Updates app server heartbeats to use srv.Heartbeatv2 in order to
leverage the inventory control stream instead of the legacy mechanism.
The new srv.heartbeatV2Driver implementation for app servers detects
the version of Auth and falls back appropriately if the Auth server
is too old to know about the new field added to the InventoryHeartbeat
message. The connected_resources metric should be accurate if the
auth and app service are on the same version or if the auth service
is on a more recent version. If the app service is newer than auth
and the new app server driver kicks into fall back mode then the
connected resource metric will not be updated.
Partially addresses #40917
* Add warning to previous command
* Hash out basics of new tbot proxying command use
* Avoid passing full botConfig into `tbot ssh-proxy-command`
* wip
* simplify impl
* Set up test suite for ssh config generation
* Add support for checking if ALPNConnUpgrade is required
* Cache the alpn upgrade result
* Americanize Spellings
* Update lib/tbot/config/template_ssh_client.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Add CHANGELOG.md entry for breaking change
* Update tool/tbot/proxy.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Update lib/tbot/tbot.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Switch to `--no` variants rather than `={bool}`
* Use SingleFlight on alpn proxy upgrade cache
* Improve singleflight
* Add rudimentary shell quoting
* Uniformly pad the templating
* Rename shellQuote -> proxyCommandQuote
* Fix imports
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Keep SIGHUP handled while there's a pidfile on disk
* Make checkServerIdentity more verbose
* Use a buffered channel that was filled
* Clarify that it's fine if the channel is full
* Use signal.Notify outside of WaitAndReload
`ListPlugins` endpoint doesn't enforce `size>0` nor it assumes the
default page size when `pageSize = 0` is passed.
This results in the agent being in a deadloop because it cannot iterate
through results.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* AWS OIDC App Access: add PublicAddr to App
This PR adds a missing field to the App created to handle the AWS App
Access when using the AWS OIDC credentials
The PublicAddr is required and was not being set.
* fix identation
* Add AWSSAMLProviderV1 to access graph proto
* Access Graph: sync AWS SAML Providers
* Parse SAML entity descriptor before sending to TAG
* Add protos for AWS OIDC providers
* Fetch AWS OIDC providers
* Fetch signing certificates for AWS SAML providers
* Deflake identity provider fetch test
The concrete implementation of IAM mock uses a map,
resulting in non-deterministic iteration order.
Sort the results before comparing to alleviate.
* Update lib/srv/discovery/fetchers/aws-sync/iam_test.go
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
---------
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
On a busy cluster, Teleport can issue hundreds or even thousands
of TLS certificates in a short period of time. This can clutter
the logs and make troubleshooting difficult.
- Decrease the severity from INFO to DEBUG
- Log only the common name, not the full subject
This starts separating the lib/auth client and server code into
distinct packages to reduce the dependency tree of client tools.
For the time being aliases were left to all things moved into
lib/auth/authclient to reduce the changeset and ensure code still
compiles. Future changes will be built off this to convert code
to use lib/auth/authclient where applicable, this was intentionally
left to a minimum amount of changes to facilitate backports.
The session closing in TerminalHandler.Close did not always close
established ssh sessions if the client closed the web socket
at any point between the new browser tab being opened and the session
being established. In these cases the SSH connection was leaked for
the duration of the Proxy process. To ensure sessions are always
terminated a check to see if the client closed the web socket was
added prior to writing the session metadata and after the shell
is established for the ssh session.
Deletes the client fallback logic for users and auth connectors.
The server side cleanup was punted to v17 to prevent any v14 clients
from being unable to interact with a v16 control plane when trying
to interact with users and auth connectors.
#38026 made rejecting client running unusupported major versions an
opt-in behavior. Moving forward(v16 and beyond) this is now going
to be an opt-out behavior(TELEPORT_UNSTABLE_ALLOW_OLD_CLIENTS=yes).
In addition, a cluster alert is now being emitted once for the life
of an Auth process if it rejects an unsupported client - with
visibility limited to users with token:create permissions.
