplayback path to websocket proxy definitions so that it can be used with the dev server
* adds tdp.TypeRDPFastPathPDU as a tdp message to be recorded
* With this commit, recordings can be played back with the FastPathProcessor
Refactors tdp Client and subclass PlayerClient
such that now the classes are always constructed the same way,
and the internal representation of the screen size (the FastPathProcessor)
is either:
1. Created upon the call to Client.connect(spec) when spec is !undefined.
This is the case when the Client is being used for a desktop session.
2. Created when a client screen spec is received from the server. This is
the case when PlayerClient is being used for playback.
* Switches from sending the width/height via ur parameter string
to sending it via the client screen spec tdp message.
* changes tdpCli* to client* and adds a canvas* to the canvas related functions
* Static tokio (#30066)
* Beginnings of RdpdrBackend integration (#32814)
* Adds handling for the EstablishContextCall (#32971)
* Adds support for `ListReadersCall` and `ListReadersReturn` (#33004)
* Adds support for `GetStatusChangeCall`/`GetStatusChangeReturn` (#33056)
* Adds support for ConnectCall and ConnectReturn (#33136)
* Better error handling (#32925)
This change removes couple of unwrap that could cause panics on the Rust side and prevents panics from invalid cgo handle on the Go side.
It also sends error message from IronRDP to UI and cleans up a little final sequence of closing various goroutines in case of error or sessions end.
* Adds support for `HCardAndDispositionCall` with `ScardIoCtlCode::BeginTransaction` (#33192)
* `TransmitCall` and `TransmitReturn` (#33282)
* `StatusCall` and `StatusReturn` (#33284)
* `ReleaseContext` and refactor `handle_scard_call` (#33434)
* IronRDP clipboard sharing (#33335)
This change adds clipboard sharing to our IronRDP migration using ironrdp_cliprdr crate with out TDP-based backend (reused from rdp-rs times)
* Adds EndTransaction, Disconnect, Cancel, and IsValidContext (#33612)
* Adds support for `GetDeviceTypeId` (#33613)
* Adds support for `ReadCacheW` (#33618)
* `WriteCacheW` (#33620)
* Smartcard Login (#33712)
* `GetReaderIcon` (#33779)
* Update to IronRDP latest commit
* Removes a bunch of old deprecated code (including `rdp-rs`) (#33786)
* Pipes in `SharedDirectoryAnnounce` (#33911)
* Use tokio-boring for TLS upgrade (#33900)
This change switches TLS upgrade in our new RDP approach to tokio-boring in FIPS-compliant builds.
It also adds runtime check for FIPS mode.
Tested locally in custom Docker image.
* Update sspi (#34558)
* Break up rdpdr.rs, add support for the first directory sharing pdus (#34009)
* Adds support for `SharedDirectoryCreateRequest` and `SharedDirectoryCreateResponse`. (#34011)
* `SharedDirectoryDeleteRequest` and `SharedDirectoryDeleteResponse` (#34051)
* remove leftover code
* Server drive query information request (#34082)
* Rdp client refactor (#34122)
* Add handling for `DeviceCloseRequest` (#34139)
* Updates to `IronRDP` latest (#34744)
* Updates to IronRDP latest with a slightly different API
* remove defunct comment
* `ServerDriveQueryDirectoryRequest` and `SharedDirectoryListRequest/Response` (#34746)
* `ServerDriveQueryVolumeInformationRequest` and `ClientDriveQueryVolumeInformationResponse` (#34871)
* `DeviceControlRequest` (#34898)
* `Read` (#34914)
* `Write` (#34919)
* `SetInformation` (#35092)
* `LockControl` (#35146)
* Stack pr feedback and other cleanup (#35306)
* Adds desktop access websocket pattern to vite config
* Updates IronRDP to latest, removes manual context strings in favor of automatically generated (by this latest IronRDP commit) (#35392)
* Small line fixes, comment removal, changing license to AGPL
* Update Go/Rust interface section of README (#35590)
* Ironrdp manual docs (#35455)
* Remove unnecessary whitespace
* Refactor navigation paths in Active Directory documentation for clarity
Replaced textual descriptions with formatted paths using `>` symbols for better readability.
