summaryrefslogtreecommitdiffhomepage
path: root/ssh/tailssh
AgeCommit message (Collapse)AuthorFilesLines
2023-05-03ssh/tailssh: restore support for recording locallyMaisem Ali1-32/+64
We removed it earlier in 916aa782af5d43ccfa92f6245201796df212fb8a, but we still want to support it for some time longer. Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-05-01ssh/tailssh: improve debug logging around revoked sessionsTom DNetto1-0/+11
Updates https://github.com/tailscale/corp/issues/10943 Signed-off-by: Tom DNetto <tom@tailscale.com>
2023-04-25ssh/tailssh: also handle recording upload failure during writesMaisem Ali1-15/+30
Previously we would error out when the recording server disappeared after the in memory buffer filled up for the io.Copy. This makes it so that we handle failing open correctly in that path. Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-04-22ssh/tailssh: handle dialing multiple recorders and failing openMaisem Ali2-71/+253
This adds support to try dialing out to multiple recorders each with a 5s timeout and an overall 30s timeout. It also starts respecting the actions `OnRecordingFailure` field if set, if it is not set it fails open. Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-04-17various: add golangci-lint, fix issues (#7905)Andrew Dunham2-3/+3
This adds an initial and intentionally minimal configuration for golang-ci, fixes the issues reported, and adds a GitHub Action to check new pull requests against this linter configuration. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I8f38fbc315836a19a094d0d3e986758b9313f163
2023-04-05ssh/tailssh: handle output matching better in tests (#7799)Maisem Ali1-2/+14
2023-04-04ssh/tailssh: make Tailscale SSH work on gokrazyBrad Fitzpatrick2-0/+14
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-03-28ssh/tailssh: fix race in errors returned when starting recorderMaisem Ali1-2/+13
There were two code paths that could fail depending on how fast the recorder responses. This fixes that by returning the correct error from both paths. Fixes #7707 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-25ssh/tailssh: add tests for recording failureMaisem Ali2-17/+139
Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-24ssh/tailssh: add session recording test for non-pty sessionsMaisem Ali1-2/+96
Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-23ssh/tailssh: handle session recording when running in userspace modeMaisem Ali2-3/+30
Previously it would dial out using the http.DefaultClient, however that doesn't work when tailscaled is running in userspace mode (e.g. when testing). Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-23ssh/tailssh: enable recording of non-pty sessionsMaisem Ali2-5/+3
Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-23ssh/tailssh: add docs to CastHeader fieldsMaisem Ali1-18/+51
Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-23all: pass log IDs as the proper type rather than stringsWill Norris1-1/+2
This change focuses on the backend log ID, which is the mostly commonly used in the client. Tests which don't seem to make use of the log ID just use the zero value. Signed-off-by: Will Norris <will@tailscale.com>
2023-03-23ssh/tailssh: always assert our final uid/gidAndrew Dunham1-9/+19
Move the assertions about our post-privilege-drop UID/GID out of the conditional if statement and always run them; I haven't been able to find a case where this would fail. Defensively add an envknob to disable this feature, however, which we can remove after the 1.40 release. Updates #7616 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Iaec3dba9248131920204bd6c6d34bbc57a148185
2023-03-23ssh/tailssh: lock OS thread during incubatorAndrew Dunham1-0/+10
This makes it less likely that we trip over bugs like golang/go#1435. Updates #7616 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ic28c03c3ad8ed5274a795c766b767fa876029f0e
2023-03-23ssh/tailssh: use background context for uploading recordingsMaisem Ali1-1/+6
Otherwise we see errors like ``` ssh-session(sess-20230322T005655-5562985593): recording: error sending recording to <addr>:80: Post "http://<addr>:80/record": context canceled ``` The ss.ctx is closed when the session closes, but we don't want to break the upload at that time. Instead we want to wait for the session to close the writer when it finishes, which it is already doing. Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-21ssh/tailssh: allow recorders to be configured on the first or final actionMaisem Ali1-4/+16
