[v15] Backport Secrets scanner #44800
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Add the device assertion protos * Update generated protos
* Add a client-side API to assert devices * Add a godoc to authnStreamAdapter
* Define server-side device assertion interfaces * Update proto comments * Update generated protos
…43462) This PR introduces the `teleport.access_graph.v1.SecretsScannerService`that will be used by Teleport SSH nodes to report `authorized_keys` and user's laptops to report secrets found on them. The `ReportAuthorizedKeys` uses node's TLS certs signed by HostCA for authentication while `ReportSecrets` leverages the device trust credentials (requires that the device is enrolled) to report secrets without requiring valid user credentials. handle Alan's feedback
…se (#43467) This PR exposes the configuration for nodes to be aware that they should report SSH Authorized keys to Teleport. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]>
…s Graph resources (#43468) This PR extends the Access Graph resources to be able include the newly added `teleport.access_graph.v1.PrivateKey`, `teleport.access_graph.v1.AuthorizedKey` and existing device trust information `teleport.devicetrust.v1.Device`. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]>
This PR makes `generic.Service` correctly implementing `List*` functions when multiple key prefixes are defined Signed-off-by: Tiago Silva <[email protected]>
* [sec_scan][5] add secrets backend service This PR implements the backend service to support storing `authorized_keys` and `private_keys` into Teleport backend. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]> * handle feedback * handle nits --------- Signed-off-by: Tiago Silva <[email protected]>
This PR adds the ability to watch for events for `*devicepb.Device` objects. Backend storage representation of `devicepb.Device` is achieved using an internal representation that lives in `e/lib/devicetrust/storage` and whose logic is internal to the package. To be able to expose the unmarshal logic necessary for events to work, this PR exposes a registration hook that `e/lib/devicetrust/storage` function must call during initialization to register the unmarshal function. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]>
This PR introduces the ability to watch for events related to `accessgraphsecretsv1pb.AuthorizedKey` and `accessgraphsecretsv1pb.PrivateKey` objects. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]>
This PR adds the `clusterconfigpbv1.AccessGraphSettings` resource that will be used to control the secrets scanning definition of Teleport. This resource will be a singleton and the only goal is to carry some settings related to access graph because on the cloud, users don't have access to fileconf. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]>
This PR adds the boilerplate code and proto definition for `AccessGraphSettingsUpdate` audit event. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]>
This PR adds the backend service to be able to create, update and retrieve access graph configurations from Teleport backend. This PR is part of gravitational/access-graph#637.
…#44016) * [sec_scan][12] add cache and events support for `AccessGraphSettings` This PR adds the cache and events support for the new resource `AccessGraphSettings`. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * add tests --------- Signed-off-by: Tiago Silva <[email protected]>
This PR introduces the gRPC implementation for the CRUD operations related to `AccessGraphSettings`. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]>
* [sec_scan][14] create `AccessGraphSettings` on first auth init This PR adds a init script that sets `AccessGraphSettings` into Teleport backend when auth first inits and there is no `AccessGraphSettings`. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * remove iterations --------- Signed-off-by: Tiago Silva <[email protected]>
…tl` (#44055) This PR allows any cluster admin to edit `access_graph_settings` objects via `tctl`. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]>
…ns (#44081) This PR adds methods to store/retrieve functions defined by different teleport services. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]>
* [sec_scan][17] add `AssertDevice` to `FakeDeviceService` This PR introduces a `AssertDevice` logic into `FakeDeviceService` to authenticate devices during unit tests using device trust credentials. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * simplify assert tests * Update lib/devicetrust/assert/assert_test.go Co-authored-by: Alan Parra <[email protected]> --------- Signed-off-by: Tiago Silva <[email protected]> Co-authored-by: Alan Parra <[email protected]>
… server (#44324) * [sec_scan][20] add `ReportSecrets` forwarder to proxy's gRPC insecure server This PR implements a `ReportSecrets` forwarder from Proxy server to Auth server. The goal is to allow clients to hit the proxy insecure gRPC server (credentialless) and proxy will forward requests to the AuthServer on behalf of the client. This is required because the client doesn't have valid credentials and it wasn't possible for it to reach auth server via reversetunnel when the cluster uses `separate` mode. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * add comments * move dial to lib/client/proxy/insecure --------- Signed-off-by: Tiago Silva <[email protected]>
* [sec_scan][19] add `tsh scan keys` implementation This PR introduces the required code to transverse a directory(es), finding all the SSH private keys and report them back to the cluster using the device security enclave as authentication mechanism. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * handle code review * fix message * handle code review * fork ssh private keys * add skip dirs support * handle code review --------- Signed-off-by: Tiago Silva <[email protected]>
* [sec_scan][22] add authorized keys reporter This PR introduces a SSH authorized keys reporter that monitors `/etc/passwd` file and all users' authorized_keys files and reports the findings back to teleport. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]> * handle comments * handle comments --------- Signed-off-by: Tiago Silva <[email protected]>
This PR adds ability to extract the comment and key type from AuthorizedKeys files. Signed-off-by: Tiago Silva <[email protected]>
tigrato
added
the
no-changelog
![orca-security-us[bot]](https://avatars.githubusercontent.com/in/276250?s=60&v=4){kind=small}
This comment was marked as duplicate.