Having been subject to going through many such tutorials myself, I find this to be a more
user-friendly way of presenting the information. It's very common to need to go back and
forth between the documentation and the group policy manager, and having these paths in a
format that can catch the eye quickly is a big help. This also appears to be common practice
e.g.
- https://softwarekeep.com/help-center/how-to-enable-remote-desktop-on-windows
- https://www.helpwire.app/blog/remote-desktop-group-policy/
* Add instructions for enabling RemoteFX
* Add an optional step to the end of each GPO update subsection
This lets us point users to subsections individually without worrying
about reminding them that they need to run a `gpupdate /force` each
time (because its already right there in the subsection).
* lowercase "open"
* Updates configuration script to enable RemoteFX (#35461)
* Restructure Cargo workspace (#35591)
* Update `IronRDP` to latest, fix key log leak (#35707)
Updates IronRDP to latest with the changes necessary to keep up with the changes in https://github.com/Devolutions/IronRDP/pull/328. We select the `"rustls"` feature explicitly now, this is in line with our implicit choice of it as [the default](https://github.com/Devolutions/IronRDP/pull/325/files#diff-1f64036f3e460819b2b1e954803b7f266feca0e2787ca0614ae1253323944f59L19) before these latest changes.
Also creates a custom debug for `ScardBackend` so as to not leak `key_der` in the logs.
* Don't leak pin in the logs
* Updates CI to fix broken checks and builds caused by WASM introduction (#35401)
* removes SystemConfiguration framework (not sure why it was there).
* Updates cspell
* fixes TestSetRedirectPageContentSecurityPolicy
* Updates e ref to a currently-draft-PR ref.
* Fix per session mfa (#35902)
* Updating e-ref to tip of `master`
* dependency-review: Ignore cargo dependencies with invalid license specifications
* Updates OSS build-macos.yaml to support wasm-pack
---------
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
Co-authored-by: Mike Jensen <mike.jensen@goteleport.com>
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
* feat(web): add token and database uri validations to sql server configure
* feat: add sql server address validation
* test: update example sql server URIs
* Update lib/web/databases_test.go
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
---------
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* OneOff Script: use ent build if cluster is Enterprise
We were always using the OSS version of teleport in the one-off scripts.
This PR changes that to pick the correct version depending on the
running version in the Proxy.
* use gzip bestspeed for compressing files
https://github.com/GoogleContainerTools/distroless#debian-12
Note that the debian12 images no longer include OpenSSL, which we
don't need anyway, as we statically link our own copy for tsh and
other purposes.
Also, add Debian 12 to various places, as a supported OS.
Other included changes:
* Remove Debian 8 and 9, as they aren't receiving any security updates.
* Standardize how we select which distroless release to use.
* Ensure a specific distroless version is used instead of latest.
* Add new Amazon Linux and Oracle Linux releases to compatibility testing.
* Correct s/MacOS/macOS/ in install script.
`e` companion -- https://github.com/gravitational/teleport.e/pull/2154
When the OneOff script completes, print a success message to let the
user know that everything worked as expected and what their next action
should be.
* Add support for Amazon Linux 2023 to installer script
The installer script was hardcoded to only allow `amzn` version `2`. We have a repo for `amzn` version `2023` which works fine, so we should use that instead.
* Add Amazon Linux 2023 to discover tab
* Update snapshots
We were escaping the command arguments with double quotes.
It works with bash4.3+.
However, AWS CloudShell has bash 4.2 which:
>
> zz. When using the pattern substitution word expansion, bash now runs the
> replacement string through quote removal, since it allows quotes in that
> string to act as escape characters. This is not backwards compatible, so
> it can be disabled by setting the bash compatibility mode to 4.2.
http://tiswww.case.edu/php/chet/bash/CHANGES
When running this script in bash 4.2, the arguments end up being `"xyz"`
instead of `xyz`.
So, errors like this happen:
```
ERROR: operation error STS: GetCallerIdentity, https response error StatusCode: 0, RequestID: , request send failed, Post "https://sts.\"us-east-1\".amazonaws.com/": dial tcp: lookup sts."us-east-1".amazonaws.com: no such host
```
Removing the quotes means it will work on older and newer bash versions:
Demo:
```
> ./bin/teleport integration configure deployservice-iam --cluster=kimlisa.cloud.gravitational.io --name=r0mant --aws-region=us-east-1 --role=r0mant-oidc --task-role=Test+1=2,3.4@5-6_7
2023/07/07 08:04:05 TaskRole: Boundary Policy "Test+1=2,3.4@5-6_7Boundary" created.
