summaryrefslogtreecommitdiffhomepage
path: root/ssh/tailssh
AgeCommit message (Collapse)AuthorFilesLines
2024-07-29cmd/k8s-operator,k8s-operator/sessionrecording,sessionrecording,ssh/tailssh: ↵Irbe Krumina3-194/+5
refactor session recording functionality (#12945) cmd/k8s-operator,k8s-operator/sessionrecording,sessionrecording,ssh/tailssh: refactor session recording functionality Refactor SSH session recording functionality (mostly the bits related to Kubernetes API server proxy 'kubectl exec' session recording): - move the session recording bits used by both Tailscale SSH and the Kubernetes API server proxy into a shared sessionrecording package, to avoid having the operator to import ssh/tailssh - move the Kubernetes API server proxy session recording functionality into a k8s-operator/sessionrecording package, add some abstractions in preparation for adding support for a second streaming protocol (WebSockets) Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-07-08cmd/k8s-operator,ssh/tailssh,tsnet: optionally record 'kubectl exec' ↵Irbe Krumina2-125/+137
sessions via Kubernetes operator's API server proxy (#12274) cmd/k8s-operator,ssh/tailssh,tsnet: optionally record kubectl exec sessions The Kubernetes operator's API server proxy, when it receives a request for 'kubectl exec' session now reads 'RecorderAddrs', 'EnforceRecorder' fields from tailcfg.KubernetesCapRule. If 'RecorderAddrs' is set to one or more addresses (of a tsrecorder instance(s)), it attempts to connect to those and sends the session contents to the recorder before forwarding the request to the kube API server. If connection cannot be established or fails midway, it is only allowed if 'EnforceRecorder' is not true (fail open). Updates tailscale/corp#19821 Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: Maisem Ali <maisem@tailscale.com>
2024-06-20ssh/tailssh: fix integration test (#12562)Irbe Krumina1-1/+1
Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-06-20ssh/tailssh: replace incubator process with su instead of running su as childPercy Wegmann3-49/+177
This allows the SSH_AUTH_SOCK environment variable to work inside of su and agent forwarding to succeed. Fixes #12467 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-06-18proxymap, various: distinguish between different protocolsAndrew Dunham2-3/+7
Previously, we were registering TCP and UDP connections in the same map, which could result in erroneously removing a mapping if one of the two connections completes while the other one is still active. Add a "proto string" argument to these functions to avoid this. Additionally, take the "proto" argument in LocalAPI, and plumb that through from the CLI and add a new LocalClient method. Updates tailscale/corp#20600 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I35d5efaefdfbf4721e315b8ca123f0c8af9125fb
2024-06-12ssh/tailssh: check IsSELinuxEnforcing in tailscaled processPercy Wegmann2-16/+38
Checking in the incubator as this used to do fails because the getenforce command is not on the PATH. Updates #12442 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-05-29ssh/tailssh: fall back to using su when no TTY available on LinuxPercy Wegmann5-246/+613
This allows pam authentication to run for ssh sessions, triggering automation like pam_mkhomedir. Updates #11854 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-05-03ssh/tailssh: plumb health.Tracker in testBrad Fitzpatrick1-1/+1
In prep for it being required in more places. Updates #11874 Change-Id: Ib743205fc2a6c6ff3d2c4ed3a2b28cac79156539 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-05-03ssh/tailssh: use ptr.To in testBrad Fitzpatrick1-3/+2
Updates #cleanup Change-Id: Ic98ba1b63c8205084b30f59f0ca343788edea5b0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-05-01ssh/tailssh: add integration testPercy Wegmann3-1/+430
Updates tailscale/corp#11854 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-04-23ssh/tailssh: try fetching group IDs for user with the 'id' commandAndrew Dunham1-8/+2
Since the tailscaled binaries that we distribute are static and don't link cgo, we previously wouldn't fetch group IDs that are returned via NSS. Try shelling out to the 'id' command, similar to how we call 'getent', to detect such cases. Updates #11682 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I9bdc938bd76c71bc130d44a97cc2233064d64799
2024-04-22ipn/ipnlocal,ssh/tailssh: reject c2n /update if SSH conns are active (#11820)Andrew Lytvynov1-0/+7
