* Add SSO MFA ceremony support to WebUI per-session MFA.
* Add display name to SSO MFA device; Add SSO MFA device to SSO challenge.
* Camel case json tags for front end.
* Add sso channel ID for front end broadcast channel logic.
* Fix backwards compatiblity issue; fix error message.
* Fix test.
* Fallback to connector id if display name isn't set.
* Fix test.
* Resolve comment.
* Use uuid.NewRandom.
* go mod tidy
I've vendored in parts of gravitational/oxy under the
lib/limiter/internal/ratelimit package, taking the opportunity to
convert to slog and replace mailgun dependencies (ttlmap, timetools)
with Teleport equivalents.
This commit also removes the max_users limiter option.
This setting never actually did what it claims to do. The max_users
option was passed in as a capacity to a TTL map, but the TTL map
doesn't reject new entries when the capacity is exceeded, it
just removes old entries to make room.
Removing old entries from the TTL map did not enforce any sort of
user limit - it has the opposite effect. It "resets" existing limits
for the old user, effectively un-limiting them!
In practice, we've never actually been able to enforce a maximum
number of simultaneous users, so rather than changing the behavior
I've opted to remove the field from everything other than the config
file.
* clean up pidfile and reloads
* reduce log spam during graceful shutdowns
* hold an exclusive advisory lock on the pidfile
* do systemd reloads with the pidfile rather than $MAINPID
* prioritize signals over internal restarts
Some consts in the `auth` package are used in a lot of other packages.
This increases the probality of getting a cyclic dependency error.
This PR moves some of those consts to the defaults package and updates
all the required locations of their usage.
Only one is missing in the `/e/` repo, which I'm going to open a PR for
it.
After merging, we can also remove the `lib/auth.TokenLenBytes`
* Remove account lockout from failed recovery attempts
This account lockout looks to be unecessary and potentially problematic. Recovery codes and recovery through MFA are not possible to brute force.
In addition the potential to lockout an account from being able to use a recovery method could result in them being unable to unlock their account from other potential abuse cases (for example an attacker locking the account from failed password attempts).
As discussed in the RFD (https://github.com/gravitational/teleport/pull/35533) this includes the removal of all the API used for this locking mechanism.
* accountrecovery: Update `WithLock` function names
* accountrecovery: Combine verifyRecoveryCode and verifyRecoveryCodeWithRecord into one function
* Further GRPC cleanup after PR feedback
* Apply PR Feedback
`x/crypto/ssh` is adding a `fipsonly` mode (similar to `crypto/tls/fipsonly`) in
golang/go#64769. Once this has landed and been released, we'll swap to using it.
In the meantime, update our hardcoded algorithm set to match the algorithms listed
in https://go-review.googlesource.com/c/crypto/+/550515.
The only difference is that `aes192-ctr` is kept in `FIPSCiphers`, as it seems to be
approved by NIST SP 800-131A rev 2 (page 17).
Additionally, we now define a list of approved public key authentication algorithms for
SSH server connections. This isn't configurable for normal use case (yet), only handled
for FIPS builds.
* Increase `MinPasswordLength` from 6 to 12 characters
- PCI DSS v4.0 control 8.3.6 requires a minimum password length of 12 characters.
- NIST SP 800-63B section 5.1.1.1 requires a minimum password length of 8 characters.
* Increase `AccountLockInterval` from 20 to 30 minutes
- PCI DSS v4.0 control 8.3.4 requires a minimum lockout duration of 30 minutes.
This will contribute to better supporting customers to meet certain compliance requirements.
Ref #1936.
Ref #7687.
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
Monitors both the UI<->Proxy and Proxy<->SSH host connections in
order to provide users with near real time latency data for ssh
connections established via the UI. The client portion of the
connection is measured by how long it takes to receive a web socket
pong in response to sending a web socket ping. The host portion of
the connection is measured by how long it takes to receive a reply
of a keepalive@openssh.com global SSH request. The statistics are
periodically sent via a new envelope type over the web socket where
they are consumed and displayed to users.
Originally there was a default limit of 100 max concurrent streams, however in 2017 the GRPC team removed this default: https://github.com/grpc/grpc-go/pull/1624
With the recent HTTP/2 Rapid Reset DoS, it is now being encouraged to re-introduce a limit. The fix requires this value to be configured in fact: https://github.com/grpc/grpc-go/pull/6703
* Add daemon.Service.ResolveClusterURI
* Accept agents dir through command line flag
tshd needs to know this out of band, so that when the Electron app tells
it to watch for host UUID file for a specific cluster, the Electron app
can send just the profile name of the cluster instead of an arbitrary path
on the computer.
* Implement WaitForConnectMyComputerNodeJoin in tsh daemon
* wait: Use addEventListener instead of onabort
* Make TshAbortController emit abort event only once
This aligns it with a regular AbortController, which also emits the event
only once.
* Refactor how types are imported in tshd fixtures
* Implement WaitForConnectMyComputerNodeJoin in Electron app
* createAbortController: Add signal.aborted, use emitter.once
* Improve wait function based on Deno implementation
https://github.com/denoland/deno_std/blob/72d6e6641e3cd39ae69fba89a78feab354018ef0/async/delay.ts#L39
* Add a comment about the events package
* Adds a UnifiedResource watcher to the auth server. This watcher
will watch all the types that are displayed in the web UI and store
them in-memory to allow us to search/filter/query and get multiple
kinds returned at the same time.
[RFD](https://github.com/gravitational/teleport/pull/28162)
* Add ListUnifiedResources gRPC and web endpoints (#29661)
Adds the `ListUnifiedResources` grpc endpoint that returns paginated unified resources and exposes it in the web apiserver
* Fix test
* Consistent `http.Server` timeout configurations
This commit builds on the work from https://github.com/gravitational/teleport/pull/30151 in the following ways:
* A couple additional server configuartions that were missing timeouts are now covered
* Timeouts are now configured in a consistent way. This means:
- Configuring the `ReadTimeout` which was not covered by only setting `ReadHeaderTimeout`
- Set `ReadHeaderTimeout` to be the more aggressive (1 second) `defaults.ReadHeadersTimeout`
- Set a `WriteTimeout` in cases of potential large responses
* defaults.go: Update ReadHeadersTimeout to 10 seconds
* alpnproxy/local_proxy.go: Move http timeouts to the top
* Rate limit all unauthenticated HTTP endpoints
This commit is an extension to what was done in #172. And is designed to fix https://github.com/gravitational/teleport/issues/4330 and https://github.com/gravitational/teleport-private/issues/403.
Rather than audit endpoints and choose what endpoints should be rate limited, this commit proposes that for safety and reduced cognitive load, all unauthenticated endpoints become rate limited.
The primary concern in this type of change would be if our rate limit becomes too aggressive for general use. There are two considered strategies to make sure this does not become impacting:
1. Adjust the rate limiter so the rate limit becomes endpoint specific. This would avoid the need to consider how activity on one endpoint effects another.
2. Accept that rate limit interactions are possible and instead ensure rate limits are high enough to avoid this concern.
This commit chooses option #2. While #1 has advantages, particularly as endpoints and new use cases are added. #2 provides the strictest and safest rate limits.
Our rate limits were configured to:
period: 1 min
avg rate: 10
burst rate: 20
In order to build a safety buffer with option #2 those allowed rates were doubled.
Additionally the ability to avoid rate limits by authenticating your request (even if the endpoint is otherwise unauthenticated) was added. This is particularly useful for the `ping` endpoint which may have high levels of activity on large clusters, but which has a portion of that activity over authenticated requests.
* Add additional `High` Rate Limiting
This new `High` rate limit is designed for endpoints which are only CPU bound (and thus don't have as significant of DoS risks).
Initially this was motivated for `ping` and `find` due to the concern that these endpoints are used unauthenticated at login, and potential NAT's may result in very high rates from single egress IP's.
In my testing on my laptop, all of these endpoints can easily get 640/req/sec on a single core within a VM. Setting the maximum of 480 burst and 120 continuous should both ensure that no single source utilizes all the CPU, as well as build in additional safety margins while providing a layer of protection.
* Fix for missing error check
* AWSOIDC Integration: ListDatabases
This PR adds a new Action for the AWSOIDC Integration: ListDatabases
The goal of this action is to provide the User a list of RDS Databases
from which the User will pick one to be added as a Teleport Database
Resource.
This way, the user doesn't need to copy/paste DB name, endpoints and
labels.
Before being able to call this action, the User has to set up an AWS
OIDC integration.
How does it work:
```
Client (web app)
│ ▲
│ │4. Returns list of DBs
1. List Databases │ │ (name, tags, status, endpoint)
│ │
│ │
│ │
│ │
▼ │ 3. rds.DescribeDBInstances
┌───────────┴────┐ (auth: token) ┌─────────┐
│ ├─────────────────────────────────►│ │
│ Teleport Proxy │ │ AWS │
│ │ 3.1. Get OIDC Config │ │
│ │◄─────────────────────────────────┤ │
│ │ 3.2. Get RSA Public Key │ │
│ │◄─────────────────────────────────┤ ├─────────┐ 3.3.
│ │ │ │ │Validates token signature
│ │ │ │ │with received public key
│ │ 3.4 Returns list of DBs │ │◄────────┘
│ │◄─────────────────────────────────┤ │
└─┬──────────────┘ └─────────┘
│
│ 2. Sign Token
│
▼
┌───────────────────┐
│ │
│ Teleport Auth │
│ RSA Private Key │
└───────────────────┘
```
* add resource and account ids to DB resource
* move api namespaces
* use types.Database instead of custom database format
* add database uri
* fix comments and rate limiter
* test name override when converting RDS V2 DBs
* fix webapi database URI field
* TestClusterDatabasesGet: add parallel
* AWS-hosted OpenSearch support.
