Skip to content

[vnet] feat: forward SSH connections to target#55156

Merged
nklaassen merged 1 commit intomasterfrom
nklaassen/vnet-ssh-forward
May 31, 2025
Merged

[vnet] feat: forward SSH connections to target#55156
nklaassen merged 1 commit intomasterfrom
nklaassen/vnet-ssh-forward

Conversation

@nklaassen
Copy link
Copy Markdown
Contributor

@nklaassen nklaassen commented May 27, 2025 •
edited
Loading

This PR is the next step in the implementation of VNet SSH (RFD).

This PR implements forwarding the incoming SSH connection to the target server. The bulk of the new logic is about getting an ssh.ClientConfig that can initiate an SSH connection to the target over the TCP connection that was already established in a previous PR. This implementation works whether or not per-session MFA is required.

If you comment out the line that checks the user SSH key, you can now test VNet SSH with a real SSH client as long as you configure it to trust any host key. At this point the connection to the target host 100% works, you can run commands, the session will be recorded, and per-session MFA works fine.

Nics-MacBook-Pro:teleport nic$ ssh nic@node-iot.one.private
Warning: Permanently added 'node-iot.one.private' (ED25519) to the list of known hosts.
Nics-MacBook-Pro:~ nic$ date
Mon 26 May 2025 18:01:51 PDT
Nics-MacBook-Pro:~ nic$ exit
logout
Connection to node-iot.one.private closed.

Subsequent PRs will automatically configure SSH clients to use and trust the correct keys so that this works seamlessly.

Parent PR: #55155
Child PR: #55228

@nklaassen nklaassen added no-changelog Indicates that a PR does not require a changelog entry vnet backport/branch/v17 labels May 27, 2025
@github-actions github-actions Bot requested review from Joerger and greedy52 May 27, 2025 01:08
@nklaassen nklaassen force-pushed the nklaassen/vnet-ssh-accept branch 2 times, most recently from 26bc3f0 to b8ffacf Compare May 27, 2025 19:26
@nklaassen nklaassen force-pushed the nklaassen/vnet-ssh-forward branch from 5061431 to 8fb37f4 Compare May 27, 2025 19:27
@nklaassen nklaassen mentioned this pull request May 28, 2025
Merged
@nklaassen nklaassen force-pushed the nklaassen/vnet-ssh-accept branch from b8ffacf to 9e90d3b Compare May 28, 2025 18:52
@nklaassen nklaassen force-pushed the nklaassen/vnet-ssh-forward branch from a4dc481 to 77dfb59 Compare May 28, 2025 18:52
@nklaassen nklaassen mentioned this pull request May 28, 2025
Merged
@nklaassen nklaassen force-pushed the nklaassen/vnet-ssh-forward branch from 77dfb59 to 6f0f5a2 Compare May 29, 2025 17:53
espadolini
espadolini reviewed May 30, 2025
View reviewed changes
Comment thread lib/vnet/client_application_service.go
Comment thread proto/teleport/lib/vnet/v1/client_application_service.proto Outdated
Comment thread lib/vnet/ssh_proxy.go
reqs <-chan *ssh.Request
}

// Close closes the connection and drains all channels.
Copy link
Copy Markdown
Contributor

@espadolini espadolini May 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we should ever get to this point without goroutines already handling requests and channels, right?

Copy link
Copy Markdown
Contributor Author

@nklaassen nklaassen May 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not in this file but ssh_handler.go now calls this on the client conn if it fails to establish the server conn

Comment thread lib/vnet/ssh_proxy.go Outdated
Comment thread lib/vnet/ssh_provider.go
Comment thread lib/vnet/ssh_handler.go Outdated
Comment thread lib/vnet/ssh_handler.go Outdated
@nklaassen nklaassen force-pushed the nklaassen/vnet-ssh-forward branch from 6f0f5a2 to 93a4920 Compare May 30, 2025 17:56
@nklaassen nklaassen force-pushed the nklaassen/vnet-ssh-accept branch from 9a7ae67 to 8cbcd53 Compare May 31, 2025 04:14
@nklaassen nklaassen force-pushed the nklaassen/vnet-ssh-forward branch from bb7d9ec to 6fc6076 Compare May 31, 2025 04:16
@nklaassen nklaassen force-pushed the nklaassen/vnet-ssh-accept branch from 8cbcd53 to a103945 Compare May 31, 2025 14:44
Base automatically changed from nklaassen/vnet-ssh-accept to master May 31, 2025 15:25
@nklaassen nklaassen force-pushed the nklaassen/vnet-ssh-forward branch from 6fc6076 to 5f37bd7 Compare May 31, 2025 16:03
@nklaassen nklaassen enabled auto-merge May 31, 2025 16:03
@nklaassen nklaassen added this pull request to the merge queue May 31, 2025
Merged via the queue into master with commit 4fb2fed May 31, 2025
41 checks passed
@nklaassen nklaassen deleted the nklaassen/vnet-ssh-forward branch May 31, 2025 16:44
nklaassen added a commit that referenced this pull request Jun 1, 2025
@nklaassen
[v18][vnet] feat: forward SSH connections to target
4517ec5 
Backport #55156 to branch/v18
nklaassen added a commit that referenced this pull request Jun 1, 2025
@nklaassen
[v17][vnet] feat: forward SSH connections to target
b9dda7f 
Backport #55156 to branch/v17
github-merge-queue Bot pushed a commit that referenced this pull request Jul 22, 2025
@nklaassen @ravicious @gzdunek
[v17][vnet] feat: VNet SSH (#55313)
37b7e9b 
* [v17][vnet] feat: TCP dial to SSH targets

Backport #55087 to branch/v17

* [v17][vnet] feat: accept incoming SSH connections

Backport #55155 to branch/v17

* [v17][vnet] feat: forward SSH connections to target

Backport #55156 to branch/v17

* [v17][vnet] feat: write VNet SSH keys to TELEPORT_HOME

Backport #55228 to branch/v17

* [v17][vnet] feat: write OpenSSH-compatible config file for VNet SSH

Backport #55239 to branch/v17

* [v17][vnet] fix: support <hostname>.<leaf-cluster> for VNet SSH

Backport #55688 to branch/v17

* fix BlockUntil API for backport

* [v17][vnet] feat: add "Connect with VNet" button to SSH servers

Backport #55623 to branch/v17

* [v17][vnet] feat: support VNet SSH when cluster name does not match proxy public addr

Backport #55655 to branch/v17

* [v17][vnet] feat: add SSH configuration diagnostic

Backport #55594 to branch/v17

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>

* [v17][vnet] feat: show SSH status in VNet slider

Backport #55755 to branch/v17

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>

* [v17][vnet] feat: support proxy recording mode with VNet SSH

Backport #55788 to branch/v17

* [v17][vnet] feat: support diag checks on windows

Backport #55856 to branch/v17

* [v17] fix: data race in vnet.TestSSH

Backport #55980 to branch/v17

* [v17][vnet] feat: mention SSH on VNet info page

Backport #55973 to branch/v17

* [v17][vnet] feat: serve DNS on IPv4

Backport #55539 to branch/v17

* [v17][vnet] fix: close proxied channel only after data and requests are complete

Backport #56020 to branch/v17

* [v17][vnet] feat: automatic SSH client configuration

Backport #55923 to branch/v17

* VNet docs: Provide clear instructions for getting debug logs (#56068)

* VNet diag notification: Do not show button to open report if there's no workspace selected (#56067)

* VNet diag report: Don't show button in notification if there's no workspace

* Replace deprecated MutableRefObject with RefObject

* Make openReport not depend on value of rootClusterUri

Otherwise the effect that uses setInterval re-runs whenever the user
switches to another workspace.

* [v17][vnet] feat: automatic SSH client configuration in Connect

Backport #55924 to branch/v17

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>

* [v17][vnet] fix: avoid empty host matchers in generated SSH config

Backport #56103 to branch/v17

* avoid t.Context() pre go1.24

* fix cspell lint

* [v17][docs] VNet SSH

Backport #56147 to branch/v17

* [v17][vnet] feat: SSH usage reporting

Backport #56537 to branch/v17

* [v17][vnet] fix: mask default IP route on windows

Backport #56957 to branch/v17

---------

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>
github-merge-queue Bot pushed a commit that referenced this pull request Jul 22, 2025
@nklaassen @ravicious @gzdunek
[v18][vnet] feat: VNet SSH (#55311)
dbaeee7 
* [v18][vnet] feat: TCP dial to SSH targets

Backport #55087 to branch/v18

* [v18][vnet] feat: accept incoming SSH connections

Backport #55155 to branch/v18

* [v18][vnet] feat: forward SSH connections to target

Backport #55156 to branch/v18

* [v18][vnet] feat: write VNet SSH keys to TELEPORT_HOME

Backport #55228 to branch/v18

* [v18][vnet] feat: write OpenSSH-compatible config file for VNet SSH

Backport #55239 to branch/v18

* [v18][vnet] fix: support <hostname>.<leaf-cluster> for VNet SSH

Backport #55688 to branch/v18

* [v18][vnet] feat: add "Connect with VNet" button to SSH servers

Backport #55623 to branch/v18

* fix test in backport

* [v18][vnet] feat: support VNet SSH when cluster name does not match proxy public addr

Backport #55655 to branch/v18

* [v18][vnet] feat: add SSH configuration diagnostic

Backport #55594 to branch/v18

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>

* [v18][vnet] feat: show SSH status in VNet slider

Backport #55755 to branch/v18

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>

* [v18][vnet] feat: support proxy recording mode with VNet SSH

Backport #55788 to branch/v18

* [v18][vnet] feat: support diag checks on windows

Backport #55856 to branch/v18

* [v18] fix: data race in vnet.TestSSH

Backport #55980 to branch/v18

* [v18][vnet] feat: mention SSH on VNet info page

Backport #55973 to branch/v18

* [v18][vnet] feat: serve DNS on IPv4

Backport #55539 to branch/v18

* [v18][vnet] fix: close proxied channel only after data and requests are complete

Backport #56020 to branch/v18

* [v18][vnet] feat: automatic SSH client configuration

Backport #55923 to branch/v18

* VNet diag notification: Do not show button to open report if there's no workspace selected (#56067)

* VNet diag report: Don't show button in notification if there's no workspace

* Replace deprecated MutableRefObject with RefObject

* Make openReport not depend on value of rootClusterUri

Otherwise the effect that uses setInterval re-runs whenever the user
switches to another workspace.

* [v18][vnet] feat: automatic SSH client configuration in Connect

Backport #55924 to branch/v18

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>

* [v18][vnet] fix: avoid empty host matchers in generated SSH config

Backport #56103 to branch/v18

* [v18][docs] VNet SSH

Backport #56147 to branch/v18

* [v18][docs] add VNet warnings

Backport #56601 to branch/v18

* [v18][vnet] feat: SSH usage reporting

Backport #56537 to branch/v18

* [v18][vnet] fix: mask default IP route on windows

Backport #56957 to branch/v18

---------

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@espadolini espadolini espadolini approved these changes

@rosstimothy rosstimothy rosstimothy approved these changes

Assignees

No one assigned

Labels

no-changelog Indicates that a PR does not require a changelog entry size/md vnet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@nklaassen @espadolini @rosstimothy