Sets `http.Server.IdleTimeout` and `http.Client.IdleConnTimeout`
on clients and servers which didn't have them set. A default of
360s was chosen to be on par with the default of an NLB without
being identical.
This was added as another safety measure to prevent leaking any
idle connections indefinitely as seen in #22757.
`apidefaults.DefaultDialTimeout` was also renamed to
`apidefaults.DefaultIOTimeout` to better reflect its usage.
* SAML IdP audit events.
SAML IdP audit events have been added. These events have been added to the UI
for proper rendering. Additionally, service provider events will be emitted
when managing service providers.
* Align the naming more with the existing events.
* Zac's feedback.
* Add in delete all event.
* Fix typo.
* Update story snapshot.
* Linting and test fixes.
* Audit auth failures.
* Removing the nopermissions test, as it's covered in the regular create test.
* services.usagereporter to lib/usagereporter/teleport
* teleterm/daemon/usagereporter to usagereporter/daemon
* usagereporter/daemon type aliases
* Move UsageAnonymizable newtypes in a separate file
* DiscardUsageReporter should be passed by value
* Type renames in usagereporter/teleport
* Move audit event to usage event conversion to lib/usagereporter
* package import renames
* Don't break the e build for now
* move web usage report events to lib/usagereporter
* forgot license blurb
* lib/usagereporter/discover.go to types_discover.go
* Make UsageSessionStart more selective and granular for app access
* Allow generic "app" kind for app.session.start
app.session.start is consistently emitted, just not consistently stored
* Avoid singling out aws app access
* Use the same check as app access
* Use `ctx` rather than `context.TODO()` where available
* Further propagation of context
* Use `context.Background()` instead of `context.TODO()` where appropriate in tests
* Further remove `context.TODO` from tests
* Appease linter on parameter order
* Add usage events for certificate issuance and additional session types
This adds a new usage event for certificate issuance, emitted
whenever a new user certificate is generated. These events include
an anonymized username, TTL, and basic info about which requests are
present on the certificate (e.g. db/app/k8s requests).
Additionally, this captures additional session event types from the
audit log, including database, app, and desktop sessions, and also
properly tags k8s exec sessions which were previously grouped
together with SSH.
* Add `SessionStartV2` events, add `is_bot` flag to cert events
* Drop redundant `Event` prefix on `UsageCertificteIssued` event
* Rename `CertificateIssuedEvent` -> `UserCertificateIssuedEvent`
Prior to this, disabling desktop recordings would prevent them from
being uploaded, but AuditWriter would still write them to disk.
As a result, users who weren't recording sesions would still incur
both a performance penalty and unnecessary use of disk space.
Updates #16773
This commit adds the types necessary in order to add audit events for
login rule resource actions.
The emission of these events will be added in a separate commit to
teleport.e, and the frontend display will be added later (currently
these show up as "Unknown" events).
* Add a new db engine
* Add tests for new engine
* Update tsh db subcommands
* Refactor error message and suggestions for unsupported tsh commands
* Add dynamodb to test plan
* Add AWS external ID to db config and update protos
* Limit Device Name and User Agent lengths
* Spelling correction
* Increase ballast size while trimming message size
* Cleanup error message
* Remove additional check
* Adjust tests
* Add tests for large AuditEvent
* Rename func to add clarity
* Move limit to const and lowercase field name
* Add test for invalid device name length
* Add a test for trimming the user agent
* Replace custom emitter with MockEmitter
* Add additional background to const
* Add additional comments
* Fix import ordering
* Refactor trimN to better handle heavily quoted queries and add tests
* Convert to error assetion func
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Finish test refactor
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Add `GetEmitter()` to allow proper emitter wrapping for PreHog
This is part of a fix for the PreHog usage reporter to resolve a bug
where an improper emitter implementation was wrapped, potentially
replacing a valid set of emitters. A new `GetEmitter` function is
added to `Server` to allow fetching of the correct implementation
so it can be wrapped overwritten sensibly.
Additionally, this changes the signature of `UsageLogger.New()` to
require just an `events.Emitter` interface rather than an `IAuditLog`
specifically.
Finally, this fixes a small bug in the PreHog submitter where failed
events were accidentally dropped too early.
* Add godoc for GetEmitter/SetEmitter
* Add warnings to godoc for SetEmitter and SetUsageReporter
* [draft] Add a new usage reporter
This adds a new usage reporter service to the auth server. It's
disabled by default in OSS and can only be turned on via startup hook
in Cloud / Enterprise. In OSS, the audit log wrapper is never
configured and any usage events are sent to a no-op discard reporter.
Usage events are defined in prehog and can be sent to the new
UsageReporter Service on the auth server. An audit event wrapper is
used to capture certain events that are otherwise difficult to hook.
Events are anonymized before submission, then held in a non-blocking
queue for batching and submission purposes.
* Remove dead code
* Add SubmitUsageEvent RPC to Auth.
This adds a new SubmitUsageEvent RPC to the Auth API that external
clients (e.g. the UI) can use to submit usage events externally.