Currently we only send down recorders in first action, allow the final action to replace them but not to drop them. Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-21ssh/tailssh: add more metadata to recording headerMaisem Ali1-7/+18
Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-21ssh/tailssh: stream SSH recordings to configured recordersMaisem Ali1-31/+50
Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-21ssh/tailssh: make uid an int instead of uint64Andrew Dunham1-4/+4
Follow-up to #7615 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ib4256bff276f6d5cf95838d8e39c87b3643bde37
2023-03-20ssh/tailssh: fix privilege dropping on FreeBSD; add testsAndrew Dunham2-14/+400
On FreeBSD and Darwin, changing a process's supplementary groups with setgroups(2) will also change the egid of the process, setting it to the first entry in the provided list. This is distinct from the behaviour on other platforms (and possibly a violation of the POSIX standard). Because of this, on FreeBSD with no TTY, our incubator code would previously not change the process's gid, because it would read the newly-changed egid, compare it against the expected egid, and since they matched, not change the gid. Because we didn't use the 'login' program on FreeBSD without a TTY, this would propagate to a child process. This could be observed by running "id -p" in two contexts. The expected output, and the output returned when running from a SSH shell, is: andrew@freebsd:~ $ id -p uid andrew groups andrew However, when run via "ssh andrew@freebsd id -p", the output would be: $ ssh andrew@freebsd id -p login root uid andrew rgid wheel groups andrew (this could also be observed via "id -g -r" to print just the gid) We fix this by pulling the details of privilege dropping out into their own function and prepending the expected gid to the start of the list on Darwin and FreeBSD. Finally, we add some tests that run a child process, drop privileges, and assert that the final UID/GID/additional groups are what we expect. More information can be found in the following article: https://www.usenix.org/system/files/login/articles/325-tsafrir.pdf Updates #7616 Alternative to #7609 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I0e6513c31b121108b50fe561c89e5816d84a45b9
2023-03-13tailcfg,all: add and use Node.IsTagged()Maisem Ali1-1/+1
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-09ssh/tailssh: use context.WithCancelCauseMaisem Ali2-75/+31
It was using a custom implmentation of the context.WithCancelCause, replace usage with stdlib. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-02-25ssh/tailssh: try launching commands with /usr/bin/login on macOSMaisem Ali1-7/+52
Updates #4939 Co-authored-by: Adam Eijdenberg <adam@continusec.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-02-19ssh/tailssh: detect user shell correctly on darwinMaisem Ali1-4/+12
Updates #6213 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-02-01all: update to Go 1.20, use strings.CutPrefix/Suffix instead of our forkBrad Fitzpatrick2-4/+2
Updates #7123 Updates #5309 Change-Id: I90bcd87a2fb85a91834a0dd4be6e03db08438672 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-01-30ipn/ipnlocal: drop not required StateKey parameterMaisem Ali1-1/+1
This is #cleanup now that #7121 is merged. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-01-30net/memnet: rename from net/nettestMaisem Ali1-2/+2
This is just #cleanup to resolve a TODO Also add a package doc. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-01-27all: update copyright and license headersWill Norris5-15/+10
This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>
2023-01-09ssh/tailssh: add OpenBSD support for Tailscale SSHBrad Fitzpatrick2-3/+3
And bump go.mod for https://github.com/u-root/u-root/pull/2593 Change-Id: I36ec94c5b2b76d671cb739f1e9a1a43ca1d9d1b1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-01-06ssh/tailssh: fix Tailscale SSH to non-root tailscaledBrad Fitzpatrick1-1/+23
