Proxy X11 Forwarding Support

[fspmarshall]

Support for X11 forwarding to openssh nodes (WIP):

• Basic forwarding logic to allow recording proxy to correctly handle X11 forwarding requests and channels.
• Make X11 forwarding controllable via RBAC.
• Support the permit-x11-forwarding cert extension.
• Emit audit events for x11 forwarding requests & channels (recording proxy only).

Closes #3401

---

This PR enables minimal X11 forwarding support for teleport clusters by adding the ability to control the permit-X11-forwarding certificate extension via RBAC and giving teleport proxies the ability to correctly handle X11 forwarding requests/channels when in recording mode (X11 forwarding technically already worked when not in recording mode, but wasn't particularly useful without permit-X11-forwarding extension support). In order to leverage X11 forwarding, the user must hold a role with the permit_x11_forwarding option enabled:

kind: role
metadata:
  # ...
spec:
  options:
    permit_x11_forwarding: true
  # ...
version: v3

Since this PR only adds support to the proxy, openssh still needs to be used for both the client and node. Assuming node.example.com were an openssh node and alice had permit_x11_forwarding: true, she could graphically edit the contents of example.txt like so:

$ ssh -X -J proxy.example.com [email protected] gvim example.txt

Which, if the proxy is running in recording mode, would produce an audit event something like this:

{
    "event": "x11",
    "code": "T3008I",
    "user": "alice",
    "time": "2020-06-12T00:43:26Z",
    // ...
}

[ollyg]

just to note that I think the extension is permit-X11-forwarding (uppercase X) and this caught me out! thank you so much for working on this 😄

[awly]

Please add unit and/or integration tests

[awly]

I believe c.Assert is not thread-safe.
Probably easier to keep as is, but the race detector might complain.

[sjackman]

$ tsh version  
Teleport v7.3.3 git: go1.17.2
$ tsh ssh -X remote-host
ERROR: unknown short flag '-X'

How do I use X11 forwarding with tsh ssh?

[ollyg]

Hi @sjackman you can only use -X with the openssh client (so, using ssh instead of tsh ssh). There are other restrictions such as not using recording mode on the proxy, best to get with Gravitational support for the details.