report errors in case of SSH access denied, fixes #179

errors.go

@@ -19,6 +19,7 @@ package teleport
 import (
 	"fmt"
 	"net"
+	"os"
 	"syscall"
 
 	"github.com/gravitational/trace"
@@ -304,19 +305,23 @@ func IsAccessDenied(e error) bool {
 	return ok
 }
 
-// ConvertConnectionProblem converts system error to connection problem
-// if applicable
-func ConvertConnectionProblem(err error) error {
+// ConvertSystemError converts system error to appropriate teleport error
+// if it is possible, otherwise, returns original error
+func ConvertSystemError(err error) error {
 	innerError := err
 	if terr, ok := err.(trace.Error); ok {
 		innerError = terr.OrigError()
 	}
-	neterr, ok := err.(*net.OpError)
-	if !ok {
+	switch realErr := innerError.(type) {
+	case *net.OpError:
+		return ConnectionProblem(
+			fmt.Sprintf("failed to connect to server %v", realErr.Addr), realErr)
+	case *os.PathError:
+		return AccessDenied(
+			fmt.Sprintf("failed to execute command %v error:  %v", realErr.Path, realErr.Err))
+	default:
 		return err
 	}
-	return ConnectionProblem(
-		fmt.Sprintf("failed to connect to server %v", neterr.Addr), innerError)
 }
 
 // ConnectionProblem returns ConnectionProblem
@@ -336,7 +341,7 @@ type ConnectionProblemError struct {
 
 // Error is debug - friendly error message
 func (c *ConnectionProblemError) Error() string {
-	return fmt.Sprintf("connection problem: %v, %v", c.Message, c.Err.Error())
+	return fmt.Sprintf("%v: %v", c.Message, c.Err.Error())
 }
 
 // IsConnectionProblemError indicates that this error is of ConnectionProblem

lib/client/client.go

@@ -198,7 +198,7 @@ func (proxy *ProxyClient) ConnectToNode(
 			buf := &bytes.Buffer{}
 			io.Copy(buf, proxyErr)
 			if buf.String() != "" {
-				fmt.Println("ERROR: " + buf.String() + "\n")
+				fmt.Println("ERROR: " + buf.String())
 			}
 		}
 		err = proxySession.RequestSubsystem(fmt.Sprintf("proxy:%v", nodeAddress))
@@ -313,6 +313,19 @@ func (client *NodeClient) Shell(width, height int, sessionID string) (io.ReadWri
 		return nil, trace.Wrap(err)
 	}
 
+	stderr, err := session.StderrPipe()
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	go func() {
+		buf := &bytes.Buffer{}
+		io.Copy(buf, stderr)
+		if buf.String() != "" {
+			fmt.Println("ERROR: " + buf.String())
+		}
+	}()
+
 	err = session.Shell()
 	if err != nil {
 		return nil, trace.Wrap(err)

lib/srv/exec.go

@@ -24,7 +24,9 @@ import (
 	"os/exec"
 	"syscall"
 
+	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/events"
+
 	"github.com/gravitational/trace"
 	"golang.org/x/crypto/ssh"
 )
@@ -90,7 +92,7 @@ func (e *execFn) start(sconn *ssh.ServerConn, shell string, ch ssh.Channel) (*ex
 
 	if err := e.cmd.Start(); err != nil {
 		e.ctx.Warningf("%v start failure err: %v", e, err)
-		return e.collectStatus(e.cmd, err)
+		return e.collectStatus(e.cmd, teleport.ConvertSystemError(err))
 	}
 	e.ctx.Infof("%v started", e)
 	return nil, nil

lib/srv/proxy.go

@@ -103,7 +103,7 @@ func (t *proxySubsys) start(sconn *ssh.ServerConn, ch ssh.Channel, req *ssh.Requ
 	// may not be actually DNS resolvable
 	conn, err := remoteSrv.DialServer(serverAddr)
 	if err != nil {
-		return trace.Wrap(teleport.ConvertConnectionProblem(err))
+		return trace.Wrap(teleport.ConvertSystemError(err))
 	}
 	go func() {
 		var err error

lib/srv/sess.go

@@ -53,6 +53,7 @@ func (s *sessionRegistry) newShell(sid string, sconn *ssh.ServerConn, ch ssh.Cha
 		return trace.Wrap(err)
 	}
 	if err := sess.start(sconn, ch, ctx); err != nil {
+		defer sess.Close()
 		return trace.Wrap(err)
 	}
 	s.addSession(sess)
@@ -306,8 +307,8 @@ func (s *session) start(sconn *ssh.ServerConn, ch ssh.Channel, ctx *ctx) error {
 	}
 
 	if err := s.term.run(cmd); err != nil {
-		p.ctx.Infof("failed to start shell: %v", err)
-		return trace.Wrap(err)
+		ctx.Infof("shell command failed: %v", err)
+		return teleport.ConvertSystemError(trace.Wrap(err))
 	}
 	p.ctx.Infof("starting shell input/output streaming")
 

lib/utils/addr.go

@@ -13,6 +13,7 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 */
+
 package utils
 
 import (

lib/utils/cli.go

@@ -29,7 +29,7 @@ import (
 	logrusSyslog "github.com/Sirupsen/logrus/hooks/syslog"
 )
 
-// CLI tools by default log into syslog, not stderr
+// InitLoggerCLI tools by default log into syslog, not stderr
 func InitLoggerCLI() {
 	log.SetLevel(log.InfoLevel)
 	// clear existing hooks:
@@ -47,7 +47,7 @@ func InitLoggerCLI() {
 	}
 }
 
-// Configures the logger to dump everything to stderr
+// InitLoggerDebug configures the logger to dump everything to stderr
 func InitLoggerDebug() {
 	// clear existing hooks:
 	log.StandardLogger().Hooks = make(log.LevelHooks)

lib/utils/utils.go

@@ -115,6 +115,12 @@ func IsHandshakeFailedError(err error) bool {
 	return strings.Contains(err.Error(), "ssh: handshake failed")
 }
 
+// IsShellFailedError specifies whether this error indicates
+// failed attempt to start shell
+func IsShellFailedError(err error) bool {
+	return strings.Contains(err.Error(), "ssh: cound not start shell")
+}
+
 // PortList is a list of TCP port
 type PortList []string
 

lib/web/web_test.go

@@ -395,9 +395,8 @@ func (s *WebSuite) TestWebSessionsLogout(c *C) {
 		return redirectErr
 	}
 	re, err = pack.clt.Get(pack.clt.Endpoint("webapi", "logout"), url.Values{})
-	orig, ok := err.(*trace.TraceErr)
-	c.Assert(ok, Equals, true)
-	c.Assert(orig.OrigError(), Equals, redirectErr)
+	c.Assert(err, NotNil)
+	c.Assert(err.Error(), Matches, ".*attempted redirect.*")
 
 	// subsequent requests trying to use this session will fail
 	re, err = pack.clt.Get(pack.clt.Endpoint("webapi", "sites"), url.Values{})