Skip to content

Improving regular SSH port forwarding audit logs#50932

Merged
eriktate merged 1 commit intomasterfrom
eriktate/ssh-port-forwarding-audit-logs
Jan 17, 2025
Merged

Improving regular SSH port forwarding audit logs#50932
eriktate merged 1 commit intomasterfrom
eriktate/ssh-port-forwarding-audit-logs

Conversation

@eriktate
Copy link
Copy Markdown
Contributor

@eriktate eriktate commented Jan 9, 2025

This PR emits some additional events for SSH port forwarding and adds some context around local/remote when possible. The emitted events should look like the following:

  • Local port forwarding logs a start and end event per connection.
  • Remote port forwarding for the regular SSH server logs a start and end event per forwarding session as well as per connection.
  • Remote and local port forwarding for the forward SSH server log an event for everything, but the session-level events do not differentiate between remote/local. There are some small issues with properly capturing event data for the forward server, so I've not included the new events in this PR. I plan on addressing this in a follow up

Every event should contain the remote, local, and target address where applicable. For remote forwarding, session-level events will show the requester as the remote address whereas connection-level events should show the client address initiating the connection.

changelog: Added more granular audit logging surrounding SSH port forwarding

@github-actions github-actions Bot added audit-log Issues related to Teleports Audit Log size/md labels Jan 9, 2025
Comment thread lib/sshutils/tcpip_test.go Outdated
Comment thread lib/srv/ctx.go Outdated
Comment thread lib/srv/forward/sshserver.go Outdated
Comment thread lib/srv/forward/sshserver.go Outdated
Comment thread lib/srv/regular/sshserver.go Outdated
Comment thread lib/srv/regular/sshserver.go Outdated
@eriktate eriktate force-pushed the eriktate/ssh-port-forwarding-audit-logs branch from ef0154f to f51fada Compare January 14, 2025 02:39
@rosstimothy
Copy link
Copy Markdown
Contributor

rosstimothy commented Jan 14, 2025

It looks like the events are now being emitted in the right places, though I'm seeing a few things that still need to be addressed.

The logs are spewing the following when emitting events:

ERRO  Attempted to convert dynamic event of unknown type into protobuf event. event_type:port.local events/dynamic.go:483

The web ui is unable to render the forwarding events:

image

@eriktate eriktate force-pushed the eriktate/ssh-port-forwarding-audit-logs branch 5 times, most recently from 3d0ccd6 to fbb1383 Compare January 15, 2025 21:22
Comment thread lib/srv/regular/sshserver_test.go Outdated
Comment thread lib/srv/regular/sshserver_test.go Outdated
Comment thread lib/srv/regular/sshserver_test.go Outdated
@rosstimothy
Copy link
Copy Markdown
Contributor

Can you please update the PR title and description to reflect that this is not updating events emitted by the forwarding server and that will happen in the future?

@eriktate eriktate force-pushed the eriktate/ssh-port-forwarding-audit-logs branch from 16d5cf4 to 94fefc5 Compare January 16, 2025 16:58
@eriktate eriktate changed the title Improving SSH port forwarding audit logs Improving regular SSH port forwarding audit logs Jan 16, 2025
@eriktate eriktate force-pushed the eriktate/ssh-port-forwarding-audit-logs branch 4 times, most recently from 7dad152 to 048518e Compare January 16, 2025 18:03
@eriktate eriktate force-pushed the eriktate/ssh-port-forwarding-audit-logs branch from 835ec45 to bf6fcae Compare January 16, 2025 23:10
@eriktate eriktate added this pull request to the merge queue Jan 17, 2025
Merged via the queue into master with commit 707c2ac Jan 17, 2025
@eriktate eriktate deleted the eriktate/ssh-port-forwarding-audit-logs branch January 17, 2025 01:23
@public-teleport-github-review-bot
Copy link
Copy Markdown

@eriktate See the table below for backport results.

Branch Result
branch/v15 Failed
branch/v16 Failed
branch/v17 Failed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

audit-log Issues related to Teleports Audit Log backport/branch/v17 size/md

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants