* Allow node to handle old and new way of client IP propagation on same listener
With addition of signed PROXY headers, node was listening on multiplexer, but because
of that it couldn't processing incoming connection from older proxies
when ProxyHelloSignature was used, because
both ends were waiting for the other side to send data first.
Here we integrate ability to handle PROXY headers into connection itself,
so we can start ssh server without waiting for multiplexer to detect connection
* Remove unneeded code
* Improve comment's wording
Co-authored-by: Michael Wilson <mike@mdwn.dev>
* Improve comment's wording
Co-authored-by: Michael Wilson <mike@mdwn.dev>
* Fix imports
* Unexport function
* Add godoc
* Remove unneeded comment
* Move ProxyHelloSignature to constants
* Check that proxyline is verified
* Use Warn() instead of Warnf()
* Move ProxyHelloSignature to api/constants
* Add timeout for getting host CA during proxyline verification.
* Rearrange conditions
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Clarify comment.
---------
Co-authored-by: Michael Wilson <mike@mdwn.dev>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* make it easier to create registered openssh nodes with 'tctl'
Metadata.Name is set to a random UUID if it's unset, the requirement
to use '--force' when creating node resources is dropped, and more
checks for openssh node resources are added.
* added test coverage, renamed KindOpenSSHNode -> SubKindOpenSSHNode, added github.com/google/uuid to api/go.mod
* attempt to fix tests
* don't set node subkind if it's empty
* re-add test fix
This PR implements the core of the kube-agent-updater, which is part of
https://github.com/gravitational/teleport/issues/21516#issue-1576935859
In order to have a fully working updater we still need to:
- implement the interfaces for version retrieval, image validation and maintenance trigger
- add statefulset support (and deal with the potential deadlocks)
- implement the CI and release pipeline (Dockerfile, README, Makefile, github action, drone)
- integrate in the `teleport-kube-agent` helm chart
Those changes will happen in subsequent PRs.
* tighten existing audit title in nav
* Move plugin install and config to partials
This move not only consolidates these instructions to a single source of
truth, but also takes the divergent updates from these instructions across
multiple docs.
* init datadog guide
* Update docs/pages/includes/configure-event-handler.mdx
Co-authored-by: Michael Wilson <mike@mdwn.dev>
* respond to review feedback
* add context for Logstash
* add context for Splunk
* update page titles
See https://github.com/gravitational/teleport/pull/21950/files\#r1110311232 for details
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* move link to next steps
* Apply suggestions from code review
* adjust prereqs
* Apply suggestions from code review
* Update docs/pages/management/export-audit-events/datadog.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* appease pointless linter rule
---------
Co-authored-by: Michael Wilson <mike@mdwn.dev>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* SAML identity provider docs.
SAML IdP documentation has been added.
* formatting
* spelling
* Zac's and Roman's feedback.
* Valid config.json.
* Linting updates.
* usr Var component
Adding as a unique commit in case it's not desired
* align output with object name
* Roman's feedback, add in a section for disabling the IdP.
* copy edits
* SAML Grafana guide (#22545)
* init Grafana SAML guide
* respond to review feedback
* Correct entity provider to identity provider.
* Note that HSM is not currently supported.
* Fix link.
---------
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
* update storybook dependencies to resolve some dependabot issues.
* remove config that's already set to the default
* Resolve prettier issues after dep update.
* Pin x-default-browser version to resolve dependabot vulnerability.
* SCP -Change file attrs only when requested
OpenSSH sets 0644 by default and allows copy the source permissions by passing `-p` flag.
Our current implementation sets the file permissions even when client didn't use `-p` flag which can fail if the user doesn't have permissions to set it. This patch matches the OpenSSH behavior.
* Fix formatting
SAML IdP service providers have been added to the default allow rules to
ensure that the editor role has access to the SAML IdP service providers
during a migration.
The RBAC logic assumes that SSH connections to registered OpenSSH nodes
will always be proxied and terminated, which will come in a future PR.
Part of implementing #19261.
* Skip building webassets in CI
Building webassets is not always needed and many of our CI build just builds them and ends up not using them after.
This PR skips building the webassets for all pipelines where they are not needed. This should save us some time and $$.
* Make some changes to trigger CI
* Create the missing directory
All network I/O should be done in the cache collection fetch and
not the appy function returned from fetch. This moves the
`ListResources` request for database services out of the apply
function to be compliant with the collection requirements.
