Skip to content

emit audit events when SFTP or SCP commands are blocked#36977

Merged
capnspacehook merged 5 commits intomasterfrom
capnspacehook/file-copying-blocked-audit
Jan 27, 2024
Merged

emit audit events when SFTP or SCP commands are blocked#36977
capnspacehook merged 5 commits intomasterfrom
capnspacehook/file-copying-blocked-audit

Conversation

@capnspacehook
Copy link
Copy Markdown
Contributor

@capnspacehook capnspacehook commented Jan 20, 2024

Fixes #36820.

changelog: emit audit events when SFTP or SCP commands are blocked

@github-actions
Copy link
Copy Markdown
Contributor

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

Comment thread web/packages/teleport/src/services/audit/makeEvent.ts Outdated
type: 'sftp',
desc: 'SFTP Disallowed',
format: ({ user, path, ...rest }) =>
`User [${user}] was blocked from creating a SFTP session on node [${
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
`User [${user}] was blocked from creating a SFTP session on node [${
`User [${user}] was blocked from creating an SFTP session on node [${

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't it be 'a' since SFTP starts with a consonant, 'S'?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In case of acronyms, I was taught to use a/an depending on whether the way you pronounce the acronym starts with a consonant or a vowel sound.

https://www.scribbr.com/commonly-confused-words/a-vs-an/#acronyms

An MRI [em-arr-eye] machine uses magnets to take detailed scans of your organs.

It can be expensive to pay for an SAT [ess-ay-tee] prep course out of pocket.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TIL, thanks

@zmb3
Copy link
Copy Markdown
Collaborator

zmb3 commented Jan 25, 2024

@capnspacehook let's address Rafal's grammar suggestion and get this merged. V15 is coming soon!

Comment thread web/packages/teleport/src/services/audit/makeEvent.ts Outdated
Copy link
Copy Markdown
Collaborator

@zmb3 zmb3 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM once you fix the unused import

@capnspacehook capnspacehook added this pull request to the merge queue Jan 26, 2024
@github-merge-queue github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jan 26, 2024
@capnspacehook capnspacehook added this pull request to the merge queue Jan 27, 2024
Merged via the queue into master with commit 79583f7 Jan 27, 2024
@capnspacehook capnspacehook deleted the capnspacehook/file-copying-blocked-audit branch January 27, 2024 00:29
@public-teleport-github-review-bot
Copy link
Copy Markdown

@capnspacehook See the table below for backport results.

Branch Result
branch/v13 Create PR
branch/v14 Create PR
branch/v15 Create PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

audit-log Issues related to Teleports Audit Log server-access sftp Issues related to Teleport's SFTP implementation size/md ui

Projects

None yet

Development

Successfully merging this pull request may close these issues.

No audit log entries indicating SFTP failue due to RBAC restrictions

4 participants