Add `tsh config` helper to generate OpenSSH client configuration #7437

timothyb89 · 2021-06-29T17:46:48Z

This adds a new subcommand, tsh config, to generate OpenSSH client configuration snippets that allow users to connect directly to nodes using the standard ssh client.

To support this change, tsh's known_hosts file has been modified to match the format required by OpenSSH when verifying hosts against certificates. Old-style known_hosts entries will be automatically replaced and pruned when the end user first logs in with an updated tsh. Small changes were additionally made to the keystore and key agent to pass the proxy host into AddKnownHostKeys and to support wildcard hostnames in known_hosts entries.

As an example, on my machine, the generated configuration from tsh config looks like this:

#
# Begin generated Teleport configuration for proxy.foo.example.com:3080 from `tsh config`
#

# Common flags for all foo.example.com hosts
Host *.foo.example.com proxy.foo.example.com
    UserKnownHostsFile "/Users/tim/.tsh/known_hosts"

# Flags for all foo.example.com hosts except the proxy
Host *.foo.example.com !proxy.foo.example.com
    Port 3022
    ProxyCommand ssh -p 3023 proxy.foo.example.com -s proxy:$(echo %h | cut -d '.' -f 1):%p

# Common flags for all leaf.example.com hosts
Host *.leaf.example.com proxy.foo.example.com
    UserKnownHostsFile "/Users/tim/.tsh/known_hosts"

# Flags for all leaf.example.com hosts except the proxy
Host *.leaf.example.com !proxy.foo.example.com
    Port 3022
    ProxyCommand ssh -p 3023 proxy.foo.example.com -s proxy:$(echo %h | cut -d '.' -f 1):%[email protected]

# End generated Teleport configuration

... and the revised ~/.tsh/known_hosts format looks like this:

@cert-authority proxy.foo.example.com,foo.example.com,*.foo.example.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCt6aILUzSic4xq/BmrLsIZNs2wfzNbVE0Qlft2dUo4Sb9mwODVhvYLDMfgI1nWsDCTcwWHbu1o0j6GxLhnyigEHJpavpBbn4YqutTQ1xp35dWMi76PSUu7bNCAx3IZz8E1JhELHzFUSFAY5CuyuIy+cxKsD+CdN0xFUNtjqozX6BCp8bcY+WQCNLDf8H1m8RST/FeTaBmPtBzxF6yei7ehczEcBTC1czbprQ7piiBI6CGNeE9zKdKYHDtbQyRGs8Cy56jCF0fgEdXO0p7DqJIcr0/IjmdW6OQku1MKC8v3VxusXCVxKuJ9T5TeiRPglyW6APy4iKZYAO40Wy2WONcf type=host
@cert-authority proxy.foo.example.com,leaf.example.com,*.leaf.example.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDWUE468X1slCu5xGDIZInkVdLRIi1FU6x6221+ecr9h1KVBP0flzSssRBS7Qfa47uJ+cJaak3/luwnUmIgtQX4ovU4r5MJuZhaAreYMF6A73vDMehhOUH3KsNkEvMwOlOREJYt2YM8RZ6eSLgyo/HDlX8BHfl4uKDd9qOqvKSNab5VDstEHuoslEEj8YG2v8FaBMKUjudheSzmzRvdeSKVy9FjHA5yZslXzcMS0S0QACL4BleWwzpp/zZ++xGiTbtdb50FKhrc7REQQHmec/O/N31mLyzsUnJjeBcipphX/iYVnnzgvY78N7RfBnebNmt4To1KCul1HVK9jgsqcrUf type=host

Fixes #3734

timothyb89 · 2021-06-29T18:18:58Z

Hi all, I've got a few open questions I'd especially like some feedback on here:

