Expose reverse tunnels to users by kontsevoy · Pull Request #455 · gravitational/teleport

kontsevoy · 2016-06-12T21:58:41Z

This PR adds:

New configuration setting: "trusted_clusters" in teleport.yaml
Documentation for it
"Nomenclature" section for online docs
clusters command for tsh
--cluster flag for tsh

This PR fixes & changes:

tctl auth ls command now shows local vs "trusted" clusters.
tctl auth export uses different format for exporting CA keys, and it only exports local keys.
Better user-facing error messages and more user-friendly logging.
A couple of configuration bugs.

Fixes #437
Fixes #443

Potentially Breaking Changes

tctl auth export now uses "known_hosts" format for both user and host CAs. Does this break exporting keys and using them with OpenSSH?
"auth_servers" configuration value now uses "host:port" format instead of "tcp://host:port".

Undocumented Changes

It is now possible to specify * (wildcard) as "allowed logins" for a user CA. This is how you can say "trust every key signed by this CA". I have not documented it yet.

1. tctl auth export now dumps both user&host keys if --type key is missing 2. created fixtures for testing key imports: they're in fixtures/trusted_clusters 3. configuration parser reads "trusted_clusters" files expecting the output of tctl auth export

- Friendly error messages when parsing configuration and establishing connection - Bugs related to "first start" vs subsequent starts (reverse tunnells added to YAML file won't be seen upon restart) - Nicer logging

`tctl auth` now treats local CAs differently from "trusted CAs": - `tctl auth ls` prints two tables: local authorities and trusted authorities. - `tctl auth export` only exports local keys Also, when showing "allowed logins" for each CA, tctl now prints "N/A" for host CAs and user-friendly "<nobody>" or "<everyone>"

`tsh` has always supported reverse tunnels via undocumented "sites" command. This commit: 1. Renames "sites" to "clusters" to be consistent with the rest of Teleport naming conventions 2. Adds --cluster flag to `tsh ssh` 3. Updates the User Manual in the documentation dir Refs #437

AKA "trusted clusters"

klizhentas · 2016-06-12T22:02:38Z

+
+|Concept   | Description
+|----------|------------
+|Node      | Synonym to "server" or "computer", something one can "SSH to". A node must be running `teleport` daemon running with "node" role/service turned on.


or container

klizhentas · 2016-06-12T22:06:23Z

I'll dig in more detail tomorrow

klizhentas · 2016-06-12T22:07:24Z

tests fail:

--- PASS: TestClientAPI (0.69s)
PASS
coverage: 16.6% of statements
ok      github.com/gravitational/teleport/lib/client    1.771s  coverage: 16.6% of statements
=== RUN   TestConfig

----------------------------------------------------------------------
FAIL: config_test.go:216: ConfigTestSuite.TestTrustedClusters

config_test.go:228:
    c.Assert(err, check.IsNil)
... value *trace.TraceErr = &trace.TraceErr{Err:(*errors.errorString)(0xc82025c880), Traces:trace.Traces{trace.Trace{Path:"github.com/gravitational/teleport/lib/config/_test/_obj_test/configuration.go", Func:"github.com/gravitational/teleport/lib/config.readTrustedClusters", Line:494}}, Message:"", DebugMessage:""} ("reading trusted cluster keys: open ../../fixtures/trusted_clusters/cluster-a: no such file or directory")

OOPS: 5 passed, 1 FAILED

Refs #450 (first error)

klizhentas · 2016-06-13T18:15:21Z

-				if err := asrv.UpsertReverseTunnel(tunnel, 0); err != nil {
-					return nil, nil, trace.Wrap(err)
-				}
+	if len(cfg.ReverseTunnels) != 0 {


so if there's no firstStart logic here it means there's no way for me to preconfigure tunnels and then later remove them.

klizhentas · 2016-06-13T18:16:07Z

 	if len(fc.AuthServers) > 0 {
 		cfg.AuthServers = make([]utils.NetAddr, 0, len(fc.AuthServers))
 		for _, as := range fc.AuthServers {
-			addr, err := utils.ParseAddr(as)


utils.ParseAddr supports both tcp:// and simple host:port format, no need to introduce a breaking change here

klizhentas · 2016-06-13T23:25:44Z

lgtm

* first version * Fix build * Fix * fixes * add app context * Add Navigator * more screens * add cluster * grpc * Add gateways * add node-pty * add tshd daemon * add main process quick reload * add tsh access * Use default terminal shell and add context menu (gravitational#444) * node-pty errors * Fix build process and include `tsh` in the package (gravitational#451) * Use single `package.json` config * Include `tsh` in app package * fix linux package target * add global search * fix tsc (errors) build step * Add mocks * Add logging to file (gravitational#455) * minor cleanups * Add keyboard shortcuts service (gravitational#462) * add sync statuses for teleport resources * add teleterm icon (gravitational#470) * Fix dev reloads of main process * minore bug fixes * implement auth * update webpack configs to v5 (gravitational#492) * arrange the cards evenly depending on the available space & add drag and drop (gravitational#486) * fix text truncation on tabs * Add logout and cluster removal * Add context menu to clusters (gravitational#500) * Add tabs shortcuts & open new tab basing on active tab (gravitational#495) * Make xterm understand resize sequence (gravitational#507) * use `Immer` in teleterm store (gravitational#516) * Add apps and kubes * Teleterm bugfixes (gravitational#519) * add command palette * Replace Gateways with Connections * add tc * Clean up * Add basic config service (gravitational#526) * add fonts config (gravitational#528) * Fix resize bug * Minor teleterm fixes (gravitational#531) * remove exit code checking before closing a tab * prevent closing `home` tab * Fix crashing errors * Remove Roles and Activities * Remove GlobalSearch * Add context menu to tab items (gravitational#533) * make quickIInput always visible on top * Add workspace service (gravitational#538) * Add recently opened documents to workspace (gravitational#547) * add recently opened documents to workspace * review fixes * review fixes * add `ClusterConnect` component * remove the `close` item and electron help items from the app menu (gravitational#560) * improve navigator behaviour (gravitational#565) * improve navigator behaviour * Add new connection handling * Add username to gateways * add kube connect command * Gateway should render instructions per DB protocol * Address design changes Co-authored-by: gzdunek <gzdunek@users.noreply.github.com>

* first version * Fix build * Fix * fixes * add app context * Add Navigator * more screens * add cluster * grpc * Add gateways * add node-pty * add tshd daemon * add main process quick reload * add tsh access * Use default terminal shell and add context menu (#444) * node-pty errors * Fix build process and include `tsh` in the package (#451) * Use single `package.json` config * Include `tsh` in app package * fix linux package target * add global search * fix tsc (errors) build step * Add mocks * Add logging to file (#455) * minor cleanups * Add keyboard shortcuts service (#462) * add sync statuses for teleport resources * add teleterm icon (#470) * Fix dev reloads of main process * minore bug fixes * implement auth * update webpack configs to v5 (#492) * arrange the cards evenly depending on the available space & add drag and drop (#486) * fix text truncation on tabs * Add logout and cluster removal * Add context menu to clusters (#500) * Add tabs shortcuts & open new tab basing on active tab (#495) * Make xterm understand resize sequence (#507) * use `Immer` in teleterm store (#516) * Add apps and kubes * Teleterm bugfixes (#519) * add command palette * Replace Gateways with Connections * add tc * Clean up * Add basic config service (#526) * add fonts config (#528) * Fix resize bug * Minor teleterm fixes (#531) * remove exit code checking before closing a tab * prevent closing `home` tab * Fix crashing errors * Remove Roles and Activities * Remove GlobalSearch * Add context menu to tab items (#533) * make quickIInput always visible on top * Add workspace service (#538) * Add recently opened documents to workspace (#547) * add recently opened documents to workspace * review fixes * review fixes * add `ClusterConnect` component * remove the `close` item and electron help items from the app menu (#560) * improve navigator behaviour (#565) * improve navigator behaviour * Add new connection handling * Add username to gateways * add kube connect command * Gateway should render instructions per DB protocol * Address design changes Co-authored-by: gzdunek <gzdunek@users.noreply.github.com>

kontsevoy added 16 commits June 1, 2016 13:22

Intermediate commit

f4a4fa6

Merge branch 'ev/296' into ev/tunnels

44ff78a

Merge remote-tracking branch 'origin/master' into ev/tunnels

f75a1c8

Intermediate commit

d928ff0

Merge remote-tracking branch 'origin/master' into ev/tunnels

7c0897a

Merge branch 'master' into ev/tunnels

e6efb87

Minor bugs regarding reverse tunnels

126a9e9

- Friendly error messages when parsing configuration and establishing connection - Bugs related to "first start" vs subsequent starts (reverse tunnells added to YAML file won't be seen upon restart) - Nicer logging

Nicer error messages

7caccf2

New format for "trusted_clusters" configuration

196400f

Merge remote-tracking branch 'origin/master' into ev/tunnels

a71af86

Documented reverse tunnels

3c1892c

AKA "trusted clusters"

Re-enabled logins

eb41457

Fixed tests

7f65ed7

kontsevoy assigned klizhentas Jun 12, 2016

klizhentas reviewed Jun 12, 2016
View reviewed changes

kontsevoy added 2 commits June 12, 2016 15:11

Fixed tests

18021f5

More changes to documentation, incorporating Sasha edits

05d0309

kontsevoy force-pushed the ev/tunnels branch from 503a27e to 05d0309 Compare June 12, 2016 22:21

kontsevoy added 2 commits June 12, 2016 15:54

Nicer error message when parsing trusted_clusters config

1bcd32e

Nicer parsing of "auth_servers" config option

45f1986

kontsevoy force-pushed the ev/tunnels branch from 5581aae to 45f1986 Compare June 12, 2016 23:30

Increased test robustness

ad2d07c

Refs #450 (first error)

klizhentas reviewed Jun 13, 2016
View reviewed changes

OSX compatibility fix

6cbca23

kontsevoy added 2 commits June 13, 2016 17:12

Code review improvements

8a6ec35

Merge remote-tracking branch 'origin/master' into ev/tunnels

79dca15

kontsevoy merged commit 756b832 into master Jun 14, 2016

kontsevoy deleted the ev/tunnels branch June 17, 2016 05:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Expose reverse tunnels to users#455

Expose reverse tunnels to users#455
kontsevoy merged 24 commits intomasterfrom
ev/tunnels

kontsevoy commented Jun 12, 2016 •

edited

Loading

Uh oh!

klizhentas Jun 12, 2016

Uh oh!

klizhentas commented Jun 12, 2016

Uh oh!

klizhentas commented Jun 12, 2016

Uh oh!

klizhentas Jun 13, 2016

Uh oh!

klizhentas Jun 13, 2016

Uh oh!

klizhentas commented Jun 13, 2016

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

kontsevoy commented Jun 12, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Potentially Breaking Changes

Undocumented Changes

Uh oh!

klizhentas Jun 12, 2016

Choose a reason for hiding this comment

Uh oh!

klizhentas commented Jun 12, 2016

Uh oh!

klizhentas commented Jun 12, 2016

Uh oh!

klizhentas Jun 13, 2016

Choose a reason for hiding this comment

Uh oh!

klizhentas Jun 13, 2016

Choose a reason for hiding this comment

Uh oh!

klizhentas commented Jun 13, 2016

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kontsevoy commented Jun 12, 2016 •

edited

Loading