pam: trigger pam_authenticate on login

[awly]

This will trigger any "auth" PAM modules configured on the system for
teleport. For example, Duo 2FA prompt on each connection.
The module will be able to interact with the user (e.g. print prompts).

Also, make PAM env var propagation consistent for port forwarding
sessions.

Fixes #3929

[awly]

Tested with basic pam_exec.so module and Duo

[russjones]

Can you add test coverage, we have a PAM module we use for testing that can be configured to test if Teleport calls the authentication function. https://github.com/gravitational/teleport/blob/master/modules/pam_teleport/pam_teleport.c

[webvictim]

Some weird test stuff happening here:

Jenkins:

signal: killed
FAIL	github.com/gravitational/teleport/lib/pam	74.098s

It looks like Drone timed out and killed the container too.

[webvictim]

Looks like a memory leak:

[awly]

Looks like a memory leak:

I think it's because we're reading from stdin in some cases and in tests it's set to an infinite nop reader.

Added an io.LimitReader around it for sanity.

@russjones refactored the testing setup and added missing test cases.

[awly]

Need to re-run make install in modules/pam_teleport on the build box to get things passing again

[awly]

ok, I fixed the buildbox build steps, but looks like drone uses a cached version of buildbox.
@webvictim any particular reason we don't use make -C build.assets test here: https://github.com/gravitational/teleport/blob/master/.drone.yml#L77-L85 ?
That would let drone pick up any new changes to buildbox.

[webvictim]

The reason is mostly because Jenkins uses /gopath while Drone uses /go, so the Docker -v commands are different. We also use a shared Go build cache in Drone for speed which Jenkins doesn’t do. I can always modify the Makefile to hold the logic and just call those targets from Drone - the reason I didn’t initially is that for rapid iteration, it can be nice to be able to change the build code without having to cut new tags and backport fixes to release branches.

I am planning to modify the Drone pipeline very soon so that it pulls the buildbox image and rebuilds before running the tests.

With that said, this has actually got me wondering whether the shared build cache could be influencing the test failures in Drone...

[awly]

Looks like #3982 will soon fix the problem.
I'll wait for it to land, thanks @webvictim!

[benarent]

Do Teleport users need to set anything, or is this automatically on with?

  pam:
     enabled: true

[awly]

@benarent automatically on with that config field, yes.
Users do need to configure a PAM auth policy to get any effects from this.

[webvictim]

@awly #3982 is merged; I fixed the Dockerfile merge conflicts for you.

Looks like integration tests are failing.

[benarent]

👍 from me. I tested it with Duo and it worked perfectly. New Video Demo: https://share.getcloudapp.com/YEupwAAl

[awly]

Need approval from @klizhentas or @russjones on this one