This mildly changes the semantics of tsh's keystore. Previously, tsh only wrote a single hostname, clusterName, into each known_hosts entry. With this change, entries need to have at least *.clusterName and proxyHost in their hosts list, and with just those two both OpenSSH and tsh ssh appear to work properly. However:
- It breaks the semantics of the GetKnownHostKeys - if I insert example.com, I could only retrieve it with *.example.com (or the proxy host, though occasionally the proxyHost and clusterName are identical)
- Because of this, 2 unit tests break. They could be fixed by retrieving *.example.com instead.
- I'm unclear if tsh ever depends on bare clusterName retrieval.
Given this, I've opted to additionally include the plain clusterName in each known_hosts entry. Is this the right thing to do?
As we're now inserting wildcard hosts, GetKnownHostKeys could only retrieve a literal *.example.com and would not match, say, foo.example.com. I have modified fsLocalNonSessionKeyStore.GetKnownHostKeys() to additionally match simple wildcard hostnames, however I don't believe this is used anywhere. While it does resolve a soundness issue, it does increase attack surface. Is this a change we want to keep?
Should we stick with tsh config ssh or instead use @r0mant's suggestion in Provide an easy option to setup OpenSSH Config. #3734 (comment) to use just tsh config?

lib/client/known_hosts_migrate.go

tool/tsh/config.go

tool/tsh/tsh.go

webvictim

Just a couple of general implementation questions:

How does this work with IP addresses? A lot of customers/PoCs still use ssh [email protected] - will this handle IP ranges OK?
What happens if proxy_service.public_addr isn't set for a given cluster?

timothyb89 · 2021-07-07T00:15:23Z

How does this work with IP addresses? A lot of customers/PoCs still use ssh [email protected] - will this handle IP ranges OK?

They won't work as-is, since both the config generation and known_hosts depend on having some predictable way of addressing nodes for a particular cluster. The existing OpenSSH client guide notes a similar limitation however as far as I can tell the node host certificates have their IPs listed as principals as well.

It could probably be made to work if we listed out every individual node IP in both the generated config and in ~/.tsh/known_hosts, but I'm not sure how I feel about doing that at this stage.

Maybe this is a good candidate to implement in a future pass, alongside Match exec host matching? I'll also note that recent versions of OpenSSH support a KnownHostsCommand directive which could generate a proper known hosts entry on the fly if needed.

What happens if proxy_service.public_addr isn't set for a given cluster?

It still generates the same output on my test cluster, I assume the client falls back to the address as written by the user if the public address is unset?

This adds a new subcommand, `tsh config ssh`, to generate OpenSSH client configuration snippets that allow users to connect directly to nodes using the standard `ssh` client. To support this change, tsh's `known_hosts` file has been modified to match the format required by OpenSSH when verifying hosts against certificates. Old-style `known_hosts` entries will be automatically replaced and pruned when the end user first logs in with an updated `tsh`. Small changes were additionally made to the keystore and key agent to pass the proxy host into `AddKnownHostKeys` and to support wildcard hostnames in `known_hosts` entries.

@r0mant

This changes the config helper to use just `tsh config` per suggestion from @r0mant.

russjones · 2021-07-16T01:17:04Z

@r0mant @xacrimon @jane Can you review?

docs/pages/server-access/guides/openssh.mdx

lib/client/keystore.go

r0mant · 2021-07-16T14:10:41Z

lib/client/known_hosts_migrate.go

+	// exists. If not, pass it through.
+	for _, entry := range oldEntries {
+		if canPruneOldHostsEntry(entry, newEntries) {
+			log.Debugf("Pruning old known_hosts entry for %s.", entry.hosts[0])


Check hosts length?

Old entries have their length checked in isOldStyleHostsEntry() and are guaranteed to have exactly 1 host entry. Additionally, crypto/ssh's ParseKnownHosts rejects lines without any hosts so the list should never be empty to begin with.

If this is still problematic for code style reasons I'm happy to add more checks, though.

lib/client/known_hosts_migrate.go

r0mant · 2021-07-16T14:13:33Z

tool/tsh/config.go

+Host *.{{ .clusterName }} !{{ .proxyHost }}
+    Port 3022
+    {{- if .leaf }}
+    ProxyCommand ssh -p {{ .proxyPort }} {{ .proxyHost }} -s proxy:$(echo %h | cut -d '.' -f 1):%p@{{ .clusterName }}	


Can $(echo %h | cut -d '.' -f 1) be done by Go code instead and pasted here as a template variable?

Same below.

It is possible but would require another subcommand of some sort to be built into tsh. Per advice from @russjones we've decided to defer for a bit as the upcoming tsh connect functionality could supersede any text manipulation we do.

tool/tsh/config.go

Co-authored-by: Roman Tkachenko <[email protected]>

…al/teleport into timothyb89/ssh-config-helper

xacrimon

LGTM otherwise on the implementation

lib/client/known_hosts_migrate.go

lib/client/keystore.go

…ig-helper

russjones

Bot.

@r0mant

* Add `tsh config ssh` helper to generate OpenSSH client configuration This adds a new subcommand, `tsh config ssh`, to generate OpenSSH client configuration snippets that allow users to connect directly to nodes using the standard `ssh` client. To support this change, tsh's `known_hosts` file has been modified to match the format required by OpenSSH when verifying hosts against certificates. Old-style `known_hosts` entries will be automatically replaced and pruned when the end user first logs in with an updated `tsh`. Small changes were additionally made to the keystore and key agent to pass the proxy host into `AddKnownHostKeys` and to support wildcard hostnames in `known_hosts` entries. * Fix broken link to Trusted Clusters documentation * Use text/template for SSH config generation; wrap all errors. * Rename config helper from `config ssh` to just `config` This changes the config helper to use just `tsh config` per suggestion from @r0mant. * Fix known_hosts_migrate_test after rebase * First pass at review feedback * Update docs/pages/server-access/guides/openssh.mdx Co-authored-by: Roman Tkachenko <[email protected]> * Ensure top-level hostnames never match wildcard patterns * Add additional host count check to `canPruneOldHostsEntry`. * Replace excess call to `isOldStyleHostsEntry` with documented invariant * Trim trailing dots on absolute hostnames in `matchesWildcard` Co-authored-by: Roman Tkachenko <[email protected]>

@r0mant

…) (#7651) * Add `tsh config ssh` helper to generate OpenSSH client configuration This adds a new subcommand, `tsh config ssh`, to generate OpenSSH client configuration snippets that allow users to connect directly to nodes using the standard `ssh` client. To support this change, tsh's `known_hosts` file has been modified to match the format required by OpenSSH when verifying hosts against certificates. Old-style `known_hosts` entries will be automatically replaced and pruned when the end user first logs in with an updated `tsh`. Small changes were additionally made to the keystore and key agent to pass the proxy host into `AddKnownHostKeys` and to support wildcard hostnames in `known_hosts` entries. * Fix broken link to Trusted Clusters documentation * Use text/template for SSH config generation; wrap all errors. * Rename config helper from `config ssh` to just `config` This changes the config helper to use just `tsh config` per suggestion from @r0mant. * Fix known_hosts_migrate_test after rebase * First pass at review feedback * Update docs/pages/server-access/guides/openssh.mdx Co-authored-by: Roman Tkachenko <[email protected]> * Ensure top-level hostnames never match wildcard patterns * Add additional host count check to `canPruneOldHostsEntry`. * Replace excess call to `isOldStyleHostsEntry` with documented invariant * Trim trailing dots on absolute hostnames in `matchesWildcard` Co-authored-by: Roman Tkachenko <[email protected]> Co-authored-by: Roman Tkachenko <[email protected]>

timothyb89 requested review from xacrimon, fspmarshall, quinqu and inertial-frame June 29, 2021 17:46

timothyb89 requested review from klizhentas, r0mant and russjones as code owners June 29, 2021 17:46

This was referenced Jun 29, 2021

Provide an easy option to setup OpenSSH Config. #3734

Closed

OpenSSH functionality broken for Windows users on 6.1.0+ #6955

Closed

russjones reviewed Jun 30, 2021

View reviewed changes

lib/client/known_hosts_migrate.go Outdated Show resolved Hide resolved

tool/tsh/config.go Outdated Show resolved Hide resolved

tool/tsh/tsh.go Outdated Show resolved Hide resolved

webvictim reviewed Jul 5, 2021

View reviewed changes

timothyb89 added 4 commits July 8, 2021 16:47

Fix broken link to Trusted Clusters documentation

1973fd1

Use text/template for SSH config generation; wrap all errors.

f78ffdb

Rename config helper from config ssh to just config

4a02b15

This changes the config helper to use just `tsh config` per suggestion from @r0mant.