2023/07/07 08:04:05 TaskRole: Role "Test+1=2,3.4@5-6_7" created with Boundary "arn:aws:iam::278576220453:policy/Test+1=2,3.4@5-6_7Boundary".
2023/07/07 08:04:05 TaskRole: IAM Policy "Test+1=2,3.4@5-6_7" added to Role "Test+1=2,3.4@5-6_7".
2023/07/07 08:04:05 IntegrationRole: IAM Policy "DeployService" added to Role "r0mant-oidc"
```
* Teleport One Off Script
This PR creates an endpoint that returns a script.
This script does the following:
- detects the correct os/arch, downloads and extracts the teleport
binary package
- runs teleport with arguments defined in the endpoint's query param
This will allow the Discover wizard to give bash scripts in the form of
`bash -c "$(curl ..../oneoff... )"` to the user.
The user is then asked to run those commands.
One use case for those commands is the creation of specific AWS Roles
which are then used to give Teleport extra access to other AWS Services
/ Actions.
This specific command will come in a later PR.
* remove endpoint
* disable shellcheck for go templated vars
* use bintest v3
We were always installing the latest version available even if the
requested version was different
This PR changes the installation command and the version is now pinned
to the one received in the `TELEPORT_VERSION` variable.
* Use `cloud/stable` when Automatic Upgrades is on.
Teleport provides scripts to install teleport agents/services.
Those scripts use YUM/DEB repositories when possible.
Each repo has multiple channels:
- stable/v11
- stable/v12
- cloud/stable
We want to ensure that if the cluster is running in the cloud and
automatic upgrades is on (auth service was started with
TELEPORT_AUTOMATIC_UPGRADES=yes teleport ...), then the installation
script must offer the `cloud/stable` channel.
This PR changes the following scripts:
- Discover Install Node
- Discover Install Database Service
- Install App script
- EC2 default-installer and EC2 default-agentless-installer
* add helm chart knobs to enable auto updater
* use let instead of const and remove default export
* add HA to helm chart
* always return .automatic_upgrades in web ping response
* rename cloud/stable to stable/cloud
* fix ts test
* Emit new `AgentMetadataEvent`
Part of https://github.com/gravitational/cloud/issues/3550.
This commits adds a new `UpstreamInventoryAgentMetadata` that is sent
from a Teleport agent to an auth server.
Once received, it is transformed into an `AgentMetadataEvent` and sent
to PreHog.
Most `UpstreamInventoryAgentMetadata` fields are intentionally kept as
empty in this PR. Follow up PRs will be opened with the mechanisms
required to fill them (as described in #21337).
* server_id -> host_id
* compute OS and host architecture
* Compute OS version and container runtime
* Close stream if agent receives an agent metadata message
* cmd -> exec ; file -> read
* implement fetchOSVersion for linux
* Remove unused import
* Add note about `agentMetadataCh`
* Allow commands with args
* Remove parseFun abstraction
* fetch glibc version
* fetch container orchestrator
* Fix lint
* Fix TODO
* Add note about glibc version
* cmd -> command
* fetch cloud environment
* fetch install methods
* GLibCVersion -> GlibcVersion
* Use `http.NewRequestWithContext`
* Add missing comment
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* GLibCVersion -> GlibcVersion
* Fix lint
* Fix helm unit tests
* Add missing comments
* 5 second timeout on http requests
* Spawn gorountine that fetches metadata on each new stream
* Use `defaults.HTTPClient()`
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add missing import
* Handle error
* Revert "Spawn gorountine that fetches metadata on each new stream"
This reverts commit fe4f2790be.
* Send agent metadata to auth server once per stream
* Improve note about agentMetadataDone
* Don't process command output & file content on the agent
Since agents cannot be trusted, regex validation and sanitization should
happen in PreHog anyways. So this commit removes such logic in favor of
moving it to PreHog.
* Fix lint
* Trim space
* Move handling of `AgentMetadataEvent` to `handleControlStream`
* Use cached hello message
* Move metadata files to lib/inventory/metadata
* make sending of agent metadata more self contained
* Minimize diff
* Send all system roles to PreHog
* Remove unused import
* Add parsing of command output / file content back
* Usage reporter refactor
* Usage reporter refactor
* Add missing handling of inventory agent metadata msg
* Fix ICS usage reporter
* Improve comments
* Add cached `metadata.Get*` methods
* Use systemctl status instead of is-active
* Add `Metadata` struct
* return pointer in `FetchMetadata`
* Pass context to `GetMetadata`
* metadataFetchConfig -> fetchConfig
* GetMetadata -> Get
* Add note about `Get` result
* Ensure install methods are non-nil
* Exit `metadata.Get` if context is closed
* Replace sync.Once with atomic.Bool.Swap
* Initialize channel
* Fix lint
* Fix lint
* Make `metadata.Get` return an error instead of bool
* Allow multiple true/false values for env vars
* Use `strings.Cut`
* Use /etc/os-release ID instead of NAME
* Improve `autoEmitMetadata`
* Use `gnu_get_libc_version`
* Ubuntu -> ubuntu
* Use GOARCH
* gofmt
* Move import C up
* Variables may include quotes
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Default values for ID and VERSION_ID
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Blank lines are permitted
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Anonymize host id
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Install deb/yum repos when using node-join script
When a repo is available for the current Linux distro/version, use it
instead of just installing Teleport from the deb/rpm files.
It fallsback to the traditional binary installation when the repo is not
available.
* comment /etc/os-release
* remove sudo; add comment to runners
* improve is_repo_available function
Our need for customizing our security response headers primarily exists with the Content-Security-Policy. Other headers can be applied more broadly to provide safe defaults across our service.
This commit changes httpheaders.go to allow for the CSP to be applied separate from the other headers. Then the changes to httplib.go's handlers help make sure these headers are set generally (which we were already partially doing for caching directives).
Other changes were primarily making sure these tools are configured or used. Or a removal of previous settings as this function is now being handled more centrally.
The test was relying on ordered output of the labels list.
This commit changes the generation of labels to be ordered.
```shell
> go test -timeout 30s -run '^TestGetDatabaseJoinScript$' github.com/gravitational/teleport/lib/web -race -count 5000
ok github.com/gravitational/teleport/lib/web 11.294s
```
In the context of Discover, we want to ease the installation process of Teleport.
Our current focus is Databases.
Adding a database resource requires at least one Database service/agent running with matching labels for that resource.
The focus of this PR is to ease the installation of those agents.
Those service/agents are currently installed in a multi step flow:
- install Teleport on the host (select OS/arch/distribution format)
- configure the service by running `teleport configure db ...`
- start the application (possibly configuring the systemd unit file.
As you can see, this is a lot of steps.
This PR adds a new installation script: install-database.sh
This script is actually the same used for installing Server Nodes or App Service/Agents but now can also install database service/agents.
So, how does the new flow look like?
After adding the Database info (type, hostname, port and labels), and if there's no agent available, a new step appears: add a database agent.
The user provides a list of labels they want the agent to monitor.
Those labels are stored as SuggestedAgentMatcherLabels within the token which is generate after confirming the labels.
The user then gets an URL which they can use to install the agent.
This URL contains the token and when invoked creates the install-database.sh script containing the `db_service` configuration.
The field `db_service.resources.0.labels` contains the previously defined labels.
This script is almost the same that exists today for installing Server Nodes and App services/agents, it only changes the `teleport.yaml` configuration.
When the user run this command, the UI gets notified and can then proceed to the next step.
