In https://github.com/gravitational/teleport/pull/24254 expansion
of tilde prefixes(i.e. `tsh scp CHANGELOG.md root@host:~foo/`) was
explicitly denied. However, because the error returned to the user
is a trace.BadParameter error the reauthentication logic kicks in
and attempts to resolve the issue with fresh credentials. This
error is now caught and wrapped in a NonRetryableError to prevent
the authentication logic from providing a weird UX.
Updates https://github.com/gravitational/teleport/issues/22886.
* GitHub proxy part 6: proxing Git using SSH transport
* better command parsing and update suite
* refactor
* revert unnecearrty files
* address review comments
* ut fix
* revert localsite_test.go
* change special suffix to teleport-github-org for routing
* fix routing ut
* minor typo edit
* fix ut after sshca change
* add UT to sshutils
* minor review comments
* fix api ut because of special suffix change
* GitServerReadOnlyClient
* downgrade error to warning
* run go mod tidy. not sure why it's needed
* rename mock.go to mock_test.go
In addition to the conversion, the reverstunnel server now has
a slog.Logger provided so that it can be passed into the
sshutils.Server, is not used otherwise. A similar migration will
be performed in the future for the reversetunnel package.
This change fixes a bug in remote port forwarding where Teleport reports
the hostname from the created remote listener, rather than the
hostname requested in the tcpip-forward request.
* Add networking subprocess for port and agent forwarding.
* Remove extraneous x11 forwarding logic.
* Add x11 forwarding to the networking subprocess.
* Fix lint.
* Try create host user before starting networking process.
* Resolve comments
* Fix networking process memory leak.
* Run networking subprocess as root but change to user login after PAM call.
* Update agent forwarding socket dir permissions.
* Handle networking requests synchronously to maintain the current PAM context.
* Use user environment in networking process.
* Fix issue with PAM thread state being locked to the main goroutine; Clean up homeDir logic; Fix PAM thread state for xauth commands.
* Selectively handle some networking requests in goroutines.
* Address comments.
* Use an interrupt signal to trigger graceful exit in the networking subprocess.
* Cleanup unix sockets from the child namespace.
* Address comments.
* Remove extraneous network forwarding socket validation.
* Fix tests and lint.
* Re-add networking process done channel to avoid deadlocks on reading unix sockets passed to a dead process.
* Remove broken test.
* Address comments.
* Cleanup; remove unused child error file.
* - Explicility list file paths to clean up at the end of the networking process.
- Use terminate FD instead of interrupt to signal the process to exit.
- Log errors from the parent process.
- Read networking request response without goroutine.
* Cleanup.
* Make request socket a stream.
* Remove extraneious Chmod.
* Send request level error to request conn.
* Don't unlink unix sockets from the parent process.
* Read full error message from stream.
* Remove remaining logs in child process.
* Fix typos.
* web: support SAML resource deletion in unified resources view (#44311)
* update SAML app edit mechanism to accomodate both edit and delete functions
* use user saml idp access to disable menu actions
* add comment to ResourceActionButton props
* refactor: SamlAppActionContext to edit and delete Saml application
* address review comments
* Add networking process tests to replace old tests.
* Don't close remote file descriptor before the child process has a chance to connect to it.
* Fix lint; skip broken test.
* Disable broken test and restore older test to cover for it.
* Remove unused agent forwarding test.
* Fix lint, replace broken test.
* Fix old test that used testify/require in goroutine.
* Close request context immediately to avoid deadlock (extended timeout) on reading from the closed process.
---------
Co-authored-by: Sakshyam Shah <sshah@goteleport.com>
* support separate SSH and TLS keys in `generateUserCert`
This PR splits the SSH and TLS public keys passed to
`auth.(*Server).generateUserCert`. The attestation statement associated
with the public key is also split.
Now, `sshPublicKey` will be the subject public key of the returned SSH
certificate, and `tlsPublicKey` will be the subject public key of the
returned TLS certificate. If either is not provided, the corresponding
certificate is not generated or returned.
This does not update any code paths to actually use different keys here,
but prepares for that in the future.
* use public key conversion func
* fix public key format in db tests
* Remove logging from circuit breaker
The logging is never output, and if it was would be very verbose.
Instead of dropping the level down to trace the logger is removed
entirely.
* Add constants from trace library
The logging functionality in trace is being removed in an upcoming
release. To prepare the logging component keys are copied from trace
into teleport.