This comment was marked as duplicate.
Sorry, something went wrong.
This comment was marked as duplicate.
This comment was marked as duplicate.
Sorry, something went wrong.
tigrato
force-pushed
the
tigrato/sec-scan-v15
branch
from
40de330 to
11eee03
Compare
This comment was marked as duplicate.
This comment was marked as duplicate.
Sorry, something went wrong.
tigrato
force-pushed
the
tigrato/sec-scan-v15
branch
from
11eee03 to
ee66346
Compare
This comment was marked as duplicate.
This comment was marked as duplicate.
Sorry, something went wrong.
tigrato
force-pushed
the
tigrato/sec-scan-v15
branch
from
ee66346 to
712caa5
Compare
This comment was marked as duplicate.
This comment was marked as duplicate.
Sorry, something went wrong.
tigrato
force-pushed
the
tigrato/sec-scan-v15
branch
from
712caa5 to
3e6e2a5
Compare
There was a problem hiding this comment.
Orca Security Scan Summary
| Status | Check | Issues by priority | |
|---|---|---|---|
 Failed |
Secrets |  19  0  0  0 |
View in Orca |
🔑 The following Secrets have been detected in your pull request across all commits
| NAME | FILE | LINE NUM | COMMIT | ||
|---|---|---|---|---|---|
|
Private Key | ...data/invalid_keys.go | 44 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 265 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 168 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 162 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 207 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 78 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 42 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 23 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 131 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 29 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 10 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 140 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 115 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 107 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 50 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 35 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 280 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 243 | 72457a8 | View in code |
|
Private Key | ...testdata/ssh_keys.go | 150 | 72457a8 | View in code |
github-actions
bot
added
audit-log
|
@tigrato - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes. |
* [sec_scan][27] add support for LDAP users and macOS This PR extends support for authorized keys report for users managed by LDAP system and macOS targets. It leverages `getpwent` to read the system database files and retrieve the user properties. It doesn't use the `getpwent_r` because it's not available in macOS and because it's not (yet) standerdized > PLEASE NOTE: the `getpwent_r' function is not (yet) standardized. > The interface may change in later versions of this library. But > the interface is designed following the principals used for the > other reentrant functions so the chances are good this is what the > POSIX people would choose. Part of gravitational/access-graph#637 * handle comments * handle comments 2 * add comment
ryanclark
approved these changes
Aug 11, 2024
r0mant
approved these changes
Aug 13, 2024
public-teleport-github-review-bot
bot
removed the request for review
from justinas
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport #43804 to branch/v15
Backport #43890 to branch/v15
Backport #44036 to branch/v15
Backport #43462 to branch/v15
Backport #43467 to branch/v15
Backport #43468 to branch/v15
Backport #43486 to branch/v15
Backport #43543 to branch/v15
Backport #43905 to branch/v15
Backport #43906 to branch/v15
Backport #44010 to branch/v15
Backport #44011 to branch/v15
Backport #44014 to branch/v15
Backport #44016 to branch/v15
Backport #44021 to branch/v15
Backport #44032 to branch/v15
Backport #44055 to branch/v15
Backport #44081 to branch/v15
Backport #44159 to branch/v15
Backport #44324 to branch/v15
Backport #44220 to branch/v15
Backport #44523 to branch/v15
Backport #44643 to branch/v15
Backport #45109 to branch/v15