**Demo**
```bash
root@marcoacme-node-001:/shared# install-database.sh
2022-10-20 16:56:27 UTC [teleport-installer] TELEPORT_VERSION: 11.0.0-rc.1
2022-10-20 16:56:27 UTC [teleport-installer] TARGET_HOSTNAME: 127.0.0.1.nip.io
2022-10-20 16:56:27 UTC [teleport-installer] TARGET_PORT: 3080
2022-10-20 16:56:27 UTC [teleport-installer] JOIN_TOKEN: 6417b719b68d979ac01d3039f4246ce3
2022-10-20 16:56:27 UTC [teleport-installer] CA_PIN_HASHES: sha256:9fa22af321476074164f40aa901e291df92f3dbeea1b1f641bc5bf47efd00174
2022-10-20 16:56:27 UTC [teleport-installer] Checking TCP connectivity to Teleport server (127.0.0.1.nip.io:3080)
2022-10-20 16:56:27 UTC [teleport-installer] Couldn't find nc, telnet or /dev/tcp to do a connection test
2022-10-20 16:56:27 UTC [teleport-installer] Going to blindly continue without testing connectivity
2022-10-20 16:56:27 UTC [teleport-installer] Detected host: linux-gnu, using Teleport binary type linux
2022-10-20 16:56:27 UTC [teleport-installer] Detected arch: x86_64, using Teleport arch amd64
2022-10-20 16:56:27 UTC [teleport-installer] Detected distro type: debian
2022-10-20 16:56:27 UTC [teleport-installer] Using Teleport distribution: deb
2022-10-20 16:56:27 UTC [teleport-installer] Created temp dir /tmp/teleport-PWn6zEcG9P
2022-10-20 16:56:27 UTC [teleport-installer] Downloading Teleport deb release 11.0.0-rc.1
2022-10-20 16:56:27 UTC [teleport-installer] Running curl -fsSL --retry 5 --retry-delay 5 https://get.gravitational.com/teleport_11.0.0-rc.1_amd64.deb
2022-10-20 16:56:27 UTC [teleport-installer] Downloading to /tmp/teleport-PWn6zEcG9P/teleport_11.0.0-rc.1_amd64.deb
2022-10-20 16:56:50 UTC [teleport-installer] Downloaded file size: 119220326 bytes
2022-10-20 16:56:50 UTC [teleport-installer] Will use sha256sum to validate the checksum of the downloaded file
2022-10-20 16:56:52 UTC [teleport-installer] The downloaded file's checksum validated correctly
2022-10-20 16:56:52 UTC [teleport-installer] Using dpkg to install /tmp/teleport-PWn6zEcG9P/teleport_11.0.0-rc.1_amd64.deb
Selecting previously unselected package teleport.
(Reading database ... 8182 files and directories currently installed.)
Preparing to unpack .../teleport_11.0.0-rc.1_amd64.deb ...
Unpacking teleport (11.0.0-rc.1) ...
Setting up teleport (11.0.0-rc.1) ...
2022-10-20 16:56:54 UTC [teleport-installer] Found: Teleport v11.0.0-rc.1 git:v11.0.0-rc.1-0-g6950d74 go1.19.2
2022-10-20 16:56:54 UTC [teleport-installer] Writing Teleport database service config to /etc/teleport.yaml
2022-10-20 16:56:54 UTC [teleport-installer] Host does not appear to be using systemd
2022-10-20 16:56:54 UTC [teleport-installer] ---> This host is not running systemd, so Teleport cannot be started automatically when it exits.
2022-10-20 16:56:54 UTC [teleport-installer] ---> Please investigate an alternative way to keep Teleport running.
2022-10-20 16:56:54 UTC [teleport-installer] ---> You can find information in our documentation: https://goteleport.com/docs/
2022-10-20 16:56:54 UTC [teleport-installer] ---> For now, Teleport will be started in the foreground - you can press Ctrl+C to exit.
Run this command to start Teleport in future:
/usr/local/bin/teleport start --config=/etc/teleport.yaml
------------------------------------------------------------------------
| IMPORTANT: TELEPORT WILL STOP RUNNING AFTER YOU CLOSE THIS TERMINAL! |
| YOU MUST CONFIGURE A SERVICE MANAGER TO MAKE IT RUN ON STARTUP! |
------------------------------------------------------------------------
2022-10-20 16:56:54 UTC [teleport-installer] Starting Teleport in the foreground
2022-10-20T16:56:54Z INFO Starting Teleport v11.0.0-rc.1 common/teleport.go:435
2022-10-20T16:56:54Z [PROC:1] INFO Generating new host UUID: 51b404d7-e501-43f1-83dc-8298c1fcab2b. pid:379.1 service/service.go:874
2022-10-20T16:56:54Z [PROC:1] INFO Joining the cluster with a secure token. pid:379.1 service/connect.go:582
2022-10-20T16:56:54Z [PROC:1] INFO Joining the cluster with a secure token. pid:379.1 service/connect.go:582
2022-10-20T16:56:55Z [AUTH] INFO Attempting registration via proxy server. auth/register.go:239
2022-10-20T16:56:55Z [AUTH] INFO Attempting registration via proxy server. auth/register.go:239
...
root@marcoacme-node-001:/shared# cat /etc/teleport.yaml
version: v3
teleport:
nodename: marcoacme-node-001
auth_token: 6417b719b68d979ac01d3039f4246ce3
ca_pin:
- sha256:9fa22af321476074164f40aa901e291df92f3dbeea1b1f641bc5bf47efd00174
proxy_server: 127.0.0.1.nip.io:3080
log:
output: stderr
severity: INFO
auth_service:
enabled: no
ssh_service:
enabled: no
proxy_service:
enabled: no
db_service:
enabled: "yes"
resources:
- labels:
dev: prod
```
**Tech Details**
Request to create token with `suggested_agent_matcher_labels`:
```shell
curl 'https://127.0.0.1.nip.io:3080/v1/webapi/token' \
-H 'accept: application/json' \
-H 'content-type: application/json; charset=utf-8' \
--data-raw '
{
"roles":["Db"],
"join_method":"token",
"allow":[],
"suggested_agent_matcher_labels": {"dev":"prod"}
}
'
```
Closes#17446
Update metalinter, fix a few lint warnings and replace deprecated linters.
`deadcode`, `structcheck` and `varcheck` are abandoned and now replaced by [`unused`][1].
Since 1.19, `go fmt` reformats godocs according to https://go.dev/doc/comment. I've done a bulk-reformatting of the codebase to keep the linter happy. Backporting is mostly harmless (the exception being `lib/services/role_test.go`, that for some reason breaks the _old_ linter using the new format).
[1]: https://golangci-lint.run/usage/linters/
* Bump golangci-lint version
* Replace abandoned linters
* Fix bodyclose on lib/auth/github.com
* Fix bodyclose on lib/kube/proxy/streamproto/proto_test.go
* Fix bodyclose on lib/srv/alpnproxy/proxy_test.go
* Fix bodyclose on lib/web/conn_upgrade_test.go
* Silence staticcheck on lib/kube/proxy/forwarder_test.go
* Silence staticcheck on lib/utils/certs_test.go
* Address BuildNameToCertificate deprecation warnings
* Run `go fmt ./...`
* Run `go fmt ./...` on api/
* Ignore formatting in role_test.go
* Remove redundant initializers in lib/srv/uacc/
* Update e/
Recently we added a way to add labels on newly added nodes based on the
token.
https://github.com/gravitational/teleport/pull/15114
Each token now has a list of SuggestedLabels, which are used to feed
that list.
However, if that list is empty, the generated script would trigger the
following error when running the `teleport node configure ...` command:
`teleport: error: unexpected`
This happens because the command is generating an empty argument `""`
when running the `teleport node configure ...` command.
So it looks like this:
```bash
${TELEPORT_BINARY_DIR}/teleport node configure \
--token token \
joinmethod \
--ca-pin pin \
--auth-server host:port \
"" \
--output someport
```
That empty argument breaks things.
So, in order to fix it, we are going to change the default value when no
labels are provided.
Instead of an empty string, we'll use an empty array.
Demo (teleport node configure message removed for brev
No label
```bash
$ LABELS_FLAG=(); f=$(mktemp -d)/node.yaml; teleport node configure --auth-server w:1 "${LABELS_FLAG[@]}" --output $f && yq .s
sh_service.labels $f
enabled: "yes"
commands:
- name: hostname
command: [hostname]
period: 1m0s
```
Single label
```bash
$ LABELS_FLAG=(--labels x=y); f=$(mktemp -d)/node.yaml; teleport node configure --auth-server w:1 "${LABELS_FLAG[@]}" --output $f && yq .ssh_service $f
enabled: "yes"
labels:
x: "y"
commands:
- name: hostname
command: [hostname]
period: 1m0s
```
Multiple labels
```bash
$ LABELS_FLAG=(--labels x=y,dev=prod); f=$(mktemp -d)/node.yaml; teleport node configure --auth-server w:1 "${LABELS_FLAG[@]}" --output $f && yq .ssh_service $f
enabled: "yes"
labels:
dev: prod
x: "y"
commands:
- name: hostname
command: [hostname]
period: 1m0s
```
Steven Martin