Since we already track active SSH connections, it's not hard to proactively reject updates until those finish. We attempt to do the same on the control side, but the detection latency for new connections is in the minutes, which is not fast enough for common short sessions. Handle a `force=true` query parameter to override this behavior, so that control can still trigger an update on a server where some long-running abandoned SSH session is open. Updates https://github.com/tailscale/corp/issues/18556 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2024-04-16all: use Go 1.22 range-over-intBrad Fitzpatrick1-1/+1
Updates #11058 Change-Id: I35e7ef9b90e83cac04ca93fd964ad00ed5b48430 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-02-08all: use reflect.TypeFor now available in Go 1.22 (#11078)Joe Tsai1-1/+1
Updates #cleanup Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2024-01-05ssh/tailssh: use a local error instead of gossh.ErrDenied (#10743)Andrew Lytvynov1-9/+13
ErrDenied was added in [our fork of x/crypto/ssh](https://github.com/golang/crypto/commit/acc6f8fe8d618cba34d44e89fdde304f98c576df) to short-circuit auth attempts once one fails. In the case of our callbacks, this error is returned when SSH policy check determines that a connection should not be allowed. Both `NoClientAuthCallback` and `PublicKeyHandler` check the policy and will fail anyway. The `fakePasswordHandler` returns true only if `NoClientAuthCallback` succeeds the policy check, so it checks it indirectly too. The difference here is that a client might attempt all 2-3 auth methods instead of just `none` but will fail to authenticate regardless. Updates #8593 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-12-20all: cleanup unused code, part 1 (#10661)Andrew Lytvynov1-14/+12
Run `staticcheck` with `U1000` to find unused code. This cleans up about a half of it. I'll do the other half separately to keep PRs manageable. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-11-17ssh/tailssh: use control server time instead of local timeOx Cart1-0/+3
This takes advantage of existing functionality in ipn/ipnlocal to adjust the local clock based on periodic time signals from the control server. This way, when checking things like SSHRule expirations, calculations are protected incorrectly set local clocks. Fixes tailscale/corp#15796 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2023-11-09ssh/tailssh: add envknobs to force override forwarding, sftp, ptyBrad Fitzpatrick2-1/+27
Updates tailscale/corp#15735 Change-Id: Ib1303406be925c3231ce7e0950a173ad12626492 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-11-09ssh/tailssh: fix sftp metric increment locationBrad Fitzpatrick1-2/+4
We were incrementing the sftp metric on regular sessions too, not just sftp. Updates #cleanup Change-Id: I63027a39cffb3e03397c6e4829b1620c10fa3130 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-11-09ssh/tailssh,util: extract new osuser package from ssh code (#10170)Andrew Lytvynov1-86/+3
This package is a wrapper for os/user that handles non-cgo builds, gokrazy and user shells. Updates tailscale/corp#15405 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-10-03util/httpm, all: add a test to make sure httpm is used consistentlyBrad Fitzpatrick1-1/+2
Updates #cleanup Change-Id: I7dbf8a02de22fc6b317ab5e29cc97792dd75352c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-09-07ssh/tailssh: log when recording starts and finishes (#9294)Joe Tsai1-0/+2
Updates tailscale/corp#14579 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2023-08-23all: replace deprecated ioutil referencesMarwan Sulaiman1-2/+1
This PR removes calls to ioutil library and replaces them with their new locations in the io and os packages. Fixes #9034 Updates #5210 Signed-off-by: Marwan Sulaiman <marwan@tailscale.com>
2023-08-21types/netmap, all: make NetworkMap.SelfNode a tailcfg.NodeViewBrad Fitzpatrick2-3/+3
Updates #1909 Change-Id: I8c470cbc147129a652c1d58eac9b790691b87606 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-18types/netmap, all: use read-only tailcfg.NodeView in NetworkMapBrad Fitzpatrick3-15/+15
Updates #8948 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-17all: use Go 1.21 slices, maps instead of x/exp/{slices,maps}Brad Fitzpatrick2-2/+2
Updates #8419 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-08-15ssh/tailssh: fix gokrazy SSH crashBrad Fitzpatrick1-6/+8
Stupid mistake in earlier refactor. Updates gokrazy/gokrazy#209 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-07-21ssh: ignore io.EOF from sftp.Server.ServeJoe Tsai1-1/+6
If the connection provided to sftp.NewServer is closed, Serve returns the io.EOF error verbatim from io.Reader.Read. This is an odd error since this is an expected situation, so we manually ignore io.EOF. This is somewhat buggy since the sftp package itself incorrectly reports io.EOF in cases where it should actually be reporting io.ErrUnexpectedEOF. See https://github.com/pkg/sftp/pull/554 which patches Serve to return nil on clean closes and fixes buggy uses of io.ReadFull. Fixes #8592 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2023-06-21ssh/tailssh: fix double race condition with non-pty command (#8405)Joe Tsai3-44/+69
There are two race conditions in output handling. The first race condition is due to a misuse of exec.Cmd.StdoutPipe. The documentation explicitly forbids concurrent use of StdoutPipe with exec.Cmd.Wait (see golang/go#60908) because Wait will close both sides of the pipe once the process ends without any guarantees that all data has been read from the pipe. To fix this, we allocate the os.Pipes ourselves and manage cleanup ourselves when the process has ended. The second race condition is because sshSession.run waits upon exec.Cmd to finish and then immediately proceeds to call ss.Exit, which will close all output streams going to the SSH client. This may interrupt any asynchronous io.Copy still copying data. To fix this, we close the write-side of the os.Pipes after the process has finished (and before calling ss.Exit) and synchronously wait for the io.Copy routines to finish. Fixes #7601 Signed-off-by: Joe Tsai <joetsai@digital-static.net> Co-authored-by: Maisem Ali <maisem@tailscale.com>
2023-06-21Revert "ssh/tailssh: change to user directory when running login/command"Brad Fitzpatrick1-10/+10
This reverts commit dc5bc32d8fbacd7e1dd34d138de542d401a11ebd. It broke tests. (sadly, ones which we have disabled on CI, but go test ./ssh/tailssh broke)
2023-06-21ssh/tailssh: change to user directory when running login/commandDerek Burdick1-10/+10
On redhat 9 and similarly locked down systems, root user does not have access to a users directory. This fix does not set a directory for the incubator process and instead sets the directory when the actual process requested by remote user is executed. Fixes #8118 Signed-off-by: Derek Burdick <derek-burdick@users.noreply.github.com>
2023-06-20ssh/tailssh: work around lack of scontext in SELinuxMaisem Ali1-4/+13
Trying to SSH when SELinux is enforced results in errors like: ``` ➜ ~ ssh ec2-user@<ip> Last login: Thu Jun 1 22:51:44 from <ip2> ec2-user: no shell: Permission denied Connection to <ip> closed. ``` while the `/var/log/audit/audit.log` has ``` type=AVC msg=audit(1685661291.067:465): avc: denied { transition } for pid=5296 comm="login" path="/usr/bin/bash" dev="nvme0n1p1" ino=2564 scontext=system_u:system_r:unconfined_service_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process permissive=0 ``` The right fix here would be to somehow install the appropriate context when tailscale is installed on host, but until we figure out a way to do that stop using the `login` cmd in these situations. Updates #4908 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-06-09ssh/tailssh: add support for remote/reverse port forwardingMaisem Ali1-3/+20
This basically allows running services on the SSH client and reaching them from the SSH server during the session. Updates #6575 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-06-05ssh/tailssh: Max Username Length 256 for linuxDerek Burdick1-1/+5
Max username length is increased to 256 on linux to match /usr/include/bits/local_lim.h Fixes #8277 Signed-off-by: Derek Burdick <derek-burdick@users.noreply.github.com>
2023-05-22ssh/tailssh: add ssh session recording failed event typeCharlotte Brandhorst-Satzkorn1-2/+11
This change introduces a SSHSessionRecordingFailed event type that is used when a session recording fails to start or fails during a session, and the on failure indicates that it should fail open. Updates tailscale/corp#9967 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2023-05-21ssh/tailssh: fix regression after LDAP supportBrad Fitzpatrick2-15/+22