timothyb89 force-pushed the timothyb89/ssh-config-helper branch from 18e01e3 to 4a02b15 Compare July 8, 2021 22:49

Fix known_hosts_migrate_test after rebase

75c9790

timothyb89 changed the title ~~Add tsh config ssh helper to generate OpenSSH client configuration~~ Add tsh config helper to generate OpenSSH client configuration Jul 12, 2021

Merge branch 'master' into timothyb89/ssh-config-helper

a022a13

r0mant reviewed Jul 16, 2021

View reviewed changes

First pass at review feedback

8edfa87

timothyb89 force-pushed the timothyb89/ssh-config-helper branch from 3045327 to 8edfa87 Compare July 16, 2021 17:49

timothyb89 and others added 5 commits July 19, 2021 13:45

Update docs/pages/server-access/guides/openssh.mdx

2823c69

Co-authored-by: Roman Tkachenko <[email protected]>

Ensure top-level hostnames never match wildcard patterns

1bca517

Merge branch 'timothyb89/ssh-config-helper' of github.com:gravitation…

9a1bb50

…al/teleport into timothyb89/ssh-config-helper

Add additional host count check to canPruneOldHostsEntry.

b596ce6

Merge branch 'master' into timothyb89/ssh-config-helper

c9593e4

xacrimon reviewed Jul 20, 2021

View reviewed changes

lib/client/known_hosts_migrate.go Outdated Show resolved Hide resolved

timothyb89 added 2 commits July 20, 2021 14:33

Replace excess call to isOldStyleHostsEntry with documented invariant

5b6b0f8

Merge branch 'master' into timothyb89/ssh-config-helper

71eda99

fspmarshall approved these changes Jul 21, 2021

View reviewed changes

lib/client/keystore.go Show resolved Hide resolved

xacrimon approved these changes Jul 21, 2021

View reviewed changes

timothyb89 added 2 commits July 21, 2021 14:28

Trim trailing dots on absolute hostnames in matchesWildcard

7bde3e1

Merge remote-tracking branch 'origin/master' into timothyb89/ssh-conf…

e619ea9

…ig-helper

r0mant approved these changes Jul 22, 2021

View reviewed changes

russjones approved these changes Jul 22, 2021

View reviewed changes

timothyb89 enabled auto-merge (squash) July 22, 2021 19:40

Merge branch 'master' into timothyb89/ssh-config-helper

d04f688

timothyb89 merged commit 9a9562b into master Jul 22, 2021

timothyb89 deleted the timothyb89/ssh-config-helper branch July 22, 2021 20:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add `tsh config` helper to generate OpenSSH client configuration #7437

Add `tsh config` helper to generate OpenSSH client configuration #7437

timothyb89 commented Jun 29, 2021 •

edited by russjones

Loading

timothyb89 commented Jun 29, 2021

webvictim left a comment

timothyb89 commented Jul 7, 2021

russjones commented Jul 16, 2021

r0mant Jul 16, 2021

timothyb89 Jul 19, 2021

r0mant Jul 16, 2021

timothyb89 Jul 16, 2021

xacrimon left a comment

russjones left a comment

Add tsh config helper to generate OpenSSH client configuration #7437

Add tsh config helper to generate OpenSSH client configuration #7437

Conversation

timothyb89 commented Jun 29, 2021 • edited by russjones Loading

timothyb89 commented Jun 29, 2021

webvictim left a comment

Choose a reason for hiding this comment

timothyb89 commented Jul 7, 2021

russjones commented Jul 16, 2021

r0mant Jul 16, 2021

Choose a reason for hiding this comment

timothyb89 Jul 19, 2021

Choose a reason for hiding this comment

r0mant Jul 16, 2021

Choose a reason for hiding this comment

timothyb89 Jul 16, 2021

Choose a reason for hiding this comment

xacrimon left a comment

Choose a reason for hiding this comment

russjones left a comment

Choose a reason for hiding this comment

Add `tsh config` helper to generate OpenSSH client configuration #7437

Add `tsh config` helper to generate OpenSSH client configuration #7437

timothyb89 commented Jun 29, 2021 •

edited by russjones

Loading