Skip to content

Fix dynamic labels not being present on server access audit events#32326

Merged
gabrielcorado merged 1 commit intomasterfrom
gabrielcorado/fix-sess-dynamic-labels
Sep 22, 2023
Merged

Fix dynamic labels not being present on server access audit events#32326
gabrielcorado merged 1 commit intomasterfrom
gabrielcorado/fix-sess-dynamic-labels

Conversation

@gabrielcorado
Copy link
Copy Markdown
Contributor

@gabrielcorado gabrielcorado commented Sep 21, 2023

The SSH session uses the TargetMetadata function to grab server metadata which is then used on audit logging. The issue was that this function only used the labels available at SetLabels (as it relied on the s.labels attribute).

This PR updates it to use a combination of static and dynamic labels (similar to the GetAllLabels function from resources).

Audit logs example

SSH service configuration:

ssh_service:
  enabled: "yes"
  commands:
  - name: OS
    command: [uname]
    period: 1h

Before:

{
  "addr.local": "127.0.0.1:4443",
  "addr.remote": "127.0.0.1:49840",
  "cluster_name": "root.teleport.dev",
  "code": "T2000I",
  "ei": 0,
  "event": "session.start",
  "initial_command": [
    ""
  ],
  "login": "gabrielcorado",
  "namespace": "default",
  "proto": "ssh",
  "server_addr": "[::]:3022",
  "server_hostname": "root.teleport.dev",
  "server_id": "b51ef330-73dd-4719-b8aa-8fb0c1c2dd65",
  "session_recording": "node",
  "sid": "f885497e-b847-4436-b12c-218c6cd3f04f",
  "size": "141:22",
  "time": "2023-09-21T15:44:20.543Z",
  "uid": "0b76a567-7a52-4a02-9c8f-5d546f8429d6",
  "user": "alice"
}

After:

{
  "addr.local": "127.0.0.1:4443",
  "addr.remote": "127.0.0.1:50162",
  "cluster_name": "root.teleport.dev",
  "code": "T2000I",
  "ei": 0,
  "event": "session.start",
  "initial_command": [
    ""
  ],
  "login": "gabrielcorado",
  "namespace": "default",
  "proto": "ssh",
  "server_addr": "[::]:3022",
  "server_hostname": "root.teleport.dev",
  "server_id": "b51ef330-73dd-4719-b8aa-8fb0c1c2dd65",
+ "server_labels": {
+   "OS": "Darwin"
+ },
  "session_recording": "node",
  "sid": "46f82471-b834-41a9-a50b-6ee326a692af",
  "size": "141:22",
  "time": "2023-09-21T15:50:32.784Z",
  "uid": "5827ab06-f793-4fae-b680-b067aa02f1f0",
  "user": "alice"
}

@public-teleport-github-review-bot public-teleport-github-review-bot Bot removed the request for review from Joerger September 22, 2023 11:25
@gabrielcorado gabrielcorado added this pull request to the merge queue Sep 22, 2023
Merged via the queue into master with commit 1085bb7 Sep 22, 2023
@gabrielcorado gabrielcorado deleted the gabrielcorado/fix-sess-dynamic-labels branch September 22, 2023 12:48
@public-teleport-github-review-bot
Copy link
Copy Markdown

@gabrielcorado See the table below for backport results.

Branch Result
branch/v12 Create PR
branch/v13 Create PR
branch/v14 Create PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

server-access size/sm support-load This issue generates support load

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants