Skip to content

[vnet] feat: accept incoming SSH connections#55155

Merged
nklaassen merged 1 commit intomasterfrom
nklaassen/vnet-ssh-accept
May 31, 2025
Merged

[vnet] feat: accept incoming SSH connections#55155
nklaassen merged 1 commit intomasterfrom
nklaassen/vnet-ssh-accept

Conversation

@nklaassen
Copy link
Copy Markdown
Contributor

@nklaassen nklaassen commented May 27, 2025 •
edited
Loading

This PR is the next step in the implementation of VNet SSH (RFD).

This PR makes the sshHandler for each address generate an ssh host certificate the first time it is connected to. That host certificate is then used to terminate/accept incoming SSH connections. As described in the RFD, a single SSH user public key is accepted, in a later PR that key will be persisted to $TELEPORT_HOME/id_vnet so that clients can use it.

If you comment out the line that checks the user SSH key, you can now test VNet SSH with a real SSH client as long as you configure it to trust any host key. At this point authentication should complete successfully but the connection will be closed immediately:

$ ssh nic@node-iot.one.private
Warning: Permanently added 'node-iot.one.private' (ED25519) to the list of known hosts.
Connection to node-iot.one.private closed by remote host.
Connection to node-iot.one.private closed.

Parent PR: #55087
Child PR: #55156

@nklaassen nklaassen added no-changelog Indicates that a PR does not require a changelog entry vnet backport/branch/v17 and removed size/md labels May 27, 2025
marcoandredinis
marcoandredinis approved these changes May 27, 2025
View reviewed changes
Comment thread lib/vnet/ssh_handler.go Outdated
Comment thread lib/vnet/ssh_handler.go Outdated
@nklaassen nklaassen force-pushed the nklaassen/vnet-ssh-accept branch 2 times, most recently from 26bc3f0 to b8ffacf Compare May 27, 2025 19:26
@public-teleport-github-review-bot public-teleport-github-review-bot Bot removed the request for review from ryanclark May 28, 2025 11:03
This was referenced May 28, 2025
Merged
Merged
@nklaassen nklaassen force-pushed the nklaassen/vnet-ssh-accept branch from b8ffacf to 9e90d3b Compare May 28, 2025 18:52
espadolini
espadolini reviewed May 29, 2025
View reviewed changes
Comment thread lib/vnet/ssh_handler.go Outdated
Comment thread lib/vnet/ssh_handler.go Outdated
Comment thread lib/vnet/ssh_handler.go Outdated
Comment thread lib/vnet/ssh_handler.go Outdated
Comment thread lib/vnet/ssh_handler.go Outdated
Comment thread lib/vnet/ssh_handler.go Outdated
Comment thread lib/vnet/ssh_handler.go
@nklaassen nklaassen requested a review from espadolini May 29, 2025 17:44
Base automatically changed from nklaassen/vnet-ssh-dial to master May 31, 2025 02:16
@nklaassen nklaassen force-pushed the nklaassen/vnet-ssh-accept branch from 9a7ae67 to 8cbcd53 Compare May 31, 2025 04:15
@nklaassen nklaassen enabled auto-merge May 31, 2025 04:28
@nklaassen nklaassen force-pushed the nklaassen/vnet-ssh-accept branch from 8cbcd53 to a103945 Compare May 31, 2025 14:44
@nklaassen nklaassen added this pull request to the merge queue May 31, 2025
Merged via the queue into master with commit 1ef6c32 May 31, 2025
39 checks passed
@nklaassen nklaassen deleted the nklaassen/vnet-ssh-accept branch May 31, 2025 15:25
nklaassen added a commit that referenced this pull request May 31, 2025
@nklaassen
[v18][vnet] feat: accept incoming SSH connections
19f5dce 
Backport #55155 to branch/v18
nklaassen added a commit that referenced this pull request May 31, 2025
@nklaassen
[v17][vnet] feat: accept incoming SSH connections
a8c4fe6 
Backport #55155 to branch/v17
github-merge-queue Bot pushed a commit that referenced this pull request Jul 22, 2025
@nklaassen @ravicious @gzdunek
[v17][vnet] feat: VNet SSH (#55313)
37b7e9b 
* [v17][vnet] feat: TCP dial to SSH targets

Backport #55087 to branch/v17

* [v17][vnet] feat: accept incoming SSH connections

Backport #55155 to branch/v17

* [v17][vnet] feat: forward SSH connections to target

Backport #55156 to branch/v17

* [v17][vnet] feat: write VNet SSH keys to TELEPORT_HOME

Backport #55228 to branch/v17

* [v17][vnet] feat: write OpenSSH-compatible config file for VNet SSH

Backport #55239 to branch/v17

* [v17][vnet] fix: support <hostname>.<leaf-cluster> for VNet SSH

Backport #55688 to branch/v17

* fix BlockUntil API for backport

* [v17][vnet] feat: add "Connect with VNet" button to SSH servers

Backport #55623 to branch/v17

* [v17][vnet] feat: support VNet SSH when cluster name does not match proxy public addr

Backport #55655 to branch/v17

* [v17][vnet] feat: add SSH configuration diagnostic

Backport #55594 to branch/v17

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>

* [v17][vnet] feat: show SSH status in VNet slider

Backport #55755 to branch/v17

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>

* [v17][vnet] feat: support proxy recording mode with VNet SSH

Backport #55788 to branch/v17

* [v17][vnet] feat: support diag checks on windows

Backport #55856 to branch/v17

* [v17] fix: data race in vnet.TestSSH

Backport #55980 to branch/v17

* [v17][vnet] feat: mention SSH on VNet info page

Backport #55973 to branch/v17

* [v17][vnet] feat: serve DNS on IPv4

Backport #55539 to branch/v17

* [v17][vnet] fix: close proxied channel only after data and requests are complete

Backport #56020 to branch/v17

* [v17][vnet] feat: automatic SSH client configuration

Backport #55923 to branch/v17

* VNet docs: Provide clear instructions for getting debug logs (#56068)

* VNet diag notification: Do not show button to open report if there's no workspace selected (#56067)

* VNet diag report: Don't show button in notification if there's no workspace

* Replace deprecated MutableRefObject with RefObject

* Make openReport not depend on value of rootClusterUri

Otherwise the effect that uses setInterval re-runs whenever the user
switches to another workspace.

* [v17][vnet] feat: automatic SSH client configuration in Connect

Backport #55924 to branch/v17

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>

* [v17][vnet] fix: avoid empty host matchers in generated SSH config

Backport #56103 to branch/v17

* avoid t.Context() pre go1.24

* fix cspell lint

* [v17][docs] VNet SSH

Backport #56147 to branch/v17

* [v17][vnet] feat: SSH usage reporting

Backport #56537 to branch/v17

* [v17][vnet] fix: mask default IP route on windows

Backport #56957 to branch/v17

---------

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>
github-merge-queue Bot pushed a commit that referenced this pull request Jul 22, 2025
@nklaassen @ravicious @gzdunek
[v18][vnet] feat: VNet SSH (#55311)
dbaeee7 
* [v18][vnet] feat: TCP dial to SSH targets

Backport #55087 to branch/v18

* [v18][vnet] feat: accept incoming SSH connections

Backport #55155 to branch/v18

* [v18][vnet] feat: forward SSH connections to target

Backport #55156 to branch/v18

* [v18][vnet] feat: write VNet SSH keys to TELEPORT_HOME

Backport #55228 to branch/v18

* [v18][vnet] feat: write OpenSSH-compatible config file for VNet SSH

Backport #55239 to branch/v18

* [v18][vnet] fix: support <hostname>.<leaf-cluster> for VNet SSH

Backport #55688 to branch/v18

* [v18][vnet] feat: add "Connect with VNet" button to SSH servers

Backport #55623 to branch/v18

* fix test in backport

* [v18][vnet] feat: support VNet SSH when cluster name does not match proxy public addr

Backport #55655 to branch/v18

* [v18][vnet] feat: add SSH configuration diagnostic

Backport #55594 to branch/v18

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>

* [v18][vnet] feat: show SSH status in VNet slider

Backport #55755 to branch/v18

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>

* [v18][vnet] feat: support proxy recording mode with VNet SSH

Backport #55788 to branch/v18

* [v18][vnet] feat: support diag checks on windows

Backport #55856 to branch/v18

* [v18] fix: data race in vnet.TestSSH

Backport #55980 to branch/v18

* [v18][vnet] feat: mention SSH on VNet info page

Backport #55973 to branch/v18

* [v18][vnet] feat: serve DNS on IPv4

Backport #55539 to branch/v18

* [v18][vnet] fix: close proxied channel only after data and requests are complete

Backport #56020 to branch/v18

* [v18][vnet] feat: automatic SSH client configuration

Backport #55923 to branch/v18

* VNet diag notification: Do not show button to open report if there's no workspace selected (#56067)

* VNet diag report: Don't show button in notification if there's no workspace

* Replace deprecated MutableRefObject with RefObject

* Make openReport not depend on value of rootClusterUri

Otherwise the effect that uses setInterval re-runs whenever the user
switches to another workspace.

* [v18][vnet] feat: automatic SSH client configuration in Connect

Backport #55924 to branch/v18

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>

* [v18][vnet] fix: avoid empty host matchers in generated SSH config

Backport #56103 to branch/v18

* [v18][docs] VNet SSH

Backport #56147 to branch/v18

* [v18][docs] add VNet warnings

Backport #56601 to branch/v18

* [v18][vnet] feat: SSH usage reporting

Backport #56537 to branch/v18

* [v18][vnet] fix: mask default IP route on windows

Backport #56957 to branch/v18

---------

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marcoandredinis marcoandredinis marcoandredinis approved these changes

@espadolini espadolini espadolini approved these changes

@strideynet strideynet strideynet approved these changes

Assignees

No one assigned

Labels

no-changelog Indicates that a PR does not require a changelog entry vnet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@nklaassen @marcoandredinis @espadolini @strideynet