Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improving regular SSH port forwarding audit logs #50932

Merged
merged 1 commit into from
Jan 17, 2025

Conversation

eriktate
Copy link
Contributor

@eriktate eriktate commented Jan 9, 2025

This PR emits some additional events for SSH port forwarding and adds some context around local/remote when possible. The emitted events should look like the following:

  • Local port forwarding logs a start and end event per connection.
  • Remote port forwarding for the regular SSH server logs a start and end event per forwarding session as well as per connection.
  • Remote and local port forwarding for the forward SSH server log an event for everything, but the session-level events do not differentiate between remote/local. There are some small issues with properly capturing event data for the forward server, so I've not included the new events in this PR. I plan on addressing this in a follow up

Every event should contain the remote, local, and target address where applicable. For remote forwarding, session-level events will show the requester as the remote address whereas connection-level events should show the client address initiating the connection.

changelog: Added more granular audit logging surrounding SSH port forwarding

@github-actions github-actions bot added audit-log Issues related to Teleports Audit Log size/md labels Jan 9, 2025
lib/sshutils/tcpip_test.go Outdated Show resolved Hide resolved
lib/srv/ctx.go Outdated Show resolved Hide resolved
lib/srv/forward/sshserver.go Outdated Show resolved Hide resolved
lib/srv/forward/sshserver.go Outdated Show resolved Hide resolved
lib/srv/regular/sshserver.go Outdated Show resolved Hide resolved
lib/srv/regular/sshserver.go Outdated Show resolved Hide resolved
@eriktate eriktate force-pushed the eriktate/ssh-port-forwarding-audit-logs branch from ef0154f to f51fada Compare January 14, 2025 02:39
@rosstimothy
Copy link
Contributor

rosstimothy commented Jan 14, 2025

It looks like the events are now being emitted in the right places, though I'm seeing a few things that still need to be addressed.

The logs are spewing the following when emitting events:

ERRO  Attempted to convert dynamic event of unknown type into protobuf event. event_type:port.local events/dynamic.go:483

The web ui is unable to render the forwarding events:

image

@eriktate eriktate force-pushed the eriktate/ssh-port-forwarding-audit-logs branch 5 times, most recently from 3d0ccd6 to fbb1383 Compare January 15, 2025 21:22
lib/srv/regular/sshserver_test.go Outdated Show resolved Hide resolved
lib/srv/regular/sshserver_test.go Outdated Show resolved Hide resolved
lib/srv/regular/sshserver_test.go Outdated Show resolved Hide resolved
@rosstimothy
Copy link
Contributor

Can you please update the PR title and description to reflect that this is not updating events emitted by the forwarding server and that will happen in the future?

@eriktate eriktate force-pushed the eriktate/ssh-port-forwarding-audit-logs branch from 16d5cf4 to 94fefc5 Compare January 16, 2025 16:58
@eriktate eriktate changed the title Improving SSH port forwarding audit logs Improving regular SSH port forwarding audit logs Jan 16, 2025
@eriktate eriktate force-pushed the eriktate/ssh-port-forwarding-audit-logs branch 4 times, most recently from 7dad152 to 048518e Compare January 16, 2025 18:03
@eriktate eriktate force-pushed the eriktate/ssh-port-forwarding-audit-logs branch from 835ec45 to bf6fcae Compare January 16, 2025 23:10
@eriktate eriktate added this pull request to the merge queue Jan 17, 2025
Merged via the queue into master with commit 707c2ac Jan 17, 2025
45 checks passed
@eriktate eriktate deleted the eriktate/ssh-port-forwarding-audit-logs branch January 17, 2025 01:23
@public-teleport-github-review-bot

@eriktate See the table below for backport results.

Branch Result
branch/v15 Failed
branch/v16 Failed
branch/v17 Failed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants