1. Server now always uses UTC timestamps for certificates it ussues
2. Client doesn't store cert validBefore time in separate files, it
parses the cert itself.
Fixes#370
Started re-writing Teleport client keystore. From a buggy JSON-to-file
to a standard, directory/filebased API behind a standard interface to
allow for alternative implementations.
```
~/.tsh/
└── sessions
└── localhost
├── cert
├── key
└── pub
```
auth server. This is needed when you configure cluster from scratch and
all nodes including auth server spin up simultaneously.
* Add tctl tools to generate keys and certificates
+ Command "tctl authorities gen" generates public and private keypair.
+ Command "tctl authorities gencert" generates public and private keypair signed
by existng private key
+ Command "tctl authorities export" was modified to be able to export exisitng private
CA keys to local storage
All of these commands are hidden by default.
section "static configuration"
* Add ability to configure teleport from environment variable
Environment variable TELEPORT_CONFIG can contain base64 encoded
YAML file config file of the standard file format, so teleport will use it on start
* Add special secrets section to the config file
Section "secrets" was updated to support pre-configured trusted CA keys and pre-generated keys
* Add special rts hidden section to add support for provisioning
Reverse tunnels are now first class citizens of teleport.
There's no longer static configuration for reverse tunnel agents
in the config. Instead, admins can add and remove reverse tunnels
using tctl reversetunnel (hidden) commands.
* tctl reversetunnel ls
lists reverse tunnels
* tctl reversetunnel upsert a.example.com 10.0.0.4:2023,10.0.0.5:2033 --ttl=10m
updates or inserts reverse tunnel for 10 minutes
* tctl reversetunnel del a.example.com
deletes a reverse tunnel
Teleport proxies watch changes in the reverse tunnels on the backend and
spin up / spin down reverse tunnels according to these changes.
* clients to tun servers are now supporting failover on the client
* clients periodically pull and sync auth servers that are available in the cluster
* teleport stores the information about cluster state locally and reuses it on restart
Here's how it works:
* It takes the closest tag that is present in the build
* Automatically applies this tag
* Adds git commit as well
* Is 100% go gettable
* No external deps, all vendored
This commit introduces heartbeats of AuthServers and Proxies and fixes several issues:
1. Server init problem
There was an issue in server init, when certificates of multiple roles were overwriting each otther.
Now Teleport stores each keypair and certificate in a separate file <hostid>.role.key and <hostid>.role.cert
This also means that it's backwards incompatible with previous on disk format.
2. Proxy and Auth heartbeats
Auth servers and proxies now heartbeat into cluster as well
3. Bugfixes:
* Proxy role was missing, it is now treated as a separate role with permissions
* AdvertiseIP is now a global setting that can be used by all roles
* --advertise-ip flag was ignored and was never applied
* teleport service initialization has been simplified, now each role get it's own client
* minor cleanups
Three changes:
1. Pings are randomized. Note `utils.RandomizedDuration()` function.
2. Sleeps are twice as long between failures.
3. Made tests less vulnerable to sleep times (also sped them up by about
three seconds)
+ minor refactoring, moved "magic constants" into a proper
constants in `defaults` module.
The problem was:
- Self-signed cert was also used as CA cert.
- This means a browser would add it to its list of CA certs.
- Then I'd delete /var/lib/teleport/*
- And a new CA would be created for the same name, confusing the browser
To fix:
- Certificate isn't marked as CA
- Org name is set to "Acme Co" instead of "Teleport"
Fixes#206
The idea:
- When creating client's TLS configuration, supply self-signed server
cert from /var/lib/teleport/.cert
This way if a user is connecting to a proxy running on localhost, he
doesn't need to specify --insecure flag.
`web.SSHAgentLogin(proxyAddr string)` expects proxyAddr string to be a
URL, while everywhere else we address servers by host:port pair.
Because of that, `--proxy=host` sytax was broken.
Got rid of MemoryListener, instead replacing it with a closely tied pair
of "fake socket" and "fake connection", where the connection wraps
around the undrlying SSH channel. This allows me:
- Know exactly when connection.Close() is called (no wait for in-memory pipes)
- Keep the original remote addr around
Most of the changes are in api_with_roles.go
klizhentas