DialWithDeadline works around the case when net.DialWithTimeout
succeeds, but key exchange hangs. Setting deadline on connection
prevents this case from happening
- Switched to new way of building Enterprise
- Removed `tctl tunnels` command (preparation for new resources)
- Removed `tctl auth ls` command (preparation for new resources)
When this command is executed:
```
$ scp host:path/with/wildcards/* .
```
Teleport would launch "SSH exec" request on the sever side, which in
turn would execute the following:
```
/bin/bash -c /usr/bin/teleport scp --remote-addr=127.0.0.1:44226 --local-addr=127.0.0.1:3022 -r -f path/with/wildcards/*
```
The problem is that bash will attempt to "expand" the wildcard, sending
a bunch of files as an input into -f, but `teleport scp` needs to see
the _exact_ string as passed via scp client.
The proposed solution is to detect shell wildcard characters and wrap
them in single quotes preventing them from being expanded.
Another potential solution is to NOT use shell to execute SCP commands.
* Fix bug with OIDC powered sessions logged out after 10 minutes
* Adjust web sessions durations by taking roles into account
* Provide explicit TTL enforced on the server side for bearer tokens
Before this PR the web session TTL was measured using defaults,
10 minutes for local sessions and 1 hour for OIDC sessions and
the system relied on client to renew the bearer token.
With this change bearer token TTL is set to 10 minutes
and the entire web session will expire if not renewed before
The maximum session duration is set to 12 hours, if not
limited to a smaller value by roles in RBAC modules.
This commit:
* Improves on the previous commit on better name resolution by the proxy
(and fixes a bug introduced by the previous commit)
* Removes 'host_login' from tsh client profile. Closes#729
It does two things:
1. Forwards the original HTTP error to the user without replacing it
with generic "object not found". Related PR for trace package:
https://github.com/gravitational/trace/pull/27
2. Adds proper handling for `-d` (debug) CLI flag. When passed, `tsh`
will print the call stack along with the error message.
Trusted clusters and cert authorities static configuration
sections were not properly processed and we've been creating
incomplete V2 objects in the database. This commit fixes the problem
- Added idle timeout handling to every SSH connection.
- A bit of code refactoring (removing unused code paths)
Most importantly:
Added a custom SSH handshake between SSH Teleport proxies
and SSH Teleport servers. This handshake sends a custom JSON payload
from a proxy to a server, allowing to exchange additional information,
like the true IP of a client.
Sasha Klizhentas