Andrew LeFevre 5806d3324c prevent session id reuse (#42123) ...

* prevent SSH session id reuse

If a user sets `TELEPORT_SESSION` to a session ID
that isn't running, the sent session ID is ignored
and a new one is used to prevent the user
controlling the value. When parsing a session ID
the parsed result is used to ensure all session
IDs will have the same format.
`CreateSessionTracker` is updated to create
instead of upsert to ensure `SessionTracker`
resources cannot be overwritten by accident.

Clients often need to know the current session ID,
and before when they were in control of it that
wasn't an issue. To fix this servers will send the
current session ID in a SSH channel request on the
channel the SSH session was created on. This
should be fully backwards compatible, as when an
unknown SSH request type is received clients will
just ignore it/reply with false.

* add test for wrappedSSHConn

2024-05-29 14:01:15 +00:00

..

session.go

prevent session id reuse (#42123)

2024-05-29 14:01:15 +00:00