* Review: comments, case, cleanup.
* Review: comments, region discovery, typos, shared func, fix error type, fix empty CA case.
* Review: address comments.
- add docs
- refactor opensearch engine code
- make `opensearchsql` default client
- drop utils.CloneRequest function, it is not suitable for general use
- drop "extra args" functionality, it should be a separate PR and more generic
- minor refactorings
* Fix: linting, refactoring issues.
* Review: update the comment for accuracy.
* Correct merge issue.
* Review: reuse transport, use different context, rename tests
* Review: unexport internal error types, explicitly test the error serialization.
* refactor SFTP backend to use upstream dep, not our fork
This change also greatly reduces the number of SFTP audit logs.
Now SFTP events are only sent when files are opened or modified
in any way, instead of for *every* SFTP request.
* added to SFTP integration test
* fix error when handling setstat on dirs
* fix linter warning
* move file/dir permission constants to lib/defaults package
* Add agentless installer
* Resolve comments
* Resolve comments
* Use GetCertAuthorities locally
* Try to get IMDS hostname
* Try get imds hostname first
This seems to be how its implemented for non-agentless nodes
* Use FIPS cipher suites
* use the openssh ca, resolve comments
* write keys to /etc/teleport/agentless by default
* Resolve comment
* lints
* test fixes
* Add a new db engine
* Add tests for new engine
* Update tsh db subcommands
* Refactor error message and suggestions for unsupported tsh commands
* Add dynamodb to test plan
* Add AWS external ID to db config and update protos
We were inconsistent throughout the codebase and would sometimes
use the slices package and other times use our own equivalents
in api/.
This removes our versions in favor of the golang.org/x package that
does the same, which has the added benefit of reducing the surface
area of the public API module.
Note: despite existing uses of the slices package, for some reason
it didn't show up in go.mod or go.sum. Fixed that too.
The 24-hour grace period was kept in Teleport 10 for backwards
compatibility, but is no longer necessary for Teleport 11 due
to the session tracker system.
As a result, it takes about an hour to complete an abandoned upload
instead of 24 hours.
While looking up github.com/gokyle/hotp I found some old deprecation warnings
and decided to address them.
* Remove HOTP support
* Update comment on checkOTP
* Remove OTPType
* Remove a few more HOTP references
* Add initial version of installer
* Resolve comments
- Use aws waiters when checking commands
- Use SSMRunRequest rather than passing instances
- General comments
* Resolve comments, (rebase) pass scriptname parameter
This resolves comments regarding running on multiple ec2 instances at
once by adding state to the instances cache to check if the instance
is known about and how far into installation it is
* Revert cache
* Dont cache on non discovery nodes
* Resolve some comments
* Move discovery out to its own serviec
* Add a `discovery_service` section
* Fix messed up conflict merge
* Make starting a standalone discovery agent work
* Resolve comments
* Resolve comments
- use a regular events.Emitter
- resolve a thousand typos :)
* Resolve comments
* resolve comments, fix a bad merge
* Fail when a non ec2 matcher type is configured
* fix lint-go
* Resolve comments
* Resolve comments, add initial test (currently broken)
* Fix log string so only 1 pair of [] are used
* Chunk instances for sending commands
* add 'isInitialized' to watchers
* Add test for chunked discovery, log output
* lints
* explicetly set matcher.Tags to "*":"*" if its unset
Update metalinter, fix a few lint warnings and replace deprecated linters.
`deadcode`, `structcheck` and `varcheck` are abandoned and now replaced by [`unused`][1].
Since 1.19, `go fmt` reformats godocs according to https://go.dev/doc/comment. I've done a bulk-reformatting of the codebase to keep the linter happy. Backporting is mostly harmless (the exception being `lib/services/role_test.go`, that for some reason breaks the _old_ linter using the new format).
[1]: https://golangci-lint.run/usage/linters/
* Bump golangci-lint version
* Replace abandoned linters
* Fix bodyclose on lib/auth/github.com
* Fix bodyclose on lib/kube/proxy/streamproto/proto_test.go
* Fix bodyclose on lib/srv/alpnproxy/proxy_test.go
* Fix bodyclose on lib/web/conn_upgrade_test.go
* Silence staticcheck on lib/kube/proxy/forwarder_test.go
* Silence staticcheck on lib/utils/certs_test.go
* Address BuildNameToCertificate deprecation warnings
* Run `go fmt ./...`
* Run `go fmt ./...` on api/
* Ignore formatting in role_test.go
* Remove redundant initializers in lib/srv/uacc/
* Update e/
* added check that blocks enterprise Github organizations using external SSO from using Github auth connectors on Teleport OSS
* added details to docs and changelog
* move check from init to on login
* cache org sso status; address small pieces of feedback
* use utils.FnCache instead of 3rd party cache
* addressed feedback
* addressed feedback
* revised docs
* addressed more feedback
* remove notes in changelog
* removed unused interface
Gabriel Corado