* Log UDS sourced peer info
* Add logging of peer address when non-unix
* Properly group logging attributes when svid is issued
* Add config structs for unix workload attestation and tests
* Add test for entire bot config
* Return `PermissionDenied` when no SVIDs available as per SPIFFE Workload API 5.2.1
* Filter down SVIDs based on workload attestation
* Add improved logging
* Add basic unit test
* Add e2e test that uses workload attestation
* Document workload attestation features
* Test failed user/pass audit on CreateAuthenticateChallenge
* Emit login failure event in the /mfa/login/begin step
* nit: Remove final stop from logging statements
* nit: Remove seemingly outdated comment
The new subcommand is meant to be a replacement for tbot proxy ssh
which does the ssh proxying entirely within tbot to reduce resource
consumption. The old mechanism spawned a tsh process to perform the
proxying which leads to increased CPU and memory consumption - which
can be quite problematic when used as an OpenSSH ProxyCommand for
an ansible playbook.
The new command also deviates in behavior from tsh proxy ssh in that,
for the moment, it requires users to explicitly dictate whether
tls routing, alpn connection upgrades instead of guessing by making a
call to webapi/ping. This again turns out to be quite resource
intensive when tbot is used as an OpenSSH ProxyCommand for an ansible
playbook.
In the future tbot can look this information up out of band and store
it in the proper location so that tbot ssh-proxy-command can consume
it directly without users needing to provide it. The behavior as is
provides a path toward the future while also allowing users to gain
the performance improvements now.
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add backend handler for Web UI kube exec functionality.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Log error on sending it to websockete connection.
* Remove duplicate user key creation.
* Use scoped context.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Use local site cache.
* Simplify creating rest kube rest config.
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Don't set stdErr on pod execution options, if it's interactive shell.
* Don't use public proxy addr when getting kubeconfig server address/name.
* Don't set stdErr on stream options if it's interactive shell.
* Provide local host CA to podHandler directly, instead of access point.
* Add integration test for kube exec handler.
* Use read deadline instead of closing reader.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
This PR ensures the proper ResourceType is set when emitting
ResourceCreateEvent.
We now support running the Script/SSM mode using integration
credentials, so having an integration is not equivalent to using the
EICE mode.
* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
* Remove usage of tiktoken
The token counting mechanism in tokencount.go has been simplified by removing the usage of the tokenizer and instead estimating token count based on character length.
* Update tests
This logic was necessary in Teleport 15 and earlier, because some v14
(and earlier) clients did not support the insecure-drop mode.
Teleport 16 no longer needs to downgrade roles, as the minimum supported
client version is 15, and all v15 versions support insecure-drop.
* AWS OIDC: Script to configure EC2 Auto Discover with SSM
There's a new teleport command that adds an inline policy which enables
the AWS OIDC Integration to handle EC2 Auto Discover using the script
mode (SSM).
It also adds the SSM Document used in the teleport installation.
There's also a new endpoint which returns the one off script that uses
that command.
* Update lib/integrations/awsoidc/ec2_ssm_iam_config.go
Co-authored-by: Edward Dowling <EdwardDowling@users.noreply.github.com>
---------
Co-authored-by: Edward Dowling <EdwardDowling@users.noreply.github.com>
This PR adds auto-discover support for EC2 installation when using the
Script enroll mode with Integration credentials.
This mode uses SSM commands to install teleport on the target host.
Previsouly, integration credentials would only allow the EICE mode.
From now on, we can use integration credentials to run the SSM commands
on the target node.
* [vnet] DNS library
* switch to RunTestBackgroundTask
* remove unnecessary slog.With
* set forward request timeout to 5s
* add comment on getMessageBuffer
* set single deadline for read/write
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* check buf len instead of cap
* explicitly forward unhandled question types
* reduce buffer side and add comments with justification
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Validate application URL extracted from /web/launch/<app-url>
Prevents overwriting or setting new CSP directives.
Validating prevents this because a valid CSP directive
requires spaces between values and spaces are not valid
in URL (encoded or not).
Invalid CSP directives or its values gets ignored by the browser.
* Address CR
* Use accurate wording
Yassine Bounekhla