* Slight refactor for unit testing
* Add Prometheus metrics and add initial working prehog submitter
* Add more metrics, tweak prehog client, and add unit tests
* Further tweak http transport settings based on Teleport defaults
* Add missing metrics
* Fix goimports
* Add new UI usage events
* Update e ref
* Add prehog directly for now. Improve logging.
* update prehog
* Add new prehog events; use username from request identity
* add HTTP server for user events
* Add username back to pre-onboard events
* unauthenticated user events
* Fix userevent build error
* Use event-provided username where appropriate
* Move barebones prehog reqs to lib/prehog and generate here.
Also, use prod tunable values.
* Fix license lints
* De-flake tests by adding unfortunate amounts of synchronization.
* Add missing license header
* Misc PR cleanup for review
* Update lib/events/usageevents/usageevents.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Address a batch of review comments
Adds `anonymizer.AnonymizeString` and parent loggers
* Update e ref
* Clean up comments
* Remove onboard prefix from recovery code event
* Address another batch of feedback
* Use defaults.HTTPClient()
* Remove a noisy log message
* Demote noisy log message to debug
* Temporarily revert e ref for merge
Co-authored-by: Michelle Bergquist <michelle.bergquist@goteleport.com>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
This fixes two issues with the GCS session handler.
1. The "pass through" function wasn't actually passing through anything.
It always ignores errors from the delete call.
2. Prefer path over filepath here, since we always want paths delimited
by `/`. This isn't a critical issue now, but would result in all
sorts of failures if we were to try and run Teleport on systems like
windows where the filepath separator is not `/`.
We were inconsistent throughout the codebase and would sometimes
use the slices package and other times use our own equivalents
in api/.
This removes our versions in favor of the golang.org/x package that
does the same, which has the added benefit of reducing the surface
area of the public API module.
Note: despite existing uses of the slices package, for some reason
it didn't show up in go.mod or go.sum. Fixed that too.
* protobuf update
* Update proto to use dynamodb request event specific to app-access
We will include a similar event for dynamodb via database-access.
We split the events so that app and database access events are not coupled.
This way we do not have to include optional database/app metadata in one event too.
* Update protos
* Update oneof
* Move AppMetaData up with the other metadata and add a 'target' field
* Remove operation plane
* Fix typo
* Configure signing service with transport instead of http client
* Protect from resource exhaustion attacks
* Add IsDynamoDB to types.Application
* Add new event and code for dynamodb requests
* Add async emitter to app access
* Add audit.go to unify app access auditing
* Refactor auditing in app access
* Use the new audit's onSessionChunk/onRequest methods
* Put the session context in the session chunk
* Use a TeeStreamer to send AppSessionDynamoDBRequest directly to audit log as well as session file
* Change streamWriter to streamCloser in sessionChunk to clarify that it should only be used for closing
* Update handler test to test dynamodb events
* Update test to use streamCloser
* Update sever test
* Add doc strings
* Return error from audit interface methods so callers can choose what do to with it
* Move app session start/end into audit interface
* Configure tcpServer to use the server's emitter instead of auth
client, as an Audit interface.
* Have tcpServer call onSessionStart/End instead of emitting events
itself.
* Remove unneeded check type
* Rename Transport -> RoundTripper
* Fix test after renaming field
* Rename drainBody and defer body closing
* Fix subtle named return mistake
* Update lib/service/service.go
Co-authored-by: Tobiasz Heller <14020794+tobiaszheller@users.noreply.github.com>
* Update lib/service/service.go
Co-authored-by: Tobiasz Heller <14020794+tobiaszheller@users.noreply.github.com>
* Rename ok->shouldSkipCleanup to make the purpose of it more clear
* Refactor request body decoding into aws utils
* Use request instead of signed request for audit event
* Determine if req is for a dynamo endpoint instead of checking app uri
* Remove obsolete app func IsDynamoDB
* Update handler test
* Use generic console app uri to test that we differentiate request by endpoint instead of app uri
* Use a dynamodb request which has a body to test that we include the body in the audit event
* Test for expected body JSON
* fix lint
* Fixup merge
Co-authored-by: Tobiasz Heller <14020794+tobiaszheller@users.noreply.github.com>
This reverts commit 4f3aa9a3f2.
We're unable to build for 32-bit Linux due to
https://github.com/golang/go/issues/55152,
which looks like it will be fixed with Go 1.19.2 next week.
We'll re-evaluate with the next Go release and reintroduce this change
as soon as we can.
Update various "assorted" dependencies, that either are used throughout
(logging, testing), are mostly algorithmic or otherwise difficult to pinpoint
"ownership".
I've dropped a couple of deprecated/mostly meaningless dependencies. I suspect
`github.com/mitchellh/mapstructure` could be dropped to, but I didn't look
further now.
* Drop dependency on Clever/go-utils
* Drop dependency on github.com/pkg/errors
* Update various Go dependencies
* Use CompareAndSwap instead of CAS (uber/atomic)
* Add a comment after replaced dependencies
The 24-hour grace period was kept in Teleport 10 for backwards
compatibility, but is no longer necessary for Teleport 11 due
to the session tracker system.
As a result, it takes about an hour to complete an abandoned upload
instead of 24 hours.
rosstimothy