fix sftp via proxy recording mode#58951
Merged
fspmarshall merged 1 commit intomasterfrom Sep 10, 2025
Merged
Conversation
atburke
approved these changes
Sep 9, 2025
rosstimothy
approved these changes
Sep 9, 2025
Contributor
rosstimothy
left a comment
There was a problem hiding this comment.
I've tested this with the reproduction steps stated in the issue before and after this change and can confirm that upload and downloading of files works via the UI and the command line in proxy recording and node recording modes.
zmb3
approved these changes
Sep 9, 2025
4ad7221 to
48e27b5
Compare
48e27b5 to
d7f834b
Compare
Contributor
|
@fspmarshall See the table below for backport results.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Teleport was incorrectly generating an AccessDenied error when users who were authorized to copy files attempted to do so via a proxy that was configured for proxy recording mode.
Bug was originally introduced as part of the permission-handling refactor in #54081. That PR split up permissions into separate pre-calculated "permit" objects instead of passing around a bare access checker object. Part of that work necessitated separating out "access" permissions from "proxying" permissions. SSH file copying permissions needed to be evaluated as part of proxy recording mode, but that PR incorrectly omitted ssh file copying from the proxying permit.
Long-term, we would like to prevent this kind of oversight more robustly by moving away from using the
proxyingPermitin recording mode, in favor of either a dedicated permit type for recordings, or reusing theSSHAccessPermittype and hard-coding certain inapplicable permissions to safe defaults. It is confusing from a code-organization perspective to have standard proxying and recording proxying use the same permit type, and can be actively misleading since the proxy recording mode tends to function much more like a local access than like an invocation of the actual proxy subsystem.Fixes #58847
changelog: Fixed an issue where SSH file copying attempts would be spuriously denied in proxy recording mode