Skip to content

fix sftp via proxy recording mode#58951

Merged
fspmarshall merged 1 commit intomasterfrom
fspmarshall/proxy-permit-fix
Sep 10, 2025
Merged

fix sftp via proxy recording mode#58951
fspmarshall merged 1 commit intomasterfrom
fspmarshall/proxy-permit-fix

Conversation

@fspmarshall
Copy link
Copy Markdown
Contributor

Teleport was incorrectly generating an AccessDenied error when users who were authorized to copy files attempted to do so via a proxy that was configured for proxy recording mode.

Bug was originally introduced as part of the permission-handling refactor in #54081. That PR split up permissions into separate pre-calculated "permit" objects instead of passing around a bare access checker object. Part of that work necessitated separating out "access" permissions from "proxying" permissions. SSH file copying permissions needed to be evaluated as part of proxy recording mode, but that PR incorrectly omitted ssh file copying from the proxying permit.

Long-term, we would like to prevent this kind of oversight more robustly by moving away from using the proxyingPermit in recording mode, in favor of either a dedicated permit type for recordings, or reusing the SSHAccessPermit type and hard-coding certain inapplicable permissions to safe defaults. It is confusing from a code-organization perspective to have standard proxying and recording proxying use the same permit type, and can be actively misleading since the proxy recording mode tends to function much more like a local access than like an invocation of the actual proxy subsystem.

Fixes #58847

changelog: Fixed an issue where SSH file copying attempts would be spuriously denied in proxy recording mode

Copy link
Copy Markdown
Contributor

@rosstimothy rosstimothy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've tested this with the reproduction steps stated in the issue before and after this change and can confirm that upload and downloading of files works via the UI and the command line in proxy recording and node recording modes.

Comment thread lib/srv/authhandlers.go Outdated
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Sep 9, 2025
@fspmarshall fspmarshall force-pushed the fspmarshall/proxy-permit-fix branch from 4ad7221 to 48e27b5 Compare September 10, 2025 16:44
@fspmarshall fspmarshall force-pushed the fspmarshall/proxy-permit-fix branch from 48e27b5 to d7f834b Compare September 10, 2025 22:18
@fspmarshall fspmarshall added this pull request to the merge queue Sep 10, 2025
Merged via the queue into master with commit 0a7c81d Sep 10, 2025
42 checks passed
@fspmarshall fspmarshall deleted the fspmarshall/proxy-permit-fix branch September 10, 2025 23:03
@backport-bot-workflows
Copy link
Copy Markdown
Contributor

@fspmarshall See the table below for backport results.

Branch Result
branch/v18 Create PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SFTP No longer functional on 18.2.0

4 participants