mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-03 16:38:35 +08:00
Marco André Dinis
c219962ccc
This PR implements the SSH Tester for ConnectionDiagnostic feature. This feature is also known as Test Connection, part of Teleport Discover. The goal here is to provide immediante feedback about a newly added resource. Can the user connect to it? We are targetting SSH Nodes as a first ResourceKind. To test the access to an SSH Node we require the ResourceName and a login username (ssh principal). Then a series of checks will occur in two places: - SSH client in the Web server - SSH server in the SSH agent The ssh client creates a new Connection Diagnostic with some initial state. Then it tries to build up the necessary SSH config This already gives us a couple of things to check for: - does the node exist and does the current user (inherited from websession) can access it? - is the node accepting TCP connections (in the specific port)? - is the node accepting SSH protocol on top of the TCP connection? Then, the ConnectionDiagnosticID is inject into the certificate and the SSH Server receives it and will also Append traces into it: - is the requested principal allowed for the current user? - does the requested principal exist in the target node? This is not an exhaustive list of checks. For a complete list of which checks are verified please see the TestDiagnoseSSHConnection test. After all those checks, it returns if the Connection was successful and what all of the traces generated along the way. Demo:   
This package is documented using a combination of pkg.go.dev and Teleport Docs.