* Convert trace.ComponentFields to teleport.ComponentFields
* Replace trace.Component with teleport.ComponentKey
* Replace trace logging constants
* ensure moderated file transfers only preform allowed operations
* fix sess test
* wip integration test
* integration test working
* tweak some error messages and test cases
* allow setstat for uploads
* address nits from code review
* expand paths when necessary when creating file transfer request
* improve UX of errors in web UI
* deny request when an invalid user tries to transfer files
* don't allow open requests, they aren't done by the webui
* address feedback
* use a buffered reader when reading the file request, address a few nits
* Fix X11 forwarding with OpenSSH option control master when connecting through the Proxy ssh forwarding service.
* Add X11Forwarding integration test with ControlMaster subtest.
* Refactor forwarding server to always forward x11 channel requests.
* Address comments.
* Fix x11 forwarding integration tests.
* clean up pidfile and reloads
* reduce log spam during graceful shutdowns
* hold an exclusive advisory lock on the pidfile
* do systemd reloads with the pidfile rather than $MAINPID
* prioritize signals over internal restarts
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Add pre- and post-detect hooks to the multiplexer
This gets rid of the dedicated "already written" mechanism in
multiplexer.Conn.
* Add a way for net.Conn to override ServerVersion
* Resumption handshake, client and server
* Enable SSH resumption in teleport and tsh
* Disable resumption in a subtest of TestIntegrations/Disconnection
* Add back the removed tests
* minor refactor of runClientResumable
* Disable resumption for a different subtest
* Add an option to disable SSH connection resumption in Connect (#36712)
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Co-authored-by: Grzegorz Zdunek <gzdunek@users.noreply.github.com>
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Co-authored-by: Grzegorz Zdunek <gzdunek@users.noreply.github.com>
`x/crypto/ssh` is adding a `fipsonly` mode (similar to `crypto/tls/fipsonly`) in
golang/go#64769. Once this has landed and been released, we'll swap to using it.
In the meantime, update our hardcoded algorithm set to match the algorithms listed
in https://go-review.googlesource.com/c/crypto/+/550515.
The only difference is that `aes192-ctr` is kept in `FIPSCiphers`, as it seems to be
approved by NIST SP 800-131A rev 2 (page 17).
Additionally, we now define a list of approved public key authentication algorithms for
SSH server connections. This isn't configurable for normal use case (yet), only handled
for FIPS builds.
* Increase `MinPasswordLength` from 6 to 12 characters
- PCI DSS v4.0 control 8.3.6 requires a minimum password length of 12 characters.
- NIST SP 800-63B section 5.1.1.1 requires a minimum password length of 8 characters.
* Increase `AccountLockInterval` from 20 to 30 minutes
- PCI DSS v4.0 control 8.3.4 requires a minimum lockout duration of 30 minutes.
This will contribute to better supporting customers to meet certain compliance requirements.
Ref #1936.
Ref #7687.
* Special case the subsystems handled by teleport exec
This only applies to sftp, and lets us do a real reexec where that's
possible (i.e. launching /proc/self/exe on Linux), making sftp work even
if Teleport has been replaced by some wrapper or has been deleted.
* Delete leftover comment
* Update godoc for ExecCommand.Command
Ensure that `proxy_ssh_sessions_total` is incremented in both the
root and the leaf cluster if a session to a node in the leaf cluster
is established through the root cluster. This now also prevents
leaf clusters from terminating during a graceful shutdown if there
is an active connection that was created from the root.
Fixes#32605.
This change drains unused SSH channels and requests to prevent a
situation where an attacker could repeatedly open channels and
send data that won't be read, causing Teleport to eventually run
out of memory.
The ssh session was not being closed for web sessions which resulted
in zombie sessions being left around until the ssh service was
restarted. TestTerminal was updated to assert that the session
tracker eventually transitions to the terminated state when the
client terminates the web socket.
Fixes#32120
* Make SSH node listener to use multiplexer to leverage parsing of signed PROXY headers
Before for backward compatibility reason we used regular listener and later
we wrapped connection into handler that could parse signed PROXY header or
proxyHelloSignature for getting correct user IP. But
after removal of proxyHelloSignature we don't need the wrapper anymore.
* Improve error message
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Added Fuzz Seeds for services/fuzz_test.go
* Fuzzing improvements for `lib/srv/db` fuzzing
This ensures that all fuzzing under `lib/srv/db` has the following:
* Good seeds that provide basic levels of coverage
* Enabled in OSS-Fuzz
* Fuzzing improvements for `lib/sshutils`
This improves the fuzzing in `lib/sshutils/sftp/parse_test.go` and `lib/sshutils/x11/display_test.go`.
Seeds were added and additional local fuzzing was done. In addition these functions are now enabled in `oss-fuzz`.
Andrew LeFevre