Fix regression from 337c77964bd1701e6562f388d2d71fcad6470ddd where tailscaled started calling Setgroups. Prior to that, SSH to a non-root tailscaled was working. Instead, ignore any failure calling Setgroups if the groups are already correct. Fixes #6888 Change-Id: I561991ddb37eaf2620759c6bcaabd36e0fb2a22d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-01-06ssh/tailssh: unify some of the incubator_* GOOS files into incubator.goBrad Fitzpatrick4-58/+36
In prep for fix for #6888 Change-Id: I79f780c6467a9b7ac03017b27d412d6b0d2f7e6b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-12-23ssh/tailssh: don't swallow process exit code in be-childBrad Fitzpatrick1-1/+14
Thanks to @nshalman and @Soypete for debugging! Updates #6054 Change-Id: I74550cc31f8a257b37351b8152634c768e1e0a8a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-12-20ssh/tailssh: fix typo in error messageBrad Fitzpatrick1-2/+2
"look up" is the verb. "lookup" is a noun. Change-Id: I81c99e12c236488690758fb5c121e7e4e1622a36 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-12-15ssh/tailssh: add envknob for default PATHBrad Fitzpatrick2-9/+49
As backup plan, just in case the earlier fix's logic wasn't correct and we want to experiment in the field or have users have a quicker fix. Updates #5285 Change-Id: I7447466374d11f8f609de6dfbc4d9a944770826d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-12-14ssh/tailssh: set default Tailscale SSH $PATH for non-interactive commandsBrad Fitzpatrick2-2/+112
Fixes #5285 Co-authored-by: Andrew Dunham <andrew@tailscale.com> Change-Id: Ic7e967bf6a53b056cac5f21dd39565d9c31563af Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-16ssh/tailssh: only call CloseWrite when both stdout and stderr are doneMaisem Ali1-1/+12
Updates #5209 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-11-11ipn/ipnlocal: add support for multiple user profilesMaisem Ali1-1/+1
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-11-10ssh/tailssh: add Tailscale SSH (server) support on FreeBSDPat Maddox3-2/+17
Change-Id: I607194b6ef99205e777f3df93a74ffe1a2e0344c Signed-off-by: Pat Maddox <pat@ratiopbc.com>
2022-11-04all: remove old +build tagsBrad Fitzpatrick4-4/+0
The //go:build syntax was introduced in Go 1.17: https://go.dev/doc/go1.17#build-lines gofmt has kept the +build and go:build lines in sync since then, but enough time has passed. Time to remove them. Done with: perl -i -npe 's,^// \+build.*\n,,' $(git grep -l -F '+build') Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-01ssh/tailssh: use root / as cmd.Dir when users HomeDir doesn't existMaisem Ali1-1/+10
Fixes #5224 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-11ssh/tailssh: add password-forcing workaround for buggy SSH clientsBrad Fitzpatrick2-11/+84
If the username includes a suffix of +password, then we accept password auth and just let them in like it were no auth. This exists purely for SSH clients that get confused by seeing success to their initial auth type "none". Co-authored-by: Maisem Ali <maisem@tailscale.com> Change-Id: I616d4c64d042449fb164f615012f3bae246e91ec Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-10all: fix more resource leaks found by staticmajorEmmanuel T Odeke1-1/+7
Updates #5706 Signed-off-by: Emmanuel T Odeke <emmanuel@orijtech.com>
2022-10-09ssh/tailssh: close sshContext on context cancellationMaisem Ali2-10/+13
This was preventing tailscaled from shutting down properly if there were active sessions in certain states (e.g. waiting in check mode). Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-09ssh/tailssh: add support for sending multiple bannersMaisem Ali2-68/+47
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-09ssh/tailssh: add TestSSHAuthFlowMaisem Ali2-14/+279
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-09ssh/tailssh: do the full auth flow during ssh authMaisem Ali3-331/+216
Fixes #5091 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-07ssh/tailssh: do not send EOT on session disconnectionMaisem Ali1-3/+0
This was assumed to be the fix for mosh not working, however turns out all we really needed was the duplicate fd also introduced in the same commit (af412e8874e94dc3ac57c37c3ec5e0606aa08fbb). Fixes #5103 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-04go.mod, ssh/tailssh: fix ImplictAuthMethod typoBrad Fitzpatrick1-1/+1
Fixes #5745 Change-Id: Ie8bc88bd465a9cb35b0ae7782d61ce96480473ee Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.