58ab66ec51f1963fbee302c75ad0017d81d37884 added LDAP support for #4945 by shelling out to getdent. It was supposed to fall back to the old method when getdent wasn't found, but some variable name confusion (uid vs username) meant the old path wasn't calling the right lookup function (user.LookupId instead of user.Lookup). Which meant that changed probably also broke FreeBSD and macOS SSH support in addition to the reported OpenWRT regression. The gokrazy support didn't look right either. Fixes #8180 Change-Id: I273bbe96fe98b2517fbf0335fd476b483c051554 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-18ssh/tailssh: close tty on session closeMaisem Ali2-11/+24
We were only closing on side of the pty/tty pair. Close the other side too. Thanks to @fritterhoff for reporting and debugging the issue! Fixes #8119 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-05-08ssh/tailssh: move some user-related code into new user.goBrad Fitzpatrick2-109/+113
The previous commit 58ab66e added ssh/tailssh/user.go as part of working on #4945. So move some more user-related code over to it. Updates #cleanup Change-Id: I24de66df25ffb8f867e1a0a540d410f9ef16d7b0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-08ssh/tailssh: support LDAP users for Tailscale SSHBrad Fitzpatrick4-28/+140
Fixes #4945 Change-Id: Ie013cb47684cb87928a44f92c66352310bfe53f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-05ssh/tailssh,tailcfg: add connID to ssheventnotifyrequest and castheaderCharlotte Brandhorst-Satzkorn1-13/+16
This change adds a ConnectionID field to both SSHEventNotifyRequest and CastHeader that identifies the ID of a connection to the SSH server. Updates tailscale/corp#9967 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2023-05-05ssh/tailssh: send ssh event notifications on recording failuresCharlotte Brandhorst-Satzkorn2-10/+91
This change sends an SSHEventNotificationRequest over noise when a SSH session is set to fail closed and the session is unable to start because a recorder is not available or a session is terminated because connection to the recorder is ended. Each of these scenarios have their own event type. Updates tailscale/corp#9967 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2023-05-04tsd: add package with System type to unify subsystem init, discoveryBrad Fitzpatrick1-5/+6
This is part of an effort to clean up tailscaled initialization between tailscaled, tailscaled Windows service, tsnet, and the mac GUI. Updates #8036 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-03ssh/tailssh: restore support for recording locallyMaisem Ali1-32/+64
We removed it earlier in 916aa782af5d43ccfa92f6245201796df212fb8a, but we still want to support it for some time longer. Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-05-01ssh/tailssh: improve debug logging around revoked sessionsTom DNetto1-0/+11
Updates https://github.com/tailscale/corp/issues/10943 Signed-off-by: Tom DNetto <tom@tailscale.com>
2023-04-25ssh/tailssh: also handle recording upload failure during writesMaisem Ali1-15/+30
Previously we would error out when the recording server disappeared after the in memory buffer filled up for the io.Copy. This makes it so that we handle failing open correctly in that path. Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-04-22ssh/tailssh: handle dialing multiple recorders and failing openMaisem Ali2-71/+253
This adds support to try dialing out to multiple recorders each with a 5s timeout and an overall 30s timeout. It also starts respecting the actions `OnRecordingFailure` field if set, if it is not set it fails open. Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-04-17various: add golangci-lint, fix issues (#7905)Andrew Dunham2-3/+3
This adds an initial and intentionally minimal configuration for golang-ci, fixes the issues reported, and adds a GitHub Action to check new pull requests against this linter configuration. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8f38fbc315836a19a094d0d3e986758b9313f163
2023-04-05ssh/tailssh: handle output matching better in tests (#7799)Maisem Ali1-2/+14
2023-04-04ssh/tailssh: make Tailscale SSH work on gokrazyBrad Fitzpatrick2-0/+14
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-03-28ssh/tailssh: fix race in errors returned when starting recorderMaisem Ali1-2/+13
There were two code paths that could fail depending on how fast the recorder responses. This fixes that by returning the correct error from both paths. Fixes #7707 Signed-off-by: Maisem Ali <maisem@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.