- Add a generalized client store made up of a key, profile, and trusted certs store. Each sub store can support different backends (~/.tsh, identity_file, in-memory).
- Replace custom identity file handling with in-memory client store.
- Fix issues with trusted certs handling.
This code is not caught by linters because it's exported and they assume
there's some external users.
Since teleport is relatively self-contained, we can tell for sure
whether something is called or not.
Previous Login code path was calling itself recursively.
In some cases that lead to endless loops with browser
opening up forever.
This commit factors out retry logic to RetryWithLogin
decorator handler that is used by CLI explicitly.
Client code became better as a result as there are no
hidden side effects.
Login could change the SSH proxy address based
on the information from "ping" endpoint
The function ConnectToProxy was saving
old version of the variable and kept using
it during login procedure.
This commit fixes that so the relevant
variable is always referenced.
Implements the -D flag of ssh, but only with a SOCKS5 proxy.
OpenSSH also supports a SOCKS4 proxy.
This commit also fixes a bug in the server which prevented it from
forwarding raw IPv6 sockets, as the addresses were incorrectly
escaped.
This commit moves proxy kubernetes configuration
to a separate nested block to provide more fine
grained settings:
```yaml
auth:
kubernetes_ca_cert_path: /tmp/custom-ca
proxy:
enabled: yes
kubernetes:
enabled: yes
public_addr: [custom.example.com:port]
api_addr: kuberentes.example.com:443
listen_addr: localhost:3026
```
1. Kubernetes config section is explicitly enabled
and disabled. It is disabled by default.
2. Public address in kubernetes section
is propagated to tsh profile
The other part of the commit updates Ping
endpoint to send proxy configuration back to
the client, including kubernetes public address
and ssh listen address.
Clients updates profile accordingly to configuration
received from the proxy.
The following changes have been introduced
to tsh login behavior:
1. tsh login now accepts cluster name
as an optional positional argument:
$ tsh login clustername
2. If tsh login is called without arguments
and the current credentials are valid,
tsh login now prints status, previous behavior
always forced login:
$ tsh login
... print status if logged in...
2. If tsh login is called with the proxy
equal to current, tsh login selects cluster,
otherwise it will re-login to another proxy:
$ tsh login one
... selected cluster one
$ tsh login two
... selected cluster two
$ tsh login --proxy=example.com three
... selected cluster three because
proxy is the same
$ tsh login --proxy=acme.example.com four
...will switch to proxy acme.example.com
and cluster four
If user has not logged in yet, and runs
tsh --proxy=example.com ls
Teleport launches ad-hoc login screen, however
because tsh did not write profile, username
and proxy were lost, so any next execution
tsh --proxy=example.com ls
Will launch the same login screen and will
ask for proxy, what is not user-friendly.
This PR fixes it by saving profile after
ad-hoc login attempts.
* Updated LocalKeyAgent to load both certificate and private key into Teleport and system agent.
* Refactored LocalKeyAgent to consolidate key loading code.
* Added test coverage for LocalKeyAgent.
This commit:
* Improves on the previous commit on better name resolution by the proxy
(and fixes a bug introduced by the previous commit)
* Removes 'host_login' from tsh client profile. Closes#729
Brian Joerger