* Use event.code for non A-z keys
Without this fix, shortcuts like "Shift+1" can't work, because the reported character is "!".
* Add Zod schema to validate keyboard shortcuts
* Render better formatted error notification, add a link to docs
* Notify about duplicated accelerators
* Improve the error message for re-parsing failure (it can happen when a default value does not pass validation)
* A bunch of renames
* Allow spaces in accelerators
* Rename `isContentAnObject`
* Allow `Notification` to render links and lists
* Split by optional whitespace and "+"
* Allow lowercase letters
* Require a modifier for non-function keys
* Move VALID_SHORTCUT_MESSAGE to `initUi`
* Always return from `getDuplicateAccelerators`
* Use 'Cmd' and 'Ctrl' for mac
* Add comments
* Fix notification not rendering content
* Add more comments, rename `getKeyCode` to `getKeyName`
* Fix incorrect size of <Link> text
* Remove "expected" prefix
* Revert `typeof content === 'object'` in `Notification`
* Remove a comment about disabled keys in `ConfigService`, add a note about `keymap.` prefix
* Improve `getKeyName` comment
* Extract an inline object to a variable in `getKeyName`
* Fix notification list padding
* Change text for doc link & description for config error
* Improve comment for `getKeyName`
* Remove special formatting for list === 1 in `Notification`
* Print valid modifiers
* Call `getKeyboardShortcutSchema()` once
* Collect issues from all validations, run `invalidModifiers` through a set
* Change error message for `missingModifierIssue`
* Convert duplicates warning to error
* Define ALLOWED_KEY_CODES in a more concise way
* Support both `IntlBackslash` and `Backquote`
* Restore modifiers for mac to full spelling, sort them in order recommended by platform guidelines
* Fix old comment about the shortcuts order
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* Make naming around keyboard shortcuts more consistent
Previously, we used words like: "key", "type", "shortcut" which were really confusing (and I wrote this code), because it was hard to tell what exactly they describe.
From now, we will use only "accelerator" (borrowed from Electron) and "action" words.
For example, in a shortcut "Command+1": "tab-1":
- "Command+1" is "accelerator"
- "tab-1" is "action"
* Use "+" instead of "-" as a separator
With "-" we are not able to use this symbol as a valid key code.
* Rename some config keys to follow the same naming pattern
* Rename keyboard shortcuts to match config keys
* Extract `mapAcceleratorsToActions` to a function
* Rename other "keyboard shortcuts" to "accelerators" and "actions"
* Add Telnet into docker to test connectivity for cloud getting started
Including telnet allows the script to test connectivity.
* Describe usage by telnet
* update verbiage
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update docs/pages/choose-an-edition/teleport-cloud/getting-started.mdx
Co-authored-by: Gus Luxton <gus@goteleport.com>
* verbiage
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
Co-authored-by: Gus Luxton <gus@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Add in SAML IdP service provider session metadata to auth attempts.
The SAML IdP auth attempt event now contains SAML IdP service provider,
which will allow the audit logs to display which service provider the user
is attempting to log into.
Additionally, a shortcut name has been added to the SAML IdP service provider
metadata to handle auth attempts where the service provider could not be found
given a shortcut name.
* Linting fix.
* Modify the auth attempt audit log entries.
expanded 'registering nodes' section to provide solution to stated problem
addressed feedback
Clarified RBAC section, added security and UX notes. Removed the
option of adding info to host certs, that actually won't work with how
SSH public key auth is currently implemented.
added details on new CA, fleshed out details on getting RBAC to work
addressed some feedback, renamed OpenSSH CA -> Agentless CA
added other RBAC implementation
minor changes addressing feedback
fix incorrect usage of 'preform'
added example of registered OpenSSH node resource
remove accidental reference to unregistered nodes
renamed sub-kind and CA; removed option 1 as it was unanimously rejected
added 'teleport' node sub-kind
add manual ca rotation details
address feedback
add section about SSH agent forwarding
clairified what SSH agents can be forwarded
addressed feedback
add future work
removed 'future work' section
clarified that proxy recording and direct dialing will be removed at the same time
address feedback
Update rfd/0098-registered-openssh-nodes.md
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* Add GCP Service Account parameter to tctl users add reference
Only applies to master and branch/v12
* Moved azure identities parameter next